a424227630910228405c93bace9c45da2c543f02b5653a7ac29f6d73583c5397

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 11:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e02001c2fdcdcdc433e3de8d457f20e5_JaffaCakes118.html
Size

35KB
MD5

e02001c2fdcdcdc433e3de8d457f20e5
SHA1

22964afab3d21226e9efce27f607d66abcc020b7
SHA256

a424227630910228405c93bace9c45da2c543f02b5653a7ac29f6d73583c5397
SHA512

e60b2f49875f0900a194fdb1468c2ad6abfc4a8785239d7c1e9eb21811a1506c0cc0f8eabb1213276f8aaf936466b3c513f545adf65449dafc32c30c64c25ab1
SSDEEP

768:Bg7MvayjJmDPHscL4CUfliNjFa81/edHt:Bg7MBjJmDPHsea8dedHt

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2212	msedge.exe
2212	msedge.exe
2464	msedge.exe
2464	msedge.exe
4544	identity_helper.exe
4544	identity_helper.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 1356	2464	msedge.exe	84
PID 2464 wrote to memory of 1356	2464	msedge.exe	84
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 1084	2464	msedge.exe	85
PID 2464 wrote to memory of 2212	2464	msedge.exe	86
PID 2464 wrote to memory of 2212	2464	msedge.exe	86
PID 2464 wrote to memory of 2040	2464	msedge.exe	87
PID 2464 wrote to memory of 2040	2464	msedge.exe	87
PID 2464 wrote to memory of 2040	2464	msedge.exe	87
PID 2464 wrote to memory of 2040	2464	msedge.exe	87
PID 2464 wrote to memory of 2040	2464	msedge.exe	87
PID 2464 wrote to memory of 2040	2464	msedge.exe	87
PID 2464 wrote to memory of 2040	2464	msedge.exe	87
PID 2464 wrote to memory of 2040	2464	msedge.exe	87
PID 2464 wrote to memory of 2040	2464	msedge.exe	87
PID 2464 wrote to memory of 2040	2464	msedge.exe	87
PID 2464 wrote to memory of 2040	2464	msedge.exe	87
PID 2464 wrote to memory of 2040	2464	msedge.exe	87
PID 2464 wrote to memory of 2040	2464	msedge.exe	87
PID 2464 wrote to memory of 2040	2464	msedge.exe	87
PID 2464 wrote to memory of 2040	2464	msedge.exe	87
PID 2464 wrote to memory of 2040	2464	msedge.exe	87
PID 2464 wrote to memory of 2040	2464	msedge.exe	87
PID 2464 wrote to memory of 2040	2464	msedge.exe	87
PID 2464 wrote to memory of 2040	2464	msedge.exe	87
PID 2464 wrote to memory of 2040	2464	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e02001c2fdcdcdc433e3de8d457f20e5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9feca46f8,0x7ff9feca4708,0x7ff9feca4718
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,2217554617017862247,1977894371537673400,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,2217554617017862247,1977894371537673400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,2217554617017862247,1977894371537673400,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2217554617017862247,1977894371537673400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2217554617017862247,1977894371537673400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,2217554617017862247,1977894371537673400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,2217554617017862247,1977894371537673400,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2217554617017862247,1977894371537673400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2217554617017862247,1977894371537673400,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2217554617017862247,1977894371537673400,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,2217554617017862247,1977894371537673400,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,2217554617017862247,1977894371537673400,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5576 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
520B

MD5
bc065faeb6c75ff536383ea4478725b4

SHA1
b5a65671f9ea406d1e290bad922de0179ab1d8a8

SHA256
c4a3f8ea788b3bc65c3d85bacad0ea6be1da901dcdea74c06f2285bd655e6685

SHA512
5438638e90a8c00d61b988963db9e2dd8401f15b6b53c6e697fcd3b8f9cc2988a0c1bafdf2d090c60ae2ad19929d73a151cd8ef22fe9ec150441638344432f8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2fdcc222dca0d70ad4e870bcc56433d5

SHA1
cd2b8dea07f0f9dbfbf29a442387dab1f82f6b8b

SHA256
1cde492abfd06cbac0c9c206a97fcdd1c7a36eb98291edf742ab74a328cb133b

SHA512
33089feb3e7c239c308bf20fe919e501aa72391a90b3ae7b99c0f2d54660d37e1a9d9d49bbc485391673db7fe92d9954e9eb7ad2353e8395bf43e52b059a7265

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f0fac6c531486c1c68bda89cda5191d5

SHA1
29a78faf65fb64658531bb370237912cb968ad89

SHA256
57725d3e3e2e6e453e5209cbd162c738bbde0140c6f1e3106ccfe91a3eb73a5d

SHA512
24b09deb07fb549c7fc93342130837b68e792cfe3b5dfd6c979ddbc2c09fbf799cb4922b3e94c670e5d8d0584cbee962492578fe5f5fd4bb108306319023f50f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6b55318d1c54c94bd7949985b72aa053

SHA1
16a985aa0ccbe4be6075257bca0d9633c3b0679a

SHA256
cb50dd014b1c2e673a1f0586c96b46fc382015382926d6c24c7a7827820d5024

SHA512
98e9771756cd98c3e0dbd320859664a9f144830596454a6cd8a57b119df05ca7850cc26218ba382d0cdd459930d9439496e1c77fdf38395908e91dc74e63a55b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
92df930330b3c886e161f0c06c82f6d3

SHA1
e76cd510cff1cf21b3db0db7bc7c63655634fe37

SHA256
b4051d841f69a39945075e157d476e7be848a0ed7185d46bb12d2a1ff338f834

SHA512
e92983ee1ae38273e7f616442554adaf62b51a4a703d9a93607a3d2190b2348f058012b09ebb547d8303c1b0be638d337ebdd9c91050a260f17b0ab7c7ac034a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5893fe.TMP

Filesize
539B

MD5
28ea24c997ee430355df18ef36939872

SHA1
8c1b31d3a0a674c147685cd32fd40a7c12ffdfdb

SHA256
0cf207c4fd6285f98e47c736bcb436057c0fe79493600ca712e63a4da7d09b64

SHA512
e9018541e278442821d3d90044faa2b9f6ab6f16a3687e689eb35c9e10c3c092ef85039bfb6d19c24b47d98c838005019365fc142a6e2064b66a55fbf09dd5de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
37b3183fbf276a26debdd6bcf7d8576c

SHA1
f385d70f4b2b02ffea4160a0a83282ad2f0327ae

SHA256
2b0a2134bf2ca2cd1b034541f3ed46f71955f692b48f2fd273c1a2dca0958d03

SHA512
41d93af0fa9bb05d4f66b443c9f648fae9825e0e3f2fad8f930c40f49a669e9a55b17b8d4dc21ae6c62678a7280bb39a56c33a9293ed71eb111f6aa70f9aac60

Download Submit