e92135b3b88e50f095aece5ac97f6568142de367bff5a9db313842e20b4bf13d

Analysis

max time kernel
147s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df17b0d4839cef1b810da94f0efddc5f_JaffaCakes118.html
Size

69KB
MD5

df17b0d4839cef1b810da94f0efddc5f
SHA1

b06b63f2e975eb0f63aeedee04330ded8cf2e8b4
SHA256

e92135b3b88e50f095aece5ac97f6568142de367bff5a9db313842e20b4bf13d
SHA512

5f2e77565d03b8c6b60c185e1e589999f032dbf410951f2454e72fb83065d24fc868c3c83b7eb667b56e94bc5a019938a93c0fafbd76abd6f83d15f247b5d348
SSDEEP

768:Ji7gcMiR3sI2PDDnX0g6smn6solMlboTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQV:J3SQaWTzNen0tbrga94hcuNnQC

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe
1136	msedge.exe
1136	msedge.exe
2116	identity_helper.exe
2116	identity_helper.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe
4952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 4244	1136	msedge.exe	83
PID 1136 wrote to memory of 4244	1136	msedge.exe	83
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 3660	1136	msedge.exe	84
PID 1136 wrote to memory of 4732	1136	msedge.exe	85
PID 1136 wrote to memory of 4732	1136	msedge.exe	85
PID 1136 wrote to memory of 3960	1136	msedge.exe	86
PID 1136 wrote to memory of 3960	1136	msedge.exe	86
PID 1136 wrote to memory of 3960	1136	msedge.exe	86
PID 1136 wrote to memory of 3960	1136	msedge.exe	86
PID 1136 wrote to memory of 3960	1136	msedge.exe	86
PID 1136 wrote to memory of 3960	1136	msedge.exe	86
PID 1136 wrote to memory of 3960	1136	msedge.exe	86
PID 1136 wrote to memory of 3960	1136	msedge.exe	86
PID 1136 wrote to memory of 3960	1136	msedge.exe	86
PID 1136 wrote to memory of 3960	1136	msedge.exe	86
PID 1136 wrote to memory of 3960	1136	msedge.exe	86
PID 1136 wrote to memory of 3960	1136	msedge.exe	86
PID 1136 wrote to memory of 3960	1136	msedge.exe	86
PID 1136 wrote to memory of 3960	1136	msedge.exe	86
PID 1136 wrote to memory of 3960	1136	msedge.exe	86
PID 1136 wrote to memory of 3960	1136	msedge.exe	86
PID 1136 wrote to memory of 3960	1136	msedge.exe	86
PID 1136 wrote to memory of 3960	1136	msedge.exe	86
PID 1136 wrote to memory of 3960	1136	msedge.exe	86
PID 1136 wrote to memory of 3960	1136	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\df17b0d4839cef1b810da94f0efddc5f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff540d46f8,0x7fff540d4708,0x7fff540d4718
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,10961903498458482730,5979596453108969885,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,10961903498458482730,5979596453108969885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,10961903498458482730,5979596453108969885,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,10961903498458482730,5979596453108969885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,10961903498458482730,5979596453108969885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,10961903498458482730,5979596453108969885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,10961903498458482730,5979596453108969885,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,10961903498458482730,5979596453108969885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,10961903498458482730,5979596453108969885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,10961903498458482730,5979596453108969885,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,10961903498458482730,5979596453108969885,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,10961903498458482730,5979596453108969885,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
82727c6cb08627858e2a69a335d209b3

SHA1
9a6d9eabb19775cc487db34fb50659166f968fcb

SHA256
1cd4a1dcd707e2447a1e5195ab69bc08e519b04fe5af89d4917d3688e99a0955

SHA512
b50350225252e4b2b66b5b1eab89fcb9cefced60df30cce72431383bf7ec5791af4ddb1ec087161c530a96798faa9a270b3056b2beff8986db14a7d988447770

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a9cbca7552ab461cb84c4e0bfde2a919

SHA1
d720b574740b84595ea19f270002bd83df5b32db

SHA256
b5109c6f48448e819b8fb08198b403572c36b6b80e7f8af1d10bb17efdf2a6bb

SHA512
6526a924c25273210ee2ac7ae0a2b63cf5ddf49a8b7d8043843f30f1c83192d0cd2005ab7e99be0e7a8d256f6aed6caaa1bfb1e6936062dffe5e8aa673d306de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
69016e86c35043a77c01ea3b1804fb20

SHA1
4b0a560e48a2a36babd5e5983b5af2ad344303d0

SHA256
efe33830f971130cbcd729f857ba068bdbd060ae6d36a10bc899a776a5a23492

SHA512
bc0b0c4ecacf391496faeae7755561f30fbf6a4aa94a95c9830c3e6c6065b7904b0e9eb6cf0f7eb3b9c5872a53421e4998c8ceab1e58cdf8119e83f53aee3ae6

Download Submit