baa638b06db160ca7b44a45d75ffebdf7afd0f82e6e0da0731b8b299cdc8621f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 10:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc300ee81bc1188def51c33e5303ee20_JaffaCakes118.html
Size

39KB
MD5

dc300ee81bc1188def51c33e5303ee20
SHA1

c0322d03775cddf78471fc9a8ede111586860c0b
SHA256

baa638b06db160ca7b44a45d75ffebdf7afd0f82e6e0da0731b8b299cdc8621f
SHA512

81d06fa52caa308a72c16a34d0dc14694cd5bffdff65185e1c487a731a195b209dc4c853d36aa3c79abd0ac4aad89c006d81fd45327662b155406acd0a198c3b
SSDEEP

768:LRO3e7M2v2WFBwoc0+p4ogn/gB17shBxF5bpGygYJp:LRO3e7M2v2WFBpXS4oghBxF5bfbp

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1424	msedge.exe
1424	msedge.exe
4064	msedge.exe
4064	msedge.exe
212	identity_helper.exe
212	identity_helper.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 3140	4064	msedge.exe	83
PID 4064 wrote to memory of 3140	4064	msedge.exe	83
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 2372	4064	msedge.exe	84
PID 4064 wrote to memory of 1424	4064	msedge.exe	85
PID 4064 wrote to memory of 1424	4064	msedge.exe	85
PID 4064 wrote to memory of 1228	4064	msedge.exe	86
PID 4064 wrote to memory of 1228	4064	msedge.exe	86
PID 4064 wrote to memory of 1228	4064	msedge.exe	86
PID 4064 wrote to memory of 1228	4064	msedge.exe	86
PID 4064 wrote to memory of 1228	4064	msedge.exe	86
PID 4064 wrote to memory of 1228	4064	msedge.exe	86
PID 4064 wrote to memory of 1228	4064	msedge.exe	86
PID 4064 wrote to memory of 1228	4064	msedge.exe	86
PID 4064 wrote to memory of 1228	4064	msedge.exe	86
PID 4064 wrote to memory of 1228	4064	msedge.exe	86
PID 4064 wrote to memory of 1228	4064	msedge.exe	86
PID 4064 wrote to memory of 1228	4064	msedge.exe	86
PID 4064 wrote to memory of 1228	4064	msedge.exe	86
PID 4064 wrote to memory of 1228	4064	msedge.exe	86
PID 4064 wrote to memory of 1228	4064	msedge.exe	86
PID 4064 wrote to memory of 1228	4064	msedge.exe	86
PID 4064 wrote to memory of 1228	4064	msedge.exe	86
PID 4064 wrote to memory of 1228	4064	msedge.exe	86
PID 4064 wrote to memory of 1228	4064	msedge.exe	86
PID 4064 wrote to memory of 1228	4064	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dc300ee81bc1188def51c33e5303ee20_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca88e46f8,0x7ffca88e4708,0x7ffca88e4718
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,13506893072693830239,12132906912468972988,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,13506893072693830239,12132906912468972988,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,13506893072693830239,12132906912468972988,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13506893072693830239,12132906912468972988,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13506893072693830239,12132906912468972988,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,13506893072693830239,12132906912468972988,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,13506893072693830239,12132906912468972988,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13506893072693830239,12132906912468972988,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13506893072693830239,12132906912468972988,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13506893072693830239,12132906912468972988,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13506893072693830239,12132906912468972988,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,13506893072693830239,12132906912468972988,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3040 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
262B

MD5
5c125582c009989ef5f2a9146378e7d8

SHA1
a562106eda51ed1b96b905bcf1ac5381d7b7a21b

SHA256
afba42da805d3c2007ce2fbc96e1728ebf67db7c7e165911738cd23fe5c6f606

SHA512
bf784a08eb5667a7e3e37566b8f850c0e82d5d79500ed0930ae5e1db361ba5b6a67968daec478432baca10e72ba0093a0cba667ca375df35238c097d746185a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bf659be65bab195d8581878ec7a658ce

SHA1
9860036e3a44dfad3ceaefec2ff6439093401480

SHA256
1b0de913db864fdc3dace3189a149276f2b7bf70412564def24c34d1a22aec90

SHA512
a77b84fd7e2d984a309e5c78c57a8aa1ad1b0940b55af4c15e655ed1de6539213cb6b2d6d9ebf272646868670d6359bbec9156093e29db246ddff1144bf4d412

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4141c5215761f7e1a4cd45c899b5a316

SHA1
b22dc8f2a7f3e5953504f5ea75b9881ade772484

SHA256
164a9046ddb57d1d3a92f44f2aaaa63b75e94a8a90dc4d6a6b20b3a64775580f

SHA512
c2ed193fff1dea0aca207b8f6b74083d61cd4091faed89fc271a70da47e1f66e2b3aed73c91437615a2aa84dfd987808824c9538fddad01425c4bfe5181d03a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
992dc0014feb2ec4222602c441e1426d

SHA1
8c629c4a469f93d968691e2f3fd305267e87e1f7

SHA256
8c5f59472b23f44d4beeedbdc0a8d897462133cff68eddaab5c28d75531b2703

SHA512
cca5802d38aaba68350b3118a65579437c56d5863d59ba5e620853d2be1e4df8e145c8125cc76a8500af8dc8dacada9282f20d4b84ca54148fa081fcf5e41128

Download Submit