99d9a57a7845f15be311669d104b02e72f2738bce9cffa5c7b726f375719a29c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2024, 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9ee2102976c2aaec8455957156b6818_JaffaCakes118.html
Size

325KB
MD5

e9ee2102976c2aaec8455957156b6818
SHA1

6ea611b8c643a5fcea5cb3c9a368cbc73c203b9a
SHA256

99d9a57a7845f15be311669d104b02e72f2738bce9cffa5c7b726f375719a29c
SHA512

fc0c6705845e10f4ca34504377f10568e696a193af88a053172ea0c705b6f12c8464c9262b8cb76ac82ca990606854cfcba65e58cdec99df7176e439006b9f0c
SSDEEP

3072:Y/8JPaXdkqxqd85j6JwawzMKI+2VnKpYtAgOlMccGxCARBGdCm+8dCrh2T8uWMR7:B49u2qZZL8Nck8Eh2o0

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3172	msedge.exe
3172	msedge.exe
4564	msedge.exe
4564	msedge.exe
4844	identity_helper.exe
4844	identity_helper.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe
1904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 516	4564	msedge.exe	82
PID 4564 wrote to memory of 516	4564	msedge.exe	82
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 2528	4564	msedge.exe	83
PID 4564 wrote to memory of 3172	4564	msedge.exe	84
PID 4564 wrote to memory of 3172	4564	msedge.exe	84
PID 4564 wrote to memory of 3192	4564	msedge.exe	85
PID 4564 wrote to memory of 3192	4564	msedge.exe	85
PID 4564 wrote to memory of 3192	4564	msedge.exe	85
PID 4564 wrote to memory of 3192	4564	msedge.exe	85
PID 4564 wrote to memory of 3192	4564	msedge.exe	85
PID 4564 wrote to memory of 3192	4564	msedge.exe	85
PID 4564 wrote to memory of 3192	4564	msedge.exe	85
PID 4564 wrote to memory of 3192	4564	msedge.exe	85
PID 4564 wrote to memory of 3192	4564	msedge.exe	85
PID 4564 wrote to memory of 3192	4564	msedge.exe	85
PID 4564 wrote to memory of 3192	4564	msedge.exe	85
PID 4564 wrote to memory of 3192	4564	msedge.exe	85
PID 4564 wrote to memory of 3192	4564	msedge.exe	85
PID 4564 wrote to memory of 3192	4564	msedge.exe	85
PID 4564 wrote to memory of 3192	4564	msedge.exe	85
PID 4564 wrote to memory of 3192	4564	msedge.exe	85
PID 4564 wrote to memory of 3192	4564	msedge.exe	85
PID 4564 wrote to memory of 3192	4564	msedge.exe	85
PID 4564 wrote to memory of 3192	4564	msedge.exe	85
PID 4564 wrote to memory of 3192	4564	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e9ee2102976c2aaec8455957156b6818_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffabc4646f8,0x7ffabc464708,0x7ffabc464718
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4264226688893298284,15914875560227564851,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,4264226688893298284,15914875560227564851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,4264226688893298284,15914875560227564851,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4264226688893298284,15914875560227564851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4264226688893298284,15914875560227564851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,4264226688893298284,15914875560227564851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,4264226688893298284,15914875560227564851,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4264226688893298284,15914875560227564851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4264226688893298284,15914875560227564851,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4264226688893298284,15914875560227564851,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,4264226688893298284,15914875560227564851,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,4264226688893298284,15914875560227564851,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5956 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
955B

MD5
989239744eeee218e62489df22f59bb3

SHA1
c6afd4613281681852728334ac7f6a8f1af1ac37

SHA256
e3deba8c37fb8a980865a271a42b5454f3dd3ed69255b74fa5e2bfd35361b866

SHA512
a2362409e72acbb8678c641ff255261b5e11331ff4596783f56cb9d1534fda34969ee24d436ddd4de2ff4ec5b2315c9d08ef0f6c0a6d392bb030b6662ecb332f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6f5e1af10263bc59d526b8068fba4705

SHA1
0e5fcf4c866d0700095dce3532a33d033f46dce6

SHA256
0ef9ca919f34c867c8f52bf411d6fdf39fd0bd9302212ca3a5ecc1cebe37f91b

SHA512
a4a1730a5931295b9876dd9d32c18e38879db0103a21cd0c407fa7137192cdd7688aec3b1bee2faf9e1e725e02f95365684f1cf7bb245310ff44eb01b4ed194a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7b0b669434809ea2ab464d32a9be140c

SHA1
e7ef8d58ed19ac2e43bd9a3bfeb52b25d9d604f3

SHA256
e5eb3a818f7dd13373cb7bf20cfcdc17e6cdfd105891d1d7be92a9e80978e44b

SHA512
3126e20dbe6379d26e452dc1984f65b138ec7d3639a84b928d3c2844ced98ba47490f48a728b733edec7897de64fa53b7a7b86419b84010a14a8d0580312cd50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
526B

MD5
a76ed091fab3ba04fc5ba722117dc434

SHA1
625c5c895f6d554e99469787d3b0ec3fd9594b66

SHA256
e494cbf9e34870bd0d17e69d92c1b7b604a7b542e61006a662a0e2252b1ab61a

SHA512
fd6504c2813541475a55d3d8c8be713281af3e7754275c2ca7d7790c4a562776c2dd86cf49025a8a5fdf659ab1f326fa6ee2a2b0a48c097f6261cb3369a99654

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584263.TMP

Filesize
526B

MD5
895413eff08d146a39c1eacbf30d0717

SHA1
b80f34f57a9765a3a43f983414a9939b81564a76

SHA256
1709675b3ce3af9185206e92c11bbb5618603e04dc63d5c5ed6eb71bf8fed292

SHA512
0b92d6fe03cc35d9985d9ff164c421f859be4ef6c12d339ec461edd4c95b3353dcf59dd63761c1ea934416e5ab773ed8312999d9b2df3bdf6083c77c994c3c19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3dce41860b675eaff2d8b6ffb8cb71b2

SHA1
1e21b7722895eed82fb3ad76e910428df9e53894

SHA256
80d1f2905bcf88eaa60c68c20d043b6d7f45c516308b9879652e0332aa2c0283

SHA512
c0b42580bcf19a3d9211c4f090452c5b6833455ce73d97e2618717946b888cd74fee2fd339f076be22250357cb141c7d38b90436b7b2c78b9586f6adc9425ffe

Download Submit