ca573aded9bcc843910c9f3cb58c1cf9d6031a3d1ce99234d4b0f1411dab74bd

Analysis

max time kernel
145s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 05:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaa95ec932ca78a5ce91b0858bad1ce6_JaffaCakes118.html
Size

8KB
MD5

eaa95ec932ca78a5ce91b0858bad1ce6
SHA1

8638ced2d3c82a06502431abcaeb1202fc3dbc52
SHA256

ca573aded9bcc843910c9f3cb58c1cf9d6031a3d1ce99234d4b0f1411dab74bd
SHA512

5191c4b1f3d7f468e1be90cd64387c4695c9a34e35019796bd1c49b5ecac1a0e195563b169e4d0ca2c226724e24527b4a9b6c1752b616afe36551f2c5cb1836f
SSDEEP

96:uzVs+ux7xHLLY1k9o84d12ef7CSTUdzfSxG6MURT2/13pX4m6WHXCmCGq8k/lBcD:csz7xHAYS/TRTg5o3b76f

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1792	msedge.exe
1792	msedge.exe
60	msedge.exe
60	msedge.exe
2752	identity_helper.exe
2752	identity_helper.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 60 wrote to memory of 424	60	msedge.exe	82
PID 60 wrote to memory of 424	60	msedge.exe	82
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 936	60	msedge.exe	83
PID 60 wrote to memory of 1792	60	msedge.exe	84
PID 60 wrote to memory of 1792	60	msedge.exe	84
PID 60 wrote to memory of 2840	60	msedge.exe	85
PID 60 wrote to memory of 2840	60	msedge.exe	85
PID 60 wrote to memory of 2840	60	msedge.exe	85
PID 60 wrote to memory of 2840	60	msedge.exe	85
PID 60 wrote to memory of 2840	60	msedge.exe	85
PID 60 wrote to memory of 2840	60	msedge.exe	85
PID 60 wrote to memory of 2840	60	msedge.exe	85
PID 60 wrote to memory of 2840	60	msedge.exe	85
PID 60 wrote to memory of 2840	60	msedge.exe	85
PID 60 wrote to memory of 2840	60	msedge.exe	85
PID 60 wrote to memory of 2840	60	msedge.exe	85
PID 60 wrote to memory of 2840	60	msedge.exe	85
PID 60 wrote to memory of 2840	60	msedge.exe	85
PID 60 wrote to memory of 2840	60	msedge.exe	85
PID 60 wrote to memory of 2840	60	msedge.exe	85
PID 60 wrote to memory of 2840	60	msedge.exe	85
PID 60 wrote to memory of 2840	60	msedge.exe	85
PID 60 wrote to memory of 2840	60	msedge.exe	85
PID 60 wrote to memory of 2840	60	msedge.exe	85
PID 60 wrote to memory of 2840	60	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eaa95ec932ca78a5ce91b0858bad1ce6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe661546f8,0x7ffe66154708,0x7ffe66154718
  2⤵
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5135316839255233806,5844955100229124727,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,5135316839255233806,5844955100229124727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,5135316839255233806,5844955100229124727,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5135316839255233806,5844955100229124727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5135316839255233806,5844955100229124727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,5135316839255233806,5844955100229124727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,5135316839255233806,5844955100229124727,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5135316839255233806,5844955100229124727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5135316839255233806,5844955100229124727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5135316839255233806,5844955100229124727,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,5135316839255233806,5844955100229124727,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,5135316839255233806,5844955100229124727,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5308 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
515e0dd58a867a8501d3a7a5f30c53f8

SHA1
c2e8e6d095ee816ecc30130a5575bd4132ef6631

SHA256
eb5ad803b87cd08c10c464381e6593f5f0f67fbc7052f80fcd2fcd3e746aa5d3

SHA512
5946517f1e3438c7647ab4c68d420cdc5b7898f96a0795f63986a43f9d7197eb07f6769a70bcc998ee1aca3c76716961cf9aae3929eaffe4d7407661dd357bcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
374bad6e9c18ddf5a9bd0cd64594d644

SHA1
fc85b06717393c6c189d382a8671f1cc27b2e391

SHA256
95cc7f631a02ce6db7aad886ef3aba52feeb59e48ee1dd4272573db23225a99a

SHA512
9aacf232d4a02be929d0c97d8f9ccaac1b0396f91cd332ae151491e16d87c0daec16025bd549d14f85dc0e566c98e429afa47548b917854ecda3fcfef692f7cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cb904d6c034a7bd23269a62fed47e9fe

SHA1
10b4a85539478f8663fb3bff23d9ff88855ffaad

SHA256
4029ebefc697a5b8e4d7e98453685efac77e844d0da61c62394059ee5007e617

SHA512
fab3674b48e700367e714770c9202081339ce2b8c96016f33a59ea00a324d8c4ea5929464b738a61394536e94b85129286670866fc72e454a1e455f3f51c8ad4

Download Submit