d63c377a49694de9d9ceee91bd9dd33d0e0f33b92a21e82e3490bf09ff5477db

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2024, 22:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea13d3daeb61a92c0f1345e259a49c60_JaffaCakes118.html
Size

4KB
MD5

ea13d3daeb61a92c0f1345e259a49c60
SHA1

ad08269605a4f48fcd7eb320693e702e0901202a
SHA256

d63c377a49694de9d9ceee91bd9dd33d0e0f33b92a21e82e3490bf09ff5477db
SHA512

83e80b92beee864cd59a2cec30176275dd6f44fc8e1285b12971d5219433deb204fea1b0859eabc28c0c577055b5f2643b57cb93ee816bcaa20de8f74ac6ba91
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o7OWFcFA:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDe

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe
5032	msedge.exe
5032	msedge.exe
3548	identity_helper.exe
3548	identity_helper.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 740	5032	msedge.exe	82
PID 5032 wrote to memory of 740	5032	msedge.exe	82
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 4172	5032	msedge.exe	83
PID 5032 wrote to memory of 3332	5032	msedge.exe	84
PID 5032 wrote to memory of 3332	5032	msedge.exe	84
PID 5032 wrote to memory of 940	5032	msedge.exe	85
PID 5032 wrote to memory of 940	5032	msedge.exe	85
PID 5032 wrote to memory of 940	5032	msedge.exe	85
PID 5032 wrote to memory of 940	5032	msedge.exe	85
PID 5032 wrote to memory of 940	5032	msedge.exe	85
PID 5032 wrote to memory of 940	5032	msedge.exe	85
PID 5032 wrote to memory of 940	5032	msedge.exe	85
PID 5032 wrote to memory of 940	5032	msedge.exe	85
PID 5032 wrote to memory of 940	5032	msedge.exe	85
PID 5032 wrote to memory of 940	5032	msedge.exe	85
PID 5032 wrote to memory of 940	5032	msedge.exe	85
PID 5032 wrote to memory of 940	5032	msedge.exe	85
PID 5032 wrote to memory of 940	5032	msedge.exe	85
PID 5032 wrote to memory of 940	5032	msedge.exe	85
PID 5032 wrote to memory of 940	5032	msedge.exe	85
PID 5032 wrote to memory of 940	5032	msedge.exe	85
PID 5032 wrote to memory of 940	5032	msedge.exe	85
PID 5032 wrote to memory of 940	5032	msedge.exe	85
PID 5032 wrote to memory of 940	5032	msedge.exe	85
PID 5032 wrote to memory of 940	5032	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ea13d3daeb61a92c0f1345e259a49c60_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbe2f46f8,0x7ffdbe2f4708,0x7ffdbe2f4718
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,1069519893949735182,15680334765267241507,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,1069519893949735182,15680334765267241507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,1069519893949735182,15680334765267241507,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1069519893949735182,15680334765267241507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1069519893949735182,15680334765267241507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,1069519893949735182,15680334765267241507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,1069519893949735182,15680334765267241507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1069519893949735182,15680334765267241507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1069519893949735182,15680334765267241507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1069519893949735182,15680334765267241507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1069519893949735182,15680334765267241507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,1069519893949735182,15680334765267241507,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5404 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
292B

MD5
61982fab74b82aea621caea17d10e1c7

SHA1
e466826baaba51ad3edeb3deb1bc3282dadae1df

SHA256
d6893987f8a93f1b1574fd9c6e163b7f178603d1e3a2c6d1dcc128cb7d259808

SHA512
202ffab0a64417691560186385959ebdfd34460360253265f2cbcc70d99d6d78ea91e79675b366a165568dedec5874556ddebd6eb7077af5612be10a2a8e0e9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bdede0da429164f003e5ee6a41e76f37

SHA1
8c74deb8bfbcf218a1e1d91bfbba1a89f3b84d69

SHA256
ed06ad80271318f169421dbb3d6c072556c8c68132f96046bb945d6babb4d223

SHA512
38479dbabed0ded98af26ed92fc913f9ff1d381acf6b511d09be6d37a063d4112d2130d378daba8bab319e0295467cbda3762b074e7ef2fab905f0187c305d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3f2b3389ed89bcadcc63ed04bf5ce745

SHA1
be2f494afc2e94c84b2f7d3e7b390d1bdddc9af1

SHA256
97a49bc42a5e0b9cc89dbcce86c0bb3eb554f9ca83b2cbc0cd7fee44afc21cc9

SHA512
92408234428e2f221960a7d92db7be6bcaed2a1ef91dd584ecf1626e5a1b7a577f1dd115a09e976e13505272f967a3ff971623106743cbfef052a3b96a908aa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
466a0e13fddd75d01131228cb3b15329

SHA1
1059479429cb95d82b97cf3415a4dacf829aeff1

SHA256
ab5c1f63d7559924f1396a72d2cc5baf58caf300a089c775c54188f3505a6045

SHA512
1805ef66054f538486f93263d31fc5796ea4834c60c32591155337140d65534a4fe132b887087ed2e9428a931a7e14251ae8f093bff987070b6349cf52f76a36

Download Submit