4c6549c77ef7a820eb45a5f59e0508c13d56e47c7cc2deaac2e490a5567a4a29

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ddb9739bf8aedce5863c7d03d9470575_JaffaCakes118.html
Size

25KB
MD5

ddb9739bf8aedce5863c7d03d9470575
SHA1

8277a8c2ae72c3e4a6e2aef52a12b291c3a3c01b
SHA256

4c6549c77ef7a820eb45a5f59e0508c13d56e47c7cc2deaac2e490a5567a4a29
SHA512

8d566e4d066cbfc6fc08c32682387b10883e843f293a65d245245b92848f964f4ac7a627f2ee0afff494237a0f130340dbe148a2b76dc253a3c10f415eb280ca
SSDEEP

768:IRdqBj816a3hBKwimwGUTj4BTsHKNuTZhhvKO1z:FUfhkwimwGUTj4FsHKs3NK6

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4188	msedge.exe
4188	msedge.exe
1820	msedge.exe
1820	msedge.exe
3312	identity_helper.exe
3312	identity_helper.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2968	1820	msedge.exe	83
PID 1820 wrote to memory of 2968	1820	msedge.exe	83
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 5104	1820	msedge.exe	84
PID 1820 wrote to memory of 4188	1820	msedge.exe	85
PID 1820 wrote to memory of 4188	1820	msedge.exe	85
PID 1820 wrote to memory of 1256	1820	msedge.exe	86
PID 1820 wrote to memory of 1256	1820	msedge.exe	86
PID 1820 wrote to memory of 1256	1820	msedge.exe	86
PID 1820 wrote to memory of 1256	1820	msedge.exe	86
PID 1820 wrote to memory of 1256	1820	msedge.exe	86
PID 1820 wrote to memory of 1256	1820	msedge.exe	86
PID 1820 wrote to memory of 1256	1820	msedge.exe	86
PID 1820 wrote to memory of 1256	1820	msedge.exe	86
PID 1820 wrote to memory of 1256	1820	msedge.exe	86
PID 1820 wrote to memory of 1256	1820	msedge.exe	86
PID 1820 wrote to memory of 1256	1820	msedge.exe	86
PID 1820 wrote to memory of 1256	1820	msedge.exe	86
PID 1820 wrote to memory of 1256	1820	msedge.exe	86
PID 1820 wrote to memory of 1256	1820	msedge.exe	86
PID 1820 wrote to memory of 1256	1820	msedge.exe	86
PID 1820 wrote to memory of 1256	1820	msedge.exe	86
PID 1820 wrote to memory of 1256	1820	msedge.exe	86
PID 1820 wrote to memory of 1256	1820	msedge.exe	86
PID 1820 wrote to memory of 1256	1820	msedge.exe	86
PID 1820 wrote to memory of 1256	1820	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ddb9739bf8aedce5863c7d03d9470575_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc49f046f8,0x7ffc49f04708,0x7ffc49f04718
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,8791483460488395455,9374229179403550244,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,8791483460488395455,9374229179403550244,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,8791483460488395455,9374229179403550244,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8791483460488395455,9374229179403550244,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8791483460488395455,9374229179403550244,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8791483460488395455,9374229179403550244,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8791483460488395455,9374229179403550244,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,8791483460488395455,9374229179403550244,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,8791483460488395455,9374229179403550244,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8791483460488395455,9374229179403550244,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,8791483460488395455,9374229179403550244,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,8791483460488395455,9374229179403550244,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4888 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
189B

MD5
443319881835b14fda88caab9945e84c

SHA1
adb420bd20774e8eabc4d3d53ecfccb20ae7cb54

SHA256
fd79d0831e92ccbffc20eed3a0d07b39a121b4f3be4f720d2981fdd2e7b5b8da

SHA512
39c2c7fd638c04ce244473831d3dc8175e8e9ecb9a0df38370300233202d7d7fa9166912b8d97b34efd7b90eab6da376191e1c5c9ce253e96c9686b886ab29fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bebf405bf96572abbf0310f7d5c52fb3

SHA1
9632630e78eb7962aae1c684e0dd681577f00ea9

SHA256
1dadf5521daca1b2ef9b1c4f9a87823e866cfbe12bd6933da649987a49484bae

SHA512
62ce407f8f0415df316229c560ab5a89fa5530acde9f7a6c5b671ccc2b3bc70db3c88a674c26861a16add5808a67fd4a226b77e34dac8f60c556f490d6d46e20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bc6f25e0f324594745cc28e04d6d0d3a

SHA1
c325df7c9106e4ef3397458aed3f7d27dd3ffd6a

SHA256
d8fee4ac68436dd8dd4f0404dbebd2684b6bc0bf25b578bbd376027154069f0b

SHA512
99031c60dcd5f50cefbbaf9b4bc3c015cdf32c14d2d9fb5dd694fc6994a048489098ac0679644017d88b8caca15fa724e51eedf22c9892632c32e3a64e1517dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5b329c65a32dfb73cbe2c14142dbb273

SHA1
104040af463c00f2ac806fcf6e57a6115186a8bd

SHA256
6dc553b364614602c41df288efa46159af717df0dceb30853b3b727bbfbf6633

SHA512
d9b2b9a3d565bca5a8e4520f952a103380f1b492da70f44b4173489c5c93d632129cba4b56243d2af0542a8f7e59201c9fa079466c355b025ad25a34536ed322

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
54dc2e4d9e6c9572c72e95b3c238a8da

SHA1
9e6a827fdc8617349ee23a0227333479b4d786cc

SHA256
08232ab8adbf50c516b3631714b0e1c1763f4b8d8f1c9ff3f718698e051bf8b8

SHA512
4e7b5c6b831073fe253579c6cf6fac4846a552b9b2d976bbc05fd5fdf4a49cb9407bee93f8be52c51e8379e4f38547cfe80d3f14cb91a6eb8dbe0176ef1bb072

Download Submit