06bad27458b8fb763aa3cc286ad67a40a75f070b2bc4a68f9eab3ae08e93ca8e

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcdaffebc14de23b5032e1fcddc98749_JaffaCakes118.html
Size

73KB
MD5

dcdaffebc14de23b5032e1fcddc98749
SHA1

bffa057af0aa852a8cf8193e6c4dc7fdf0e43ec2
SHA256

06bad27458b8fb763aa3cc286ad67a40a75f070b2bc4a68f9eab3ae08e93ca8e
SHA512

44f6a8d8960a7286acc4195d2ed075cab9060fa19bbe8fefc1617bb273c5f35a63e58ec84d20f9d499751dcdddc14dfdcc0faf4de7c42d5ed3b77c434a6d9dd7
SSDEEP

768:8KCDyJuZ3EIvxr6tJ9zB3k6vpBP2frMhLJ3dG8bszqulK6gPKamv82zcn+Vo3x8Y:8X2YZ0RnLJPbscRmk2W3xVyKA2fQa

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
1440	msedge.exe
1440	msedge.exe
4748	identity_helper.exe
4748	identity_helper.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 3888	1440	msedge.exe	83
PID 1440 wrote to memory of 3888	1440	msedge.exe	83
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 3112	1440	msedge.exe	84
PID 1440 wrote to memory of 2012	1440	msedge.exe	85
PID 1440 wrote to memory of 2012	1440	msedge.exe	85
PID 1440 wrote to memory of 2744	1440	msedge.exe	86
PID 1440 wrote to memory of 2744	1440	msedge.exe	86
PID 1440 wrote to memory of 2744	1440	msedge.exe	86
PID 1440 wrote to memory of 2744	1440	msedge.exe	86
PID 1440 wrote to memory of 2744	1440	msedge.exe	86
PID 1440 wrote to memory of 2744	1440	msedge.exe	86
PID 1440 wrote to memory of 2744	1440	msedge.exe	86
PID 1440 wrote to memory of 2744	1440	msedge.exe	86
PID 1440 wrote to memory of 2744	1440	msedge.exe	86
PID 1440 wrote to memory of 2744	1440	msedge.exe	86
PID 1440 wrote to memory of 2744	1440	msedge.exe	86
PID 1440 wrote to memory of 2744	1440	msedge.exe	86
PID 1440 wrote to memory of 2744	1440	msedge.exe	86
PID 1440 wrote to memory of 2744	1440	msedge.exe	86
PID 1440 wrote to memory of 2744	1440	msedge.exe	86
PID 1440 wrote to memory of 2744	1440	msedge.exe	86
PID 1440 wrote to memory of 2744	1440	msedge.exe	86
PID 1440 wrote to memory of 2744	1440	msedge.exe	86
PID 1440 wrote to memory of 2744	1440	msedge.exe	86
PID 1440 wrote to memory of 2744	1440	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dcdaffebc14de23b5032e1fcddc98749_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe746446f8,0x7ffe74644708,0x7ffe74644718
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,14385907801280456559,11233436591087903611,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,14385907801280456559,11233436591087903611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,14385907801280456559,11233436591087903611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14385907801280456559,11233436591087903611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14385907801280456559,11233436591087903611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,14385907801280456559,11233436591087903611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,14385907801280456559,11233436591087903611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14385907801280456559,11233436591087903611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14385907801280456559,11233436591087903611,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14385907801280456559,11233436591087903611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14385907801280456559,11233436591087903611,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,14385907801280456559,11233436591087903611,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1456 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
0cdd9431d6b475c3654210debecd1dbc

SHA1
fb8703fcbca5aceb316b9e562c22d5258653ba78

SHA256
5a3c57b9035e80f25055f9b84277bf399834e7c729b4c9fa5a8b19278effceb2

SHA512
2272cc9d0eee01aa964c1149d58d075dc4155b5f9f63cdc76a674032ae0b7513715d9d7fc0ce68058aa492c7ea652693b5247c3ed8856cc3ffc2bc87195d39cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d8b9a05477795f1383ada23a37fa4433

SHA1
edae6372164faa080043f8b47b18fae425bafb20

SHA256
9200c81e900c562d3f1541d17506052d2b50fa068eba474c2f6ef0b487a4bc9a

SHA512
48f0cb99b4c536f025b769ce75fbff941ecb256fa499529393703019bc05078a840d6a46dc488cda2d5238bbcd5382bdbf0e53fe3eff0dd57ce92359d448e8de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
691d0aa5df54a58ae855463bf15341df

SHA1
8b23cefbfb03253351daade4c5ab8048db5727f4

SHA256
4e9c7cda9a567ba52371d214c362a2ad1aea3da9409758b8d0dace95ee7f806d

SHA512
a3b5092c48efa08153d7675d787b961de476fb5e310a9b02f472ceaab6e56ad075722f637ff0a193c255dbad33e97cb2b2a323f1d4e499a44b061e7e2ad4100b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
989dd75988746e662450f8d9bfd8496c

SHA1
4f487ce2657d5e644f32be22c7a78800fa89088b

SHA256
3fb711d2bd426ed945945b14ce90798c9e5796a168ad554e7d5bae9c675a042a

SHA512
fb6a892e598ee0ccfd520cda39945f63fa6ff500fc82a96291753af6eb2241dd35c345c8dd8c4858dd0fa7b1b7d901dae8e488fe26d65ad96ce6bec92d95b0a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cd4c28238ccba150963508583c9e8245

SHA1
2596439a47232b075d51f6c3b54259da9925e417

SHA256
c2a3fbc6a7c0bfd32e907d984d3a52715128fe9abc460136209f4f2ceaf5b7a8

SHA512
d57a964aa911eb809bcc865a147cdfd470c7c6c7671def5f5aff4c7fb6f401d655396c0ec68fdb76cc9fa11223cced2e144a12295a660a3450e320a76f1a2310

Download Submit