bfc90b51f2ac70f8ec61eb11c97a603f0a4434a91b557e112482a48728ee20dd

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 05:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dbdd3ad920e70dd9078dad6b226d3801_JaffaCakes118.html
Size

934KB
MD5

dbdd3ad920e70dd9078dad6b226d3801
SHA1

15dd808f5f97be77cabc5781e51d6b9d7cd15bc7
SHA256

bfc90b51f2ac70f8ec61eb11c97a603f0a4434a91b557e112482a48728ee20dd
SHA512

2ad089b276a080e1570b7381eee12a5d865ce71388758c6e341ce4b25356ab9fdbba61939a50d777b7c72522c83d3b7b6477dad0a129d8781be08a53e0fb95ec
SSDEEP

6144:AqfnN0EMgEOMNpSIgsM2tdYyYjMysM2tdYyYjM9/:AqfnN0EMgEOO4I5M2jYxYfM2jYxY9

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
2792	msedge.exe
2792	msedge.exe
1600	identity_helper.exe
1600	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 1620	2792	msedge.exe	83
PID 2792 wrote to memory of 1620	2792	msedge.exe	83
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4424	2792	msedge.exe	84
PID 2792 wrote to memory of 4476	2792	msedge.exe	85
PID 2792 wrote to memory of 4476	2792	msedge.exe	85
PID 2792 wrote to memory of 4024	2792	msedge.exe	86
PID 2792 wrote to memory of 4024	2792	msedge.exe	86
PID 2792 wrote to memory of 4024	2792	msedge.exe	86
PID 2792 wrote to memory of 4024	2792	msedge.exe	86
PID 2792 wrote to memory of 4024	2792	msedge.exe	86
PID 2792 wrote to memory of 4024	2792	msedge.exe	86
PID 2792 wrote to memory of 4024	2792	msedge.exe	86
PID 2792 wrote to memory of 4024	2792	msedge.exe	86
PID 2792 wrote to memory of 4024	2792	msedge.exe	86
PID 2792 wrote to memory of 4024	2792	msedge.exe	86
PID 2792 wrote to memory of 4024	2792	msedge.exe	86
PID 2792 wrote to memory of 4024	2792	msedge.exe	86
PID 2792 wrote to memory of 4024	2792	msedge.exe	86
PID 2792 wrote to memory of 4024	2792	msedge.exe	86
PID 2792 wrote to memory of 4024	2792	msedge.exe	86
PID 2792 wrote to memory of 4024	2792	msedge.exe	86
PID 2792 wrote to memory of 4024	2792	msedge.exe	86
PID 2792 wrote to memory of 4024	2792	msedge.exe	86
PID 2792 wrote to memory of 4024	2792	msedge.exe	86
PID 2792 wrote to memory of 4024	2792	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dbdd3ad920e70dd9078dad6b226d3801_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c68146f8,0x7ff9c6814708,0x7ff9c6814718
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,13903973695496845252,3581408242412642020,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1952,13903973695496845252,3581408242412642020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1952,13903973695496845252,3581408242412642020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,13903973695496845252,3581408242412642020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,13903973695496845252,3581408242412642020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,13903973695496845252,3581408242412642020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,13903973695496845252,3581408242412642020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,13903973695496845252,3581408242412642020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,13903973695496845252,3581408242412642020,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,13903973695496845252,3581408242412642020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,13903973695496845252,3581408242412642020,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,13903973695496845252,3581408242412642020,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5384 /prefetch:2
  2⤵
  PID:3836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
656B

MD5
30cd989075a530869f87b5c44b369fa2

SHA1
b5835b2f285eb5a15a817ac3019b26011fdc12c3

SHA256
2aaefcd104e876f4c00c4b5f96b9d405076a845c224793273d8f533d2225ea43

SHA512
ab378b3ecc11f4910d7d87bf269166a84c909510e0753d00116516df058a181d4a8fd65a032f5eea6097fa32fa5b2d17456725699f2a35734257473b930de09a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7860e8a2925873bbc91754099c5a0578

SHA1
29f7c728f62511dd393c1bfc6f6412fb1d2d92d8

SHA256
2d198e265a8e571ea90b80b6b5e7b5bea76aebf71901fb30804634f3bb91e69d

SHA512
88687d4dc81af15f6bc9a71b87fca8ba475d2d5baf6af60cd4114840efb0e12383ea13413f175b4103a826ca234d6a041b13a811730e491a8db0c2003c7fdb8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b5d27953f3bb5350356025be95051769

SHA1
5713fe1631f845666b7c63e7b7f5dcbd48dfd7ff

SHA256
4c8c518272767227f39a9ba2e76ee126907e79849d424569f60151f0f1442096

SHA512
d8d196efb24489b85424ba04e02a7e903376d230c3a2008c1df12120b0b7b12f90755edd9c2514c032637771ec7ed6584acd906561db28688967c61cb117fc5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4788cc5e2505a2fdc01085bde9fd4717

SHA1
4cac2ef7593e4aa22e8e49d97525ab874da0e03f

SHA256
302c316461451bd1b45950597ce7c4144d7d7be7e49329fa587f9d1f6112f3b7

SHA512
bdb2b365a03fbd1e48cbc6ca18b80c25b58896e8841590ef603459615d300d1df19b0b77d21cde60c410ae3e0f0180af886445f17a1ce5650c805f69d23358b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
cb5d4d1914cd8c4997e9426c5d643121

SHA1
20e55952f758d6ab545ca0f66438e3dede3321b5

SHA256
e60e8eff4482148154fce4ce6ced263851ae18a26d09214c8a85724f91091f0b

SHA512
09cedb41bd625333091887979809fec20bbe4ec33e9b2ea9bcbf150dad0bd5b07916696b9133e2848e92ab6244f508e4514dabe8984971043f899bdabed98b34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5830b0.TMP

Filesize
204B

MD5
dea32cc61d9170f8537b9f3000ce9e18

SHA1
e9957a128db75be2a8da69b319a7fe8d81708a02

SHA256
98a67faad97abfe16356108827300d8600352b85eae54dde1099f3d129d9d602

SHA512
9484c36a62e3a1bd865fd5006da2f9abd9e8d56be11723abd1ed975d6695a5f2d5eaa8b16e068777571b25cba28f9583cdd462b3421c9d3f71382d8083b2f612

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
442b0a541aaf46cf5681df1b6dad5482

SHA1
0d895a5895b00f1451813d659a4b0f6d1b8ad01a

SHA256
3dc1cc52d619f9151dc0ad7db808e53c6071ccf9062f40cee0b1354b90ce50ac

SHA512
a4fe6181729a775f91d15a7e31194e6476e8aaeef86f3db127e2e1febb2e2b6865411af9aa1e2aa0a7b5a7e947955f03cad4573f04609bda78284f5823b254db

Download Submit