6b54600c29614d2859eebd2d53b643089b0e869e076ac0878907fe9805e103d6

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15-09-2024 05:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1cdcaa217999100b2f52db473406b07_JaffaCakes118.html
Size

61KB
MD5

e1cdcaa217999100b2f52db473406b07
SHA1

b9933c7311cf4121ef50dc67f47997c912639305
SHA256

6b54600c29614d2859eebd2d53b643089b0e869e076ac0878907fe9805e103d6
SHA512

cf76c6b8a817b363a07063c45be87dc3a950e29fad717f9d4b5cef75007642fbff7f396bd446c603f4474e039a15ea62d16c32e778576c26342d68182e68731c
SSDEEP

1536:6V8FR+9euehWLlAB66MfilnZlJuoITKGvqLbNoFVozOaXBwf:6UKeueh8lABw82G+ebNoFVozOaXBwf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4268	msedge.exe
4268	msedge.exe
3612	identity_helper.exe
3612	identity_helper.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 4372	4268	msedge.exe	83
PID 4268 wrote to memory of 4372	4268	msedge.exe	83
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 1376	4268	msedge.exe	84
PID 4268 wrote to memory of 4624	4268	msedge.exe	85
PID 4268 wrote to memory of 4624	4268	msedge.exe	85
PID 4268 wrote to memory of 1844	4268	msedge.exe	86
PID 4268 wrote to memory of 1844	4268	msedge.exe	86
PID 4268 wrote to memory of 1844	4268	msedge.exe	86
PID 4268 wrote to memory of 1844	4268	msedge.exe	86
PID 4268 wrote to memory of 1844	4268	msedge.exe	86
PID 4268 wrote to memory of 1844	4268	msedge.exe	86
PID 4268 wrote to memory of 1844	4268	msedge.exe	86
PID 4268 wrote to memory of 1844	4268	msedge.exe	86
PID 4268 wrote to memory of 1844	4268	msedge.exe	86
PID 4268 wrote to memory of 1844	4268	msedge.exe	86
PID 4268 wrote to memory of 1844	4268	msedge.exe	86
PID 4268 wrote to memory of 1844	4268	msedge.exe	86
PID 4268 wrote to memory of 1844	4268	msedge.exe	86
PID 4268 wrote to memory of 1844	4268	msedge.exe	86
PID 4268 wrote to memory of 1844	4268	msedge.exe	86
PID 4268 wrote to memory of 1844	4268	msedge.exe	86
PID 4268 wrote to memory of 1844	4268	msedge.exe	86
PID 4268 wrote to memory of 1844	4268	msedge.exe	86
PID 4268 wrote to memory of 1844	4268	msedge.exe	86
PID 4268 wrote to memory of 1844	4268	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e1cdcaa217999100b2f52db473406b07_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3b9b46f8,0x7fff3b9b4708,0x7fff3b9b4718
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4413305708836420263,8071858931366643241,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,4413305708836420263,8071858931366643241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,4413305708836420263,8071858931366643241,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4413305708836420263,8071858931366643241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4413305708836420263,8071858931366643241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4413305708836420263,8071858931366643241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4413305708836420263,8071858931366643241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4413305708836420263,8071858931366643241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4413305708836420263,8071858931366643241,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4413305708836420263,8071858931366643241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4413305708836420263,8071858931366643241,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4413305708836420263,8071858931366643241,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
267B

MD5
9f879005600f543034b8f145d11c4a55

SHA1
7f13f419645f9c651b94eaae64337e8d9aa98cbb

SHA256
436238cc5c68c9f3341ec64e9334c2fa33ad4758586dfc2e88aff65ea312bcd2

SHA512
7db6fa06d5b94e48b5f98faeb60f155c1bca9ed8d4eca4fcd8eecd89340eed32952523c9343d3d2e0f5dfd894f4cb8c6fb621192c5f92888725313232f214588

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
504e358955bb3059b99e80aae8d3084a

SHA1
826245ed439ac98276a2b90233ff25eb8120663b

SHA256
73eba2bdb16ca9bf546f8f1039edc546fff560ba0f1dff6b75a5869d963e642f

SHA512
91f7e402b8c6b91c2262e3d16e69080b2dd2090d2afd2d517f81a3e8732f266ecc17c086f7d362a854f6a638866574475be66ea2928c3803aaa7a063ad5c476e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9a74f85fa7c393ae200b9da86dfb434f

SHA1
99e23d697c973a9daa927f19f925704d25205f9d

SHA256
0a2639c38e97c9604bdeb1151fe7c7ab8fc1e7e02e319aeaf3823305a0040125

SHA512
ce8d3428dc8a4a0c7e54032877d31efd77dedc39c2de867f33f8ccc7d5915d83bb2a5287ba758e54f3e6833182a6e19c1216e8a407d4c8482c4e8c381fd84b83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
747daafcf641068d026e350ad38de46d

SHA1
59da027ad3f87eb057dc8502dba0fa4881394312

SHA256
d8560e4c17a5bbf52900c4b7dd115947e686b67e8b5785b0d7a9c9379e155d51

SHA512
1f69348c4d59b179da621c838b8dcfc5968dd886df5d4dd8c5b89f8ffe955eb4ee2bab5e27ab38a56f7d00d7afd4b3b9a059d6f99e543ed1b627792f5b6365af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
59aa69b513dad27c21426a377dfc915c

SHA1
bf4a496471f0bc0fc1d964ebb82155d65162e700

SHA256
aff9d85e5fc7e00f54b4a289cfb43046b3eb8b32d7c200ad1a2ee245f7828397

SHA512
2f7ffac4e596d60edd0e7fbe9c4d2c76076a979e73d6228b9bfa8c9edd09ba244ab13cfecb0f0a7cff6634c20c95fda1ec57f5d3aa69cd3fff0a1c43300c67d1

Download Submit