55696c83b4ffc4bdc739cc02271230d6533aedd2f75d85d490ddf5832287c0dd

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15-09-2024 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e23e2b0b5d9a18be3b9ca54b65f116f5_JaffaCakes118.html
Size

4KB
MD5

e23e2b0b5d9a18be3b9ca54b65f116f5
SHA1

7c40fd56f69da86355a1b34aeb0746c0d068f3f5
SHA256

55696c83b4ffc4bdc739cc02271230d6533aedd2f75d85d490ddf5832287c0dd
SHA512

e59e063cdb0f085db8f6cb5615b2b037a48285c38aa746dada7c681c486de34fa78eda8f7b9cc76c4212afb6a8995b82ceb99ecfedd0940343152e86b403d292
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oRL5fd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDu

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1924	msedge.exe
1924	msedge.exe
2456	msedge.exe
2456	msedge.exe
696	identity_helper.exe
696	identity_helper.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2284	2456	msedge.exe	83
PID 2456 wrote to memory of 2284	2456	msedge.exe	83
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 2024	2456	msedge.exe	84
PID 2456 wrote to memory of 1924	2456	msedge.exe	85
PID 2456 wrote to memory of 1924	2456	msedge.exe	85
PID 2456 wrote to memory of 3496	2456	msedge.exe	86
PID 2456 wrote to memory of 3496	2456	msedge.exe	86
PID 2456 wrote to memory of 3496	2456	msedge.exe	86
PID 2456 wrote to memory of 3496	2456	msedge.exe	86
PID 2456 wrote to memory of 3496	2456	msedge.exe	86
PID 2456 wrote to memory of 3496	2456	msedge.exe	86
PID 2456 wrote to memory of 3496	2456	msedge.exe	86
PID 2456 wrote to memory of 3496	2456	msedge.exe	86
PID 2456 wrote to memory of 3496	2456	msedge.exe	86
PID 2456 wrote to memory of 3496	2456	msedge.exe	86
PID 2456 wrote to memory of 3496	2456	msedge.exe	86
PID 2456 wrote to memory of 3496	2456	msedge.exe	86
PID 2456 wrote to memory of 3496	2456	msedge.exe	86
PID 2456 wrote to memory of 3496	2456	msedge.exe	86
PID 2456 wrote to memory of 3496	2456	msedge.exe	86
PID 2456 wrote to memory of 3496	2456	msedge.exe	86
PID 2456 wrote to memory of 3496	2456	msedge.exe	86
PID 2456 wrote to memory of 3496	2456	msedge.exe	86
PID 2456 wrote to memory of 3496	2456	msedge.exe	86
PID 2456 wrote to memory of 3496	2456	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e23e2b0b5d9a18be3b9ca54b65f116f5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd70fd46f8,0x7ffd70fd4708,0x7ffd70fd4718
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,1761238552578434134,14449923586170388826,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,1761238552578434134,14449923586170388826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,1761238552578434134,14449923586170388826,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,1761238552578434134,14449923586170388826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,1761238552578434134,14449923586170388826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,1761238552578434134,14449923586170388826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,1761238552578434134,14449923586170388826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,1761238552578434134,14449923586170388826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,1761238552578434134,14449923586170388826,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,1761238552578434134,14449923586170388826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,1761238552578434134,14449923586170388826,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,1761238552578434134,14449923586170388826,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
292B

MD5
0539fc95886cd90bb57fe987a8b21f5c

SHA1
ac4fba4b7bf5d861055f96895ff834c5f74f5f11

SHA256
09dc0c2da862af8b2c85b4fa9227fdc95bab68e34b0ba2833cd0da78cd229245

SHA512
0ef5990587428a15a8f3b23809804e88b1172c6d60cf7fcdb5cdd09bd628d3422b119f5b6cc6656d52a347002b6187f6e637d3a3d8a2735b55355c9a04653d7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8bac099ee443ddfa2bc85d230226ad4f

SHA1
122cd142bf4cf7c9496b80be24dc3a07bf8eefe6

SHA256
bab795d3a9a09a465bd378156ba8090fe7b43261fb5668d088b33ded8dfa8e4e

SHA512
8544332a527011d8bc8cc312931b1e263e1588eab08c428efe00d07efa8c5c002cbeafd16aa50fed5ba81b4abd811c6a7f4c1be39769dee7f57aabc75b115420

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bab652dff3564e07c99bf2812afd1c72

SHA1
dcb6d87951d97b4a06611ca9cde167cd6bdb4e18

SHA256
ad6346ac6aa3f518f3c0915428948ce1094083fd14bbe6b88e70c05bca2fa1e1

SHA512
e825c11368285b25b209be4fbf8a7d009dd8479d1b292c56b5d49d4f207e406f428030b2a9eacae0591b9fe99246497703f42114d458f3a8e17fbad331228173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c47507dcce641158b96f5bde0e25071b

SHA1
7d41d30887f3ff0abe05797ddf03a93c7562d247

SHA256
a73b4d56b8a12d97552b27689372d6f2551a7fb960d2a95a7d95a72c0c279f98

SHA512
89aa4ec50fc8f65efa8f0213270cc880ed12f4baa3b8b043ee3b537f7bcb6ee5e536804efed03db8a99cebbc87394862524b9e4811ab05503f189b5f617df9d5

Download Submit