19d16c3c209199b9013f9a5e36c4540f31f47094bfda2ed5ea14df696974c10b

Analysis

max time kernel
145s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 15:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de74b4d47b17ea27a897554c14b86e36_JaffaCakes118.html
Size

1KB
MD5

de74b4d47b17ea27a897554c14b86e36
SHA1

5edc5ff93ea0a51abcea6f84a3bb97ea5e440df3
SHA256

19d16c3c209199b9013f9a5e36c4540f31f47094bfda2ed5ea14df696974c10b
SHA512

434d5ce3053e10115f3e14a51b56a918e3294f785408b7693b7045637317d2ae3a5d998059e201ef7baf70ea3c03a5055776befe4f9ad1c54164a267a017bd1e

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2160	msedge.exe
2160	msedge.exe
5032	msedge.exe
5032	msedge.exe
2972	identity_helper.exe
2972	identity_helper.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe
4132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 4652	5032	msedge.exe	83
PID 5032 wrote to memory of 4652	5032	msedge.exe	83
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 1608	5032	msedge.exe	84
PID 5032 wrote to memory of 2160	5032	msedge.exe	85
PID 5032 wrote to memory of 2160	5032	msedge.exe	85
PID 5032 wrote to memory of 2648	5032	msedge.exe	86
PID 5032 wrote to memory of 2648	5032	msedge.exe	86
PID 5032 wrote to memory of 2648	5032	msedge.exe	86
PID 5032 wrote to memory of 2648	5032	msedge.exe	86
PID 5032 wrote to memory of 2648	5032	msedge.exe	86
PID 5032 wrote to memory of 2648	5032	msedge.exe	86
PID 5032 wrote to memory of 2648	5032	msedge.exe	86
PID 5032 wrote to memory of 2648	5032	msedge.exe	86
PID 5032 wrote to memory of 2648	5032	msedge.exe	86
PID 5032 wrote to memory of 2648	5032	msedge.exe	86
PID 5032 wrote to memory of 2648	5032	msedge.exe	86
PID 5032 wrote to memory of 2648	5032	msedge.exe	86
PID 5032 wrote to memory of 2648	5032	msedge.exe	86
PID 5032 wrote to memory of 2648	5032	msedge.exe	86
PID 5032 wrote to memory of 2648	5032	msedge.exe	86
PID 5032 wrote to memory of 2648	5032	msedge.exe	86
PID 5032 wrote to memory of 2648	5032	msedge.exe	86
PID 5032 wrote to memory of 2648	5032	msedge.exe	86
PID 5032 wrote to memory of 2648	5032	msedge.exe	86
PID 5032 wrote to memory of 2648	5032	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\de74b4d47b17ea27a897554c14b86e36_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83db846f8,0x7ff83db84708,0x7ff83db84718
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,13837481810628215264,5478406159679324191,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,13837481810628215264,5478406159679324191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,13837481810628215264,5478406159679324191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13837481810628215264,5478406159679324191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13837481810628215264,5478406159679324191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,13837481810628215264,5478406159679324191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,13837481810628215264,5478406159679324191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13837481810628215264,5478406159679324191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13837481810628215264,5478406159679324191,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13837481810628215264,5478406159679324191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,13837481810628215264,5478406159679324191,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,13837481810628215264,5478406159679324191,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
235abc5abd1987d510c61c808f7aab90

SHA1
8898e48dfc866eaf264a264fab8d6a32ee42fd0e

SHA256
542770972a04c49c054f6dfe5f7182e628b13e0c74a92e62a8e615a39997a585

SHA512
8f4e8b8453ab596b5339308e6d02b2224f614e41c7486adebc6eca289bd17eecc8fb37117fb17aeccc9e0a5f385c80816f3f83642e8f04729db9efe6841312da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2c0e531c8cb84f2092a114a6ee550f66

SHA1
9b8bdf81814f520946fdd66d66996e57f91e0c2e

SHA256
09540d2694ad9f64b6c4685fe954f05c9c56b17bcb5d6557844b738ed5d44da6

SHA512
14331fbb7cc29e9f668ba77ce1edde08610aa22d70b88c5ec2eed0c4fb1d39d161800f4861f487e9d361352e6df43d6fe246089216d221cd5305d43cb1a78bbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fbb06b8d9f01aeac9e2944e9ca192e44

SHA1
000c5807825b324a3bdaedda342c0ce19c50b0e4

SHA256
35937abbff4f5001662526f371b3e882bef2da3c2b13f90e8edbdbd91a3a27ef

SHA512
d7d219058c6dd9cb6928be9501e0169c06626d43463cfd4734ee188306a19479c4173b452eebbde7278857c5526b5effda7ed8350c57562f335f2602e0885e62

Download Submit