8735e6cc2d62d0d48546b8ecd0b275686348ff175f18d87faeb1a5de3d84594c

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

da8cca91507475c959e3209a532af917_JaffaCakes118.html
Size

643B
MD5

da8cca91507475c959e3209a532af917
SHA1

12056228f7bcacd60dd51a8df810be032d67682e
SHA256

8735e6cc2d62d0d48546b8ecd0b275686348ff175f18d87faeb1a5de3d84594c
SHA512

60a06f159158ba41241e4e18fcce6f4a51b521f42266af88ceb27ecca9fab51ebceb764b210b5bb9668453c3096c52694d927418eae7e6976e45da4aeed8d4b0

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
4816	msedge.exe
4816	msedge.exe
3932	identity_helper.exe
3932	identity_helper.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe
4816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4816 wrote to memory of 1080	4816	msedge.exe	83
PID 4816 wrote to memory of 1080	4816	msedge.exe	83
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1472	4816	msedge.exe	84
PID 4816 wrote to memory of 1600	4816	msedge.exe	85
PID 4816 wrote to memory of 1600	4816	msedge.exe	85
PID 4816 wrote to memory of 536	4816	msedge.exe	86
PID 4816 wrote to memory of 536	4816	msedge.exe	86
PID 4816 wrote to memory of 536	4816	msedge.exe	86
PID 4816 wrote to memory of 536	4816	msedge.exe	86
PID 4816 wrote to memory of 536	4816	msedge.exe	86
PID 4816 wrote to memory of 536	4816	msedge.exe	86
PID 4816 wrote to memory of 536	4816	msedge.exe	86
PID 4816 wrote to memory of 536	4816	msedge.exe	86
PID 4816 wrote to memory of 536	4816	msedge.exe	86
PID 4816 wrote to memory of 536	4816	msedge.exe	86
PID 4816 wrote to memory of 536	4816	msedge.exe	86
PID 4816 wrote to memory of 536	4816	msedge.exe	86
PID 4816 wrote to memory of 536	4816	msedge.exe	86
PID 4816 wrote to memory of 536	4816	msedge.exe	86
PID 4816 wrote to memory of 536	4816	msedge.exe	86
PID 4816 wrote to memory of 536	4816	msedge.exe	86
PID 4816 wrote to memory of 536	4816	msedge.exe	86
PID 4816 wrote to memory of 536	4816	msedge.exe	86
PID 4816 wrote to memory of 536	4816	msedge.exe	86
PID 4816 wrote to memory of 536	4816	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\da8cca91507475c959e3209a532af917_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe661546f8,0x7ffe66154708,0x7ffe66154718
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,3943269025665124765,17274408038222577900,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,3943269025665124765,17274408038222577900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,3943269025665124765,17274408038222577900,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,3943269025665124765,17274408038222577900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,3943269025665124765,17274408038222577900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,3943269025665124765,17274408038222577900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,3943269025665124765,17274408038222577900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,3943269025665124765,17274408038222577900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3512 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,3943269025665124765,17274408038222577900,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,3943269025665124765,17274408038222577900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,3943269025665124765,17274408038222577900,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,3943269025665124765,17274408038222577900,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1884 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,3943269025665124765,17274408038222577900,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1664 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,3943269025665124765,17274408038222577900,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4624 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
f5ff563717e6d8c7adb2a2226e86c91f

SHA1
5a92d1ea304447be84714e630e13af15a928b30f

SHA256
7a2ccd5fa0acfde2bbf5038d95f55dbcf3e751d574df61c1ea974353da0707e4

SHA512
587bc05a40b99c3e3dc8374a773a4d4f3f686759ebc4676b600868dcd12cb9016ca29c1883284487de574ce049f40b1eb9a218232535bf9487b019bee015f7cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6ae7eaf0227f9c3628fe981b4a4d7cb1

SHA1
397d86951f213d7211f5fb8bd51e24029d5b7bf3

SHA256
2d31bbf8f4b872c18e7e149f31d1d7c427d1d168d25465b20f159d4a97b1fc9c

SHA512
1fa64c501de999d2f12dd3314e9c137e2a680c6f18e8a51690be7915023939a21a1bfce3ae183574518fa9e8711d7e50f67ccab32b49f412202c5a8c8bc28247

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
27c9bd7d2875aeee7869c0d97b12b2ae

SHA1
7a5bc0d79636e6af90515dab149caf25d067c373

SHA256
36caf8741bb9ce8c555d35b5eb1f91fc073d48bad529c63aecaa39c60390fe25

SHA512
73bd82cd2f348f254004eec1137c24ca53cd6c5273de5de828607e5247f2932f445085454dbf590aca01d24636cbaa62075b2934235fbe7616269a74a2444a34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5e22ad1abe938a0e11b4fe33221e14d2

SHA1
2d4c81ebe2900c7be2097807e32feb526d6757b7

SHA256
c3233b4bacb493234c1650a4352e8f3cec7a1a67e71c553791973252a3ac9bac

SHA512
b7ea3dc50b79d91bb7ab1d31ea57a432e55c236f2d59d702a57801840585d56d375d492a96d2d4901e2cf4aff11cf6a43a8c59841536aed93ecf31f4b5942d18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
79da4ae359da77bd2e6f3cbfc627a2db

SHA1
a3b518297b044a31ac7d520690ffe7c453d73e9e

SHA256
314343be489187358eeff9e970ca4e06c2073bf6ce8628f7e7b0fe2d744ba71e

SHA512
3edbcdc7c52770d9a9b3590b5b84c9dd2875d3ab17e10688593093e05a262ac0885794c19f208e0963741e217b6adf180780c64ce211d1625b31cf604eba25ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0fdfa9761ed40ef9f3c7e7bf15631d2c

SHA1
3a2d227d5062426201537980859b5cb56a0a3de7

SHA256
c65c3ed3af6e834e873351317f3c3b4c9732b780ba9e9798ca92214f570b79fe

SHA512
fcac912857577d543191adf82e2c38f5c0d8ff801181652ca9fb4abb968aff4a29c0a602f2afcb8555cbdde3049388f01c65fbe7e350125573b4d7be10e48d82

Download Submit