7304c71fa38c68a16b34fbfdce5efec705efc3c754c81b51a604b18385660407

Analysis

max time kernel
145s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 03:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea84bb17bd527d792523694fbb1ad68c_JaffaCakes118.html
Size

5KB
MD5

ea84bb17bd527d792523694fbb1ad68c
SHA1

9738a276fac920031f0f641f80d9cb7e3ded281a
SHA256

7304c71fa38c68a16b34fbfdce5efec705efc3c754c81b51a604b18385660407
SHA512

07cf8573afa8fbf78e284d634c4d94162253e82339ffa97b035da49e4b42d62807479868455ea9faefd4709bee1ae713992541f51ccaba46a194c21613dfa975
SSDEEP

96:8uTgv3L+b37Pm9XccYJLQgF99VDurc0lyWS7wo0L4u:zgv3Ve79arc0lyxwotu

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
2940	msedge.exe
2940	msedge.exe
2268	identity_helper.exe
2268	identity_helper.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 1692	2940	msedge.exe	82
PID 2940 wrote to memory of 1692	2940	msedge.exe	82
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 552	2940	msedge.exe	83
PID 2940 wrote to memory of 4472	2940	msedge.exe	84
PID 2940 wrote to memory of 4472	2940	msedge.exe	84
PID 2940 wrote to memory of 4800	2940	msedge.exe	85
PID 2940 wrote to memory of 4800	2940	msedge.exe	85
PID 2940 wrote to memory of 4800	2940	msedge.exe	85
PID 2940 wrote to memory of 4800	2940	msedge.exe	85
PID 2940 wrote to memory of 4800	2940	msedge.exe	85
PID 2940 wrote to memory of 4800	2940	msedge.exe	85
PID 2940 wrote to memory of 4800	2940	msedge.exe	85
PID 2940 wrote to memory of 4800	2940	msedge.exe	85
PID 2940 wrote to memory of 4800	2940	msedge.exe	85
PID 2940 wrote to memory of 4800	2940	msedge.exe	85
PID 2940 wrote to memory of 4800	2940	msedge.exe	85
PID 2940 wrote to memory of 4800	2940	msedge.exe	85
PID 2940 wrote to memory of 4800	2940	msedge.exe	85
PID 2940 wrote to memory of 4800	2940	msedge.exe	85
PID 2940 wrote to memory of 4800	2940	msedge.exe	85
PID 2940 wrote to memory of 4800	2940	msedge.exe	85
PID 2940 wrote to memory of 4800	2940	msedge.exe	85
PID 2940 wrote to memory of 4800	2940	msedge.exe	85
PID 2940 wrote to memory of 4800	2940	msedge.exe	85
PID 2940 wrote to memory of 4800	2940	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ea84bb17bd527d792523694fbb1ad68c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff204346f8,0x7fff20434708,0x7fff20434718
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,7279241138033842592,3884814634796346919,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,7279241138033842592,3884814634796346919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,7279241138033842592,3884814634796346919,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,7279241138033842592,3884814634796346919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,7279241138033842592,3884814634796346919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,7279241138033842592,3884814634796346919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,7279241138033842592,3884814634796346919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,7279241138033842592,3884814634796346919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,7279241138033842592,3884814634796346919,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,7279241138033842592,3884814634796346919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,7279241138033842592,3884814634796346919,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,7279241138033842592,3884814634796346919,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4884 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
187B

MD5
11a6dc34313d731feb76adff414e9bb3

SHA1
b4f546e7c7516322274eceab85ef4cde8e3d8c2f

SHA256
77534140806c15590c72700a1c4e6b138c7c96c0d00c740cd78ad2af04ae9292

SHA512
e648b43b298e2a8e5038b707fb43a10d34ea8c3570f63a691035742a59e0a7f8cc99c1e862f03b68496fb8530ea84e434cc25c7c2f589f1034db87a2eda9c6d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c6b29e30c748293561c805b8590661bf

SHA1
5fc9b246b60ae00f96dad83722653cd2edf0c7b3

SHA256
ba9f7693356363ec5b1b040920a4af9bd6d99b14fababe060839111c2c6b1e1e

SHA512
c549f9b12e0d4b5d0b45be09f0de313536b33e87e9712d6283c6f22a33884f08546791143756ca244638279461f3c96d81933cbcbedb192be8ea14146565b083

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
779d4083d8de83fb4b7bc17e78ba6623

SHA1
ab638651ab161912ac740fba6c3cb5d2380cab01

SHA256
f406e47ea5cf0343d6022b1d82422c8412ac5e3c05278506a6d70b7f7cc66fb0

SHA512
9d23fc7aa269dc486ba08d5fdca01cabb738b11c6d40f9daf58731a411d87ec071702238e3b42269c405b1f47d1a499ef9bd55e05c518bd13d706664e6bdcf3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ac7670589c3be687520c74b3eabbd592

SHA1
22a649b3d313141cf987e9784eb63470dd37312f

SHA256
e2b6e5682e53281b2e777b4528432d04b430d4ea1378d977a2999debde1a9a7e

SHA512
8a3dbd1937fe78068fa984aad42bc825225360c83bfe6713c1b3cdade85958c19842607061276c3745211f1128c3f50fd5f6db8d0fb7a6850a67677d637bfbf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
41426ee137476d09acc43374679e1f7c

SHA1
e1b7030bce5b3e713fc481ea82c821d72f734aa3

SHA256
6f8dab39b63fd4bd27574d50f58435ffdb733f5c0206cf65dfdd1eab7f24fffa

SHA512
b352ec3700926e6b3c054a9efb51d320f63fdd3b9e302ada7017d7485fee5d1f608b15fbd4e92a761a26b3b52829b07035d3d5fe8ecbb1f5f75b16bb75655c5b

Download Submit