8bb5440e2bf6fc04549a7fed442ce78b6766396c5133181b71c03728788fec75

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e124177913e575c492bee83d109f185c_JaffaCakes118.html
Size

5KB
MD5

e124177913e575c492bee83d109f185c
SHA1

0d3423477dc7fae9aaed2abbd0be9353c564fb70
SHA256

8bb5440e2bf6fc04549a7fed442ce78b6766396c5133181b71c03728788fec75
SHA512

28c646426ed0b73ee3de281f02ff5ae3b950df58c9d22e3c85b371930bf3db93f9a36e029cc49a891f320dc2b3cc47f1ba4641104ae294ee0e8ece89af084ffb
SSDEEP

96:eAeE/s3Y+cqfqcWllalhmR3UllokczMGhUc2bg0f0U2mii91YN+zpFg+Ojc:eAeE03Y3E0llalhmR3UllezrhUcUXfNx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
1288	msedge.exe
1288	msedge.exe
1672	identity_helper.exe
1672	identity_helper.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2396	1288	msedge.exe	86
PID 1288 wrote to memory of 2396	1288	msedge.exe	86
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 2308	1288	msedge.exe	88
PID 1288 wrote to memory of 920	1288	msedge.exe	89
PID 1288 wrote to memory of 920	1288	msedge.exe	89
PID 1288 wrote to memory of 4876	1288	msedge.exe	90
PID 1288 wrote to memory of 4876	1288	msedge.exe	90
PID 1288 wrote to memory of 4876	1288	msedge.exe	90
PID 1288 wrote to memory of 4876	1288	msedge.exe	90
PID 1288 wrote to memory of 4876	1288	msedge.exe	90
PID 1288 wrote to memory of 4876	1288	msedge.exe	90
PID 1288 wrote to memory of 4876	1288	msedge.exe	90
PID 1288 wrote to memory of 4876	1288	msedge.exe	90
PID 1288 wrote to memory of 4876	1288	msedge.exe	90
PID 1288 wrote to memory of 4876	1288	msedge.exe	90
PID 1288 wrote to memory of 4876	1288	msedge.exe	90
PID 1288 wrote to memory of 4876	1288	msedge.exe	90
PID 1288 wrote to memory of 4876	1288	msedge.exe	90
PID 1288 wrote to memory of 4876	1288	msedge.exe	90
PID 1288 wrote to memory of 4876	1288	msedge.exe	90
PID 1288 wrote to memory of 4876	1288	msedge.exe	90
PID 1288 wrote to memory of 4876	1288	msedge.exe	90
PID 1288 wrote to memory of 4876	1288	msedge.exe	90
PID 1288 wrote to memory of 4876	1288	msedge.exe	90
PID 1288 wrote to memory of 4876	1288	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e124177913e575c492bee83d109f185c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2b9046f8,0x7ffb2b904708,0x7ffb2b904718
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,13883448309101999855,8241470115063847274,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,13883448309101999855,8241470115063847274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,13883448309101999855,8241470115063847274,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13883448309101999855,8241470115063847274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13883448309101999855,8241470115063847274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,13883448309101999855,8241470115063847274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,13883448309101999855,8241470115063847274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13883448309101999855,8241470115063847274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13883448309101999855,8241470115063847274,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13883448309101999855,8241470115063847274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,13883448309101999855,8241470115063847274,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,13883448309101999855,8241470115063847274,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4796 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b7f3c71dab9be4221763348a2efe349b

SHA1
16e77af1a44cd9061cbf3c382f1702506147b59a

SHA256
8afa6c2ce52962d54eda85b74d7b0cecc31091b87de581bdd51e8f6701e68ba5

SHA512
931edee4b7194142dc37ca731d3577a1e39fca811523c2aa86ef6655adf5fcf2f4944b29fd90355d9a962dbf49a9407937e739a05bd27741793318becad3c6e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e1a4a7eb4df4d51d49138789250bb610

SHA1
b9ad3987e2e05fb1df4fde583eb820916a2d482b

SHA256
976d2ca54acf1703f52e8a62e03fdc7ab74341e6138fe76b79ec6fba9e40ddaf

SHA512
26d8bcff9e13026a9209d105d0aabd0a5a25678e9adcd3db8678ab09a563c4acac6bb630da348f18e73127629be86ffdd8ce47495caf3e1daf90f659dcbe4a5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
00355bdebab055765d8b33010c367fd6

SHA1
29e0dc5b111aa1612aa0b69928cc2f7cc3b12180

SHA256
3cc939e462e52bc2f30a642e5752eabe1941c42e375f855ea12da2cd805e6fc7

SHA512
9f4603d41e9047406db615fbcd38d7a49a1ac736d5df177a433494488f133f2c89eb58a0b18b8b8c1d8bf77cecc5edd0d2af30366a1f37d4891cfdba7de08e56

Download Submit