844842a9ba6e8b3f971b74b18196c8564906eae73ca0178204ff02c6ab6ab5ad

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 20:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db3041ee6e446506598f677c538369c9_JaffaCakes118.html
Size

36KB
MD5

db3041ee6e446506598f677c538369c9
SHA1

3969d0991bdaece6a17c79f4c3b9c00c9ca0ad90
SHA256

844842a9ba6e8b3f971b74b18196c8564906eae73ca0178204ff02c6ab6ab5ad
SHA512

81bc80f799a3a8fd94e2f9d207ca4023fe596169c45eb570fc7c1a9d7a969b5849aaa324b80390438c2b57f3b8b2780b7a2f12c126e43997fbe1e7008739afea
SSDEEP

768:zwx/MDTHUO88hARjZPXWE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6Tsdi6f9U56lLRcR:Q/LbJxNVpufS6/s8KK

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe
3868	msedge.exe
3868	msedge.exe
3412	identity_helper.exe
3412	identity_helper.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 4436	3868	msedge.exe	83
PID 3868 wrote to memory of 4436	3868	msedge.exe	83
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 1220	3868	msedge.exe	84
PID 3868 wrote to memory of 3008	3868	msedge.exe	85
PID 3868 wrote to memory of 3008	3868	msedge.exe	85
PID 3868 wrote to memory of 3684	3868	msedge.exe	86
PID 3868 wrote to memory of 3684	3868	msedge.exe	86
PID 3868 wrote to memory of 3684	3868	msedge.exe	86
PID 3868 wrote to memory of 3684	3868	msedge.exe	86
PID 3868 wrote to memory of 3684	3868	msedge.exe	86
PID 3868 wrote to memory of 3684	3868	msedge.exe	86
PID 3868 wrote to memory of 3684	3868	msedge.exe	86
PID 3868 wrote to memory of 3684	3868	msedge.exe	86
PID 3868 wrote to memory of 3684	3868	msedge.exe	86
PID 3868 wrote to memory of 3684	3868	msedge.exe	86
PID 3868 wrote to memory of 3684	3868	msedge.exe	86
PID 3868 wrote to memory of 3684	3868	msedge.exe	86
PID 3868 wrote to memory of 3684	3868	msedge.exe	86
PID 3868 wrote to memory of 3684	3868	msedge.exe	86
PID 3868 wrote to memory of 3684	3868	msedge.exe	86
PID 3868 wrote to memory of 3684	3868	msedge.exe	86
PID 3868 wrote to memory of 3684	3868	msedge.exe	86
PID 3868 wrote to memory of 3684	3868	msedge.exe	86
PID 3868 wrote to memory of 3684	3868	msedge.exe	86
PID 3868 wrote to memory of 3684	3868	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\db3041ee6e446506598f677c538369c9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff88fe46f8,0x7fff88fe4708,0x7fff88fe4718
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,785514479897290985,16694530355641162686,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,785514479897290985,16694530355641162686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,785514479897290985,16694530355641162686,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,785514479897290985,16694530355641162686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,785514479897290985,16694530355641162686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,785514479897290985,16694530355641162686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,785514479897290985,16694530355641162686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,785514479897290985,16694530355641162686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,785514479897290985,16694530355641162686,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,785514479897290985,16694530355641162686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,785514479897290985,16694530355641162686,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,785514479897290985,16694530355641162686,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5096 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
614B

MD5
46fb2e09d98f72cd78eb1ef5c43d8704

SHA1
c558b6a40a1615383850b39179a590124e529dc7

SHA256
844a0dfa228931d343021faec0fab39289b473437c23edc7ad7015e72519d2cf

SHA512
a98f0df0109375475bd065480da7a14dfa99ae5bd2ba8e7abcd6287db9bc38d9fa815613d24a60dbb4a21e2f60be160c9dc5eafda191990fd795e9da0d6eba75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a092e81e8a47a8a86765dc91ec4dce0e

SHA1
759ca60ed568ef55480bd6d47fd295e3460e0c82

SHA256
3645180b0d4ea7f8dcb975a0b8dc169ce78083e42eaba0c35a62ec02aefbea02

SHA512
716649b60b048dda59fca384cd09ccada239ad1862319ffa9cbcc449ab7820375a611651d7c2b91d959ce0224f03551f186740edddb51cd800eaa4f198e7dc68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
49cf2818cfd6726589e0771b0f1741ae

SHA1
e540ef9624ea516d5da4ba0aeb25c862d3e57546

SHA256
c1add5f5a3b0a90b6fa631d5561fa4c78c0e29c50408b3b946483a175ca5ae81

SHA512
de532df77b9189a748bd5612e06ed7b773ab8c6dd4d43e23d098af6c248dc2096776d971c3d0043d9e2795719aa62f01868cef4322c9c0897875399f7751e281

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1185b9dcfad45a33841b30533017ed38

SHA1
0d67646a82f1d5939080b6080c6bc28763bb1925

SHA256
561591489683f442b488f644146a1b54f98742be2113d6917778ce3d803a5e25

SHA512
375dd3ac1dbef77654caf4f150501605909ee895812233a38db100e811b9a3d87b8964bfb5fdb0ced6dc1946ca514b5821424f656d0a637557e76749534c9fa7

Download Submit