f5a880daf981e8abd7818b2fc35a7472779a159b844661c3c046e8614d1ef177

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 12:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da520d7b080acccf454e6175dfae1b15_JaffaCakes118.html
Size

36KB
MD5

da520d7b080acccf454e6175dfae1b15
SHA1

26c810e3492a9e73cb0bf54cab40ec0d7e7b5287
SHA256

f5a880daf981e8abd7818b2fc35a7472779a159b844661c3c046e8614d1ef177
SHA512

7caacf74d33575f353df3602c793a4616d2cea2105aedf76815ddb1ae47d27dac6004e2e01cbfbf840cb5a172d30201cad272cc27d6a74d8e9b6cdea5f6e3b0e
SSDEEP

768:xs+rjIyCkCVCvCvCPCPCCCCCyCyCpCpC1C1C1C1C1C1C5yrvyOndV7BvR:xs+rjIyBEwwaaFFPPwwmmmmmmIyrvyOD

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe
2764	msedge.exe
2764	msedge.exe
4756	identity_helper.exe
4756	identity_helper.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 1088	2764	msedge.exe	82
PID 2764 wrote to memory of 1088	2764	msedge.exe	82
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2932	2764	msedge.exe	83
PID 2764 wrote to memory of 2164	2764	msedge.exe	84
PID 2764 wrote to memory of 2164	2764	msedge.exe	84
PID 2764 wrote to memory of 4896	2764	msedge.exe	85
PID 2764 wrote to memory of 4896	2764	msedge.exe	85
PID 2764 wrote to memory of 4896	2764	msedge.exe	85
PID 2764 wrote to memory of 4896	2764	msedge.exe	85
PID 2764 wrote to memory of 4896	2764	msedge.exe	85
PID 2764 wrote to memory of 4896	2764	msedge.exe	85
PID 2764 wrote to memory of 4896	2764	msedge.exe	85
PID 2764 wrote to memory of 4896	2764	msedge.exe	85
PID 2764 wrote to memory of 4896	2764	msedge.exe	85
PID 2764 wrote to memory of 4896	2764	msedge.exe	85
PID 2764 wrote to memory of 4896	2764	msedge.exe	85
PID 2764 wrote to memory of 4896	2764	msedge.exe	85
PID 2764 wrote to memory of 4896	2764	msedge.exe	85
PID 2764 wrote to memory of 4896	2764	msedge.exe	85
PID 2764 wrote to memory of 4896	2764	msedge.exe	85
PID 2764 wrote to memory of 4896	2764	msedge.exe	85
PID 2764 wrote to memory of 4896	2764	msedge.exe	85
PID 2764 wrote to memory of 4896	2764	msedge.exe	85
PID 2764 wrote to memory of 4896	2764	msedge.exe	85
PID 2764 wrote to memory of 4896	2764	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\da520d7b080acccf454e6175dfae1b15_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc77b46f8,0x7ffbc77b4708,0x7ffbc77b4718
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,1574385829570791920,1107704011293465886,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,1574385829570791920,1107704011293465886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,1574385829570791920,1107704011293465886,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1574385829570791920,1107704011293465886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1574385829570791920,1107704011293465886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1574385829570791920,1107704011293465886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,1574385829570791920,1107704011293465886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,1574385829570791920,1107704011293465886,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1574385829570791920,1107704011293465886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1574385829570791920,1107704011293465886,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1574385829570791920,1107704011293465886,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1574385829570791920,1107704011293465886,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,1574385829570791920,1107704011293465886,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
bbe6d22d51b2bea5c8a4fdf922548462

SHA1
becdc25bdf0d9ea4d3e9716e27b8153994da3298

SHA256
26b6f1d9105f72171a6ae18c4189e3a5047a4f11916b630001fb601d7efc6d6f

SHA512
946828ae72a96d4241672f99715b3a53bbdd0deb377805ff4c45bc40d38a409534d4aa37c35f8e51bee2d1f0d95a0baf57308c517536c21693975f75ab4d1e4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
974B

MD5
59817f3fb59f86b5d6bffeb4653f0b1b

SHA1
84a0f74b48533a7ecfdefcf17d3f2ee3a43caecc

SHA256
b5b7f2b7121de12d0aae2ecd811b9f4fb3da63ce1fe1cc44ee8310485db09f53

SHA512
e186183a9d3cd26b9cbb4a0fe3b18b0be395282357796834eab70bb71194510f6093025f03af8db911e328c316f5920fae769e381f462bfe973f914c3dac1953

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e1a6374e5c2dde0630d0de1e47046646

SHA1
4ede17bd792dd3ea0b4042fc181eecb8ae5d6f6f

SHA256
aa4fa385513f5c6f56878483b60a83e58ee34c4191848e8eaafe39d1daadddfa

SHA512
377c5310770f10f9577b2e4294ce546fbe2cb9f1e8943c91b8b99ffd9fee56108d93d5cd63be0ea27d6500f0535a17d6dc05c97f74f18bdcf56603663eb2ac46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
80c719ef8465d04119e7b364da427099

SHA1
90be12f5d8f2e0c2cbd0cc5bb5e34fc21228d4ae

SHA256
6baac8e5e92dfdb6f6c0a4397b76e48d8313bf64c8856d038ae7b04e6b103f63

SHA512
39be5b4fa47af7ca79e14bec62a2383d5433f065659c2e9b07df7b51304af2e41d25279e39c23e69001228b849d0e37f4c8fb1a71eb01a5b3050de8a26bcd082

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
0f461319cbe758f01ad6e1b52d255992

SHA1
23a55a712d144aba610d364fda0ca07136acda59

SHA256
c21181e226b5f2aee6804928e0bd10245e5a61fb2c73d2134bfe73391ecc4692

SHA512
4b37bb6b1ece3ec0273431741fc7a58dc53086b414c4835e0805e95c4c3b14bbfe708c8c100aa9ad9424232568caf0ed89f72237c250dbbc046246408258c79b

Download Submit