482bc75de3d0bdba995e7971809e815c7d5479fd5b48846e4f9a242a02e15314

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-09-2024 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6e6f40f66f5d27edcfddb824f3dfdf1_JaffaCakes118.html
Size

106KB
MD5

d6e6f40f66f5d27edcfddb824f3dfdf1
SHA1

0f696be63ad93ab4dbe76909fe1802d0a8c82252
SHA256

482bc75de3d0bdba995e7971809e815c7d5479fd5b48846e4f9a242a02e15314
SHA512

68a71e5e1773832d44f52bf146abc2957565893c29a04b744c22b32c4f6614e3dd5d21525ff8f54eba430c27d6aab8b42eb0be77e4c44eef12111903e0ef64b3
SSDEEP

1536:mmLHL0jge9yHekNMrgiegmneeqTUk5eeuAdjUsIqym/geeebRkj1Egebr0D/JeeF:m8LmOMr3Ks8PI7i9

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3060	msedge.exe
3060	msedge.exe
1404	identity_helper.exe
1404	identity_helper.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe
3416	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 864	3060	msedge.exe	83
PID 3060 wrote to memory of 864	3060	msedge.exe	83
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 736	3060	msedge.exe	84
PID 3060 wrote to memory of 3620	3060	msedge.exe	85
PID 3060 wrote to memory of 3620	3060	msedge.exe	85
PID 3060 wrote to memory of 2476	3060	msedge.exe	86
PID 3060 wrote to memory of 2476	3060	msedge.exe	86
PID 3060 wrote to memory of 2476	3060	msedge.exe	86
PID 3060 wrote to memory of 2476	3060	msedge.exe	86
PID 3060 wrote to memory of 2476	3060	msedge.exe	86
PID 3060 wrote to memory of 2476	3060	msedge.exe	86
PID 3060 wrote to memory of 2476	3060	msedge.exe	86
PID 3060 wrote to memory of 2476	3060	msedge.exe	86
PID 3060 wrote to memory of 2476	3060	msedge.exe	86
PID 3060 wrote to memory of 2476	3060	msedge.exe	86
PID 3060 wrote to memory of 2476	3060	msedge.exe	86
PID 3060 wrote to memory of 2476	3060	msedge.exe	86
PID 3060 wrote to memory of 2476	3060	msedge.exe	86
PID 3060 wrote to memory of 2476	3060	msedge.exe	86
PID 3060 wrote to memory of 2476	3060	msedge.exe	86
PID 3060 wrote to memory of 2476	3060	msedge.exe	86
PID 3060 wrote to memory of 2476	3060	msedge.exe	86
PID 3060 wrote to memory of 2476	3060	msedge.exe	86
PID 3060 wrote to memory of 2476	3060	msedge.exe	86
PID 3060 wrote to memory of 2476	3060	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d6e6f40f66f5d27edcfddb824f3dfdf1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcafda46f8,0x7ffcafda4708,0x7ffcafda4718
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,7229072925829058518,11332507083009335095,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,7229072925829058518,11332507083009335095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,7229072925829058518,11332507083009335095,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,7229072925829058518,11332507083009335095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,7229072925829058518,11332507083009335095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,7229072925829058518,11332507083009335095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,7229072925829058518,11332507083009335095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,7229072925829058518,11332507083009335095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,7229072925829058518,11332507083009335095,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,7229072925829058518,11332507083009335095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,7229072925829058518,11332507083009335095,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,7229072925829058518,11332507083009335095,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2776 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d3d1a3e06f6b7043219d1acf04aa98f9

SHA1
b15c65ee9925bb176ca8b94e59c96af3d4589a28

SHA256
6758818a4351111e552aab81fcb81ef90d97b51d097b8a7930f01246c3c6a845

SHA512
550704863c7853a805867e4313b7399ba3b9d3c8a8dfc6ad6cfc8711c2c0a55f22e2919419e0cd924bed1cf159b7696e0ac930c56f992fff988d6408239f3488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
07d78e6ace36e931f8112e34d8820553

SHA1
bfae7f4db63b5b3c007b45c689cd476278363165

SHA256
03ebae3db184969a7344c589a2c908fe39c0efb111a1097cc1d67153a840f10b

SHA512
7939579036e62229c3c3056a331dc51c1c6f236f33982032da4641cadcc3f3344439137e3236a04b04f9a07c4961b0166622cf3e95ac3c5d9c4437dc99506a35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
086536d6226dc033f54f922e1750829f

SHA1
69466ce94c939563a23b46458beabe0222c5e619

SHA256
e44ac88ce0d27b11bf6c31888a4b505dd0f59d43258b22811001e3c30bec57e3

SHA512
d1d88b33389cb4bd4c30ea670dcf90cefd820a9e1849a4355c586e3214208ea7fd9e296f7b5102d5c74e6f5c96be2415159adc75cd26bbf9731a444990e14591

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
73a084a94366ff9f294912f39856e91c

SHA1
16ba475deac1abe031cf2fc9f8a8d9359ab46ffc

SHA256
78e46f0e49e265e8186a8ff64605e9b8411db27cf2b8a724cc2350f9fec1c4c3

SHA512
c41bccb5ec4ca74d8c51f0b6dbbd51ea295bd34a357bee20b8e0a6b9783ecaeb0e4288f1fae9ec0b341db98617c382b85fa50617a6f64d3b6442747976582a46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
355f223a4419e32789a5954924aca5ad

SHA1
ae38c1925dd2d7a302f9df70786604484f96d795

SHA256
2ff5553ad16840e410d7574e6b892c523d65cb0c9cb3aa2e66eda9911f02cc6b

SHA512
221429908087b0455627f53581aa8ef6809885568a69df055bfa382a43e194d855db09eaf1ba8033643a02b86ff1a038f761c021301ac524d37dde61599d27a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a20907c7a3a57bf2f08aab80eda043a7

SHA1
bb25890409f98748dd5f9066cdb47e7e89e827c3

SHA256
3df6f4fb3a914b7b038820942e53f878a2d879f51147aff873df9779fcc69893

SHA512
6737931a67d44c2e7beca42d9e0ddaf4f331e57a91d6ad44bd569e727621e54cc681b914d18af63386cae8dd7c23b8970424196dee580dd50d069ffe97166340

Download Submit