5e6e3f87523fd2c129a765094322ed02abf7abbe732b703a44f69ea782bcdeec

Analysis

max time kernel
145s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 04:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dbd2d6f50196be833d021f6c17908ac7_JaffaCakes118.html
Size

38KB
MD5

dbd2d6f50196be833d021f6c17908ac7
SHA1

d691af7652dfbe1ee056582a9842f5ea9d66aeaf
SHA256

5e6e3f87523fd2c129a765094322ed02abf7abbe732b703a44f69ea782bcdeec
SHA512

9f416d96a50ce8c4993c1a9b64c790a7e2453086f34d5de67a2f52ef8a07436a2c3a169a0f5c1637c10fd340f7a11c6f4abe2d2a057a111a74934fcb66b68ae4
SSDEEP

768:quK4GlgzcoVf2uuFjrYArrTmdT5HlgeKI+642G8+k:jK4Gl+xf2umvPr6T5HluQ9+k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1660	msedge.exe
1660	msedge.exe
4988	msedge.exe
4988	msedge.exe
3852	identity_helper.exe
3852	identity_helper.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 4728	4988	msedge.exe	83
PID 4988 wrote to memory of 4728	4988	msedge.exe	83
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 2936	4988	msedge.exe	84
PID 4988 wrote to memory of 1660	4988	msedge.exe	85
PID 4988 wrote to memory of 1660	4988	msedge.exe	85
PID 4988 wrote to memory of 1540	4988	msedge.exe	86
PID 4988 wrote to memory of 1540	4988	msedge.exe	86
PID 4988 wrote to memory of 1540	4988	msedge.exe	86
PID 4988 wrote to memory of 1540	4988	msedge.exe	86
PID 4988 wrote to memory of 1540	4988	msedge.exe	86
PID 4988 wrote to memory of 1540	4988	msedge.exe	86
PID 4988 wrote to memory of 1540	4988	msedge.exe	86
PID 4988 wrote to memory of 1540	4988	msedge.exe	86
PID 4988 wrote to memory of 1540	4988	msedge.exe	86
PID 4988 wrote to memory of 1540	4988	msedge.exe	86
PID 4988 wrote to memory of 1540	4988	msedge.exe	86
PID 4988 wrote to memory of 1540	4988	msedge.exe	86
PID 4988 wrote to memory of 1540	4988	msedge.exe	86
PID 4988 wrote to memory of 1540	4988	msedge.exe	86
PID 4988 wrote to memory of 1540	4988	msedge.exe	86
PID 4988 wrote to memory of 1540	4988	msedge.exe	86
PID 4988 wrote to memory of 1540	4988	msedge.exe	86
PID 4988 wrote to memory of 1540	4988	msedge.exe	86
PID 4988 wrote to memory of 1540	4988	msedge.exe	86
PID 4988 wrote to memory of 1540	4988	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dbd2d6f50196be833d021f6c17908ac7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe661546f8,0x7ffe66154708,0x7ffe66154718
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17344891230619228136,12577973540234036403,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,17344891230619228136,12577973540234036403,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,17344891230619228136,12577973540234036403,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17344891230619228136,12577973540234036403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17344891230619228136,12577973540234036403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,17344891230619228136,12577973540234036403,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,17344891230619228136,12577973540234036403,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17344891230619228136,12577973540234036403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17344891230619228136,12577973540234036403,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17344891230619228136,12577973540234036403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,17344891230619228136,12577973540234036403,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,17344891230619228136,12577973540234036403,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
01b90a1dbb08c910a83bc2b807bbdd06

SHA1
f29964c769eeedc09497be201b0cdefa08b7ddd4

SHA256
f8550c4beeddbd8069cf2e41f824371c2369f2e5c0aee77d6e69f17d29a35cf2

SHA512
b12609e72e91cd524658bc795183200d5f2f3fdbcaac0c4ac895f68202f84b91f21b7a6beae2019cd6aa3fcf26da72b753d36d6364d0d664375d955e746ea48e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e3522077274f1d30a31ccabdc7dd1288

SHA1
516aec6895a9cbfbb0b4b69c91c2df956d07f9f8

SHA256
d38caee22b90c80e67756dc2587c609a75bb092fa4a3baeb0fb0225d84ff4b2b

SHA512
f2fc0b6c41f74d7b56ac2cae6cc9ed8ae3ea99f61d03f10b284acd254a8d106c4a600540002b45f6a5fe7642b082eb40dbb3fa5e1f0e1d066c919a0e063f6f14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7fd538d1bf53a8471f4e72e22fd6b6d7

SHA1
10a2ec84089e43af0634304e4924fbafa10c79c3

SHA256
9c0cde38e50736e48c0949b5d9c50f530c8352ea165cb7ab0caf345e56a0cbd9

SHA512
94c0d08b57e8e4fb0aaf551d9e7d0125bc245ad59d7bd4120c0d0ce2ea909455aa391b19a65b45554c5c4dbb0c13c388c2e5976e98c78082bf87ce4f3092609e

Download Submit