1d1379cce1bd2b95f81d3c24173efdd5479a1d909e27ab7a705d8c9fe1dc1c4f

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 19:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

deba32cf2c3fea1fa1535700de51f17f_JaffaCakes118.html
Size

4KB
MD5

deba32cf2c3fea1fa1535700de51f17f
SHA1

a19e9bc7a0ef4c9a18beb3026bda41d62e1a4380
SHA256

1d1379cce1bd2b95f81d3c24173efdd5479a1d909e27ab7a705d8c9fe1dc1c4f
SHA512

3f251e35ba726fdf904f67186c950626bae19e544d9a013099f54d7fa0c523693242eebf5e6343b307f05598658041b10f33e8c011b32d7928cda4f05371527b
SSDEEP

48:spH9MbgBuB+Ow85Mor0D1iIk2jSU/k1QG7vj6yxUVh:g9ubRTr0pi52jSUcyY6Vh

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2156	msedge.exe
2156	msedge.exe
1408	msedge.exe
1408	msedge.exe
2920	identity_helper.exe
2920	identity_helper.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe
4336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 2908	1408	msedge.exe	83
PID 1408 wrote to memory of 2908	1408	msedge.exe	83
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 1164	1408	msedge.exe	86
PID 1408 wrote to memory of 2156	1408	msedge.exe	87
PID 1408 wrote to memory of 2156	1408	msedge.exe	87
PID 1408 wrote to memory of 3728	1408	msedge.exe	88
PID 1408 wrote to memory of 3728	1408	msedge.exe	88
PID 1408 wrote to memory of 3728	1408	msedge.exe	88
PID 1408 wrote to memory of 3728	1408	msedge.exe	88
PID 1408 wrote to memory of 3728	1408	msedge.exe	88
PID 1408 wrote to memory of 3728	1408	msedge.exe	88
PID 1408 wrote to memory of 3728	1408	msedge.exe	88
PID 1408 wrote to memory of 3728	1408	msedge.exe	88
PID 1408 wrote to memory of 3728	1408	msedge.exe	88
PID 1408 wrote to memory of 3728	1408	msedge.exe	88
PID 1408 wrote to memory of 3728	1408	msedge.exe	88
PID 1408 wrote to memory of 3728	1408	msedge.exe	88
PID 1408 wrote to memory of 3728	1408	msedge.exe	88
PID 1408 wrote to memory of 3728	1408	msedge.exe	88
PID 1408 wrote to memory of 3728	1408	msedge.exe	88
PID 1408 wrote to memory of 3728	1408	msedge.exe	88
PID 1408 wrote to memory of 3728	1408	msedge.exe	88
PID 1408 wrote to memory of 3728	1408	msedge.exe	88
PID 1408 wrote to memory of 3728	1408	msedge.exe	88
PID 1408 wrote to memory of 3728	1408	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\deba32cf2c3fea1fa1535700de51f17f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82fc046f8,0x7ff82fc04708,0x7ff82fc04718
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,2152053862520657097,7378774275167188468,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,2152053862520657097,7378774275167188468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,2152053862520657097,7378774275167188468,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2152053862520657097,7378774275167188468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2152053862520657097,7378774275167188468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,2152053862520657097,7378774275167188468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,2152053862520657097,7378774275167188468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2152053862520657097,7378774275167188468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2152053862520657097,7378774275167188468,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2152053862520657097,7378774275167188468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2152053862520657097,7378774275167188468,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,2152053862520657097,7378774275167188468,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3440 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
318B

MD5
208180f7076362e268c4df0fe0827d62

SHA1
134949f9ce7507a9ce44ccf2636f8d398f78c19d

SHA256
98b30d265bcdc1c8f44ccc3a1d01c411ab574c10c033c8ffd608ea2a92d2e1b7

SHA512
293e0bc8dad81da48e72817f496f00bea94a8e76bb914725e209c9bc5403c936cdb3d8c1a5b0e2b834840708dba420b74f827839a99ef028985ad282a24cf752

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fb30b651d83a053d211b9e8906da1f2d

SHA1
ad4c087fbcb7d7ff8b28ec202c7197c7c5713498

SHA256
cf5ed8ca3c0c788d1bbd7b57de993d6464ac183af5281bb277bb5dddd9018f7f

SHA512
ead8a565ae1569684b53133d472335f5527c42d73268c507b55abe1985a2aca9b4c9856b267f2c3f4e0c2786f89e66055ff1c7b3fbbe6b80973e6289c529dc98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f0f6a8abfaf5b6b6784750ebd1ffad87

SHA1
15d2cdb8ad139bd7e76fd38dd41e85ea442eec86

SHA256
ba7366a12382ef1ca5fa67628b0e7b94e424da7e057218374dcaa83c7e3ad779

SHA512
1147650d741351c6d27d64cf1c83b477a62efca49eb147c56e19da1eabfefd620fe54a05448288f565761fcd0aa98910f932483383a71dc94e1b2268709aedd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0cfaa8ec9a19a3206f49150c5b055c63

SHA1
6c21d50095f92aed3c8f2637a4348471f511bd01

SHA256
7eb4f9ea89dd5bc06ac77ebfec54b9d61eeba7f13641329f5028c6475f7b527a

SHA512
16103edd64324cc0e12839c075e78864ebf44fe79acb21e23a7773d864fd84daa159847dda85f837c77d727f1092f12ece505be56341f52250ded936b98efe2c

Download Submit