489a542cb273fb3178144fb3ede223461da2ff7f9d5ac60f46d0df5120c4c766

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 18:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

daf037f10c23ae1a01178b0d54f0587a_JaffaCakes118.html
Size

28KB
MD5

daf037f10c23ae1a01178b0d54f0587a
SHA1

47026f96532ac68d1f986785ab8db12aaa3a33df
SHA256

489a542cb273fb3178144fb3ede223461da2ff7f9d5ac60f46d0df5120c4c766
SHA512

5374cebbffa4998ee98c5249ed41d19f868aab3f9900b5b8cb058825941451ec58939365aaa533ae432251e3636ec19381a4fd829ccbf1c33c2e1765bdd9dc8a
SSDEEP

768:Zcd9QZBC7mOdMgLpC5I9nC4KwYwxw8QHPd:gQZBCCOdT0IxCxwYwxw8QHPd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2040	msedge.exe
2040	msedge.exe
4588	msedge.exe
4588	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe
812	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 4088	4588	msedge.exe	84
PID 4588 wrote to memory of 4088	4588	msedge.exe	84
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 4116	4588	msedge.exe	85
PID 4588 wrote to memory of 2040	4588	msedge.exe	86
PID 4588 wrote to memory of 2040	4588	msedge.exe	86
PID 4588 wrote to memory of 2924	4588	msedge.exe	87
PID 4588 wrote to memory of 2924	4588	msedge.exe	87
PID 4588 wrote to memory of 2924	4588	msedge.exe	87
PID 4588 wrote to memory of 2924	4588	msedge.exe	87
PID 4588 wrote to memory of 2924	4588	msedge.exe	87
PID 4588 wrote to memory of 2924	4588	msedge.exe	87
PID 4588 wrote to memory of 2924	4588	msedge.exe	87
PID 4588 wrote to memory of 2924	4588	msedge.exe	87
PID 4588 wrote to memory of 2924	4588	msedge.exe	87
PID 4588 wrote to memory of 2924	4588	msedge.exe	87
PID 4588 wrote to memory of 2924	4588	msedge.exe	87
PID 4588 wrote to memory of 2924	4588	msedge.exe	87
PID 4588 wrote to memory of 2924	4588	msedge.exe	87
PID 4588 wrote to memory of 2924	4588	msedge.exe	87
PID 4588 wrote to memory of 2924	4588	msedge.exe	87
PID 4588 wrote to memory of 2924	4588	msedge.exe	87
PID 4588 wrote to memory of 2924	4588	msedge.exe	87
PID 4588 wrote to memory of 2924	4588	msedge.exe	87
PID 4588 wrote to memory of 2924	4588	msedge.exe	87
PID 4588 wrote to memory of 2924	4588	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\daf037f10c23ae1a01178b0d54f0587a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9feca46f8,0x7ff9feca4708,0x7ff9feca4718
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,1309462234300497960,15241941696208280772,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1844 /prefetch:2
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1848,1309462234300497960,15241941696208280772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1848,1309462234300497960,15241941696208280772,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,1309462234300497960,15241941696208280772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,1309462234300497960,15241941696208280772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,1309462234300497960,15241941696208280772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,1309462234300497960,15241941696208280772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,1309462234300497960,15241941696208280772,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5268 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
07e09c51583a61f073e7af0e596c1d3c

SHA1
e70f066aa41c3bc09711d9ad9b1c587038312ba6

SHA256
383639351229e3f075bf482064f456bd0abeecdaf8dcb2c973138278d62d044e

SHA512
e1289618992c2d1727cccd320d85fc0cb4160fa0258be539537a4141a84e67d624c77aa0e40edb6780cf7410f5e5374bdf803a32504597fcdaed9c9fc6687816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
9f501237acd82ac59aca4b971b477672

SHA1
cea665625f2fd2e5aa3b2ed767edcb79056f6305

SHA256
a570f71bae852e52f293e52b25874e796c84a7ae9c960fe5f8652d55a4b7eb64

SHA512
aebc05d7c141f63beabf825e5c6c3baba75c163c668ffd06602653a95a6b5221052b03b0eddd540f3af1a5c73a075fa239880d880fcbadfce4f2a9386978404a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
e9ca814d383f827505c0227f64991513

SHA1
f0705c0e7d44cfca4e370fce5c08aee30b73ea8b

SHA256
c072ecc8f528185dd449de24970889d008058969a3e2833aac1c2f946ad3f379

SHA512
a7f902cf4b9a527fba486dc23b5f4976e6c7c3928269bd62488eb994159edd8436ab0ac8cbb366e2c8cb8fbd0b70f8696fd152a4ed835f5e42cf3cb8b86faa35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c4a9038c1f3760303cf7820821994f50

SHA1
b01dbc905bab8d9222b75c6fcd2cd201a0a5b28a

SHA256
3a8789a13e9ac4e4874edaf245a8cdb43f7c12d353e0e981594e404d81452ee4

SHA512
89e05d6a4718c3b55c89ba4e79b3a62b4404c8153e5022082960ea37a684d3146e795f4399b08699753adafe8f49655597516df947c70fddb68b31d93789961c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
61cdd421c3d02cc8de6a7f4fc8bd9c8b

SHA1
0e92b978ddeea9cc2f488550217318390425031a

SHA256
ceb69361070bc407d31938f982670cfb8a5d193e0fb122d78df53a89e0bf26e6

SHA512
fc1d654b7ec85353676a23e8ef7067cd7a530d18e7e4cb543fc8b76de8f9d6ba3fa52de73b04ae877f9d39b415c931c421799bcef4b07355d15450974d897232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
721837848593b0f5f74743bb07823872

SHA1
d4cd6902871c2fb5b59fa2bdff9114ec4ff5866a

SHA256
c0db1f9b3866575a33f3b9677f23b23dccfe0b86e9469b8b3c7662a22b591df9

SHA512
92c3213e68e3e87335f244907f62ef619f7cb6f56130d050919e7dd14c268ef236774df9458d4b8a1041ab86db3ad0c94841240cdc9a6f70a8e54ce8d43c1be4

Download Submit