90d2c8e978b2b4d98f418551c4f9f97f78c8c3482f4cf784003f431ed2d0e38a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 05:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaa8f3a825009b515586460a90ffb2c1_JaffaCakes118.html
Size

4KB
MD5

eaa8f3a825009b515586460a90ffb2c1
SHA1

9613be9691d4ee50051bf844cffcdcfafde814f9
SHA256

90d2c8e978b2b4d98f418551c4f9f97f78c8c3482f4cf784003f431ed2d0e38a
SHA512

59d9143cd5164ebb951554813c36e9158152ec809de9e9318994ad978309415c49f0ad6534b2034ac0a6d2e60656bd37807575709ed3085d9eff1e3ae6a8f1f0
SSDEEP

96:Pj/ep0zKdyJi3fmiVDCC2JwDYl0cenWxGvBdO/dOTjUdOSR1dOQc:Pj/g0zKgJi3fmiVvMzGc4

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
8	msedge.exe
8	msedge.exe
4920	msedge.exe
4920	msedge.exe
4296	identity_helper.exe
4296	identity_helper.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe
3928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 4956	4920	msedge.exe	82
PID 4920 wrote to memory of 4956	4920	msedge.exe	82
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 2168	4920	msedge.exe	83
PID 4920 wrote to memory of 8	4920	msedge.exe	84
PID 4920 wrote to memory of 8	4920	msedge.exe	84
PID 4920 wrote to memory of 3432	4920	msedge.exe	85
PID 4920 wrote to memory of 3432	4920	msedge.exe	85
PID 4920 wrote to memory of 3432	4920	msedge.exe	85
PID 4920 wrote to memory of 3432	4920	msedge.exe	85
PID 4920 wrote to memory of 3432	4920	msedge.exe	85
PID 4920 wrote to memory of 3432	4920	msedge.exe	85
PID 4920 wrote to memory of 3432	4920	msedge.exe	85
PID 4920 wrote to memory of 3432	4920	msedge.exe	85
PID 4920 wrote to memory of 3432	4920	msedge.exe	85
PID 4920 wrote to memory of 3432	4920	msedge.exe	85
PID 4920 wrote to memory of 3432	4920	msedge.exe	85
PID 4920 wrote to memory of 3432	4920	msedge.exe	85
PID 4920 wrote to memory of 3432	4920	msedge.exe	85
PID 4920 wrote to memory of 3432	4920	msedge.exe	85
PID 4920 wrote to memory of 3432	4920	msedge.exe	85
PID 4920 wrote to memory of 3432	4920	msedge.exe	85
PID 4920 wrote to memory of 3432	4920	msedge.exe	85
PID 4920 wrote to memory of 3432	4920	msedge.exe	85
PID 4920 wrote to memory of 3432	4920	msedge.exe	85
PID 4920 wrote to memory of 3432	4920	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eaa8f3a825009b515586460a90ffb2c1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff5b8946f8,0x7fff5b894708,0x7fff5b894718
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,7362688844419170278,610816427813504217,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,7362688844419170278,610816427813504217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,7362688844419170278,610816427813504217,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7362688844419170278,610816427813504217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7362688844419170278,610816427813504217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,7362688844419170278,610816427813504217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,7362688844419170278,610816427813504217,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7362688844419170278,610816427813504217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7362688844419170278,610816427813504217,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7362688844419170278,610816427813504217,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7362688844419170278,610816427813504217,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,7362688844419170278,610816427813504217,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4680 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
568B

MD5
c9ca55321d4ed73d0349cf969199c3a1

SHA1
684f68175a53a98bb5f70213bf966d75e3148440

SHA256
bc1a3c3af8228f0dcc4f3555dd4392936805864272ddedaf40e378e75ce096c8

SHA512
f8dab750c4841a78c41d1e9e5fb1c18fa52e036e707b2d529138de4c94392a5280ad4a1ce615b752975d87148c76ea1c48afe8b31817d27f8d49eae3fcc66b89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2a82efb8d67590be42dc78de696e639f

SHA1
896e9ad87df46b43f6a5c17fdb31975c5fdad7c5

SHA256
e0cfc28fe61201fce355db856e135a8a8eff06aec4618c27c573cb82a6646f6f

SHA512
52745c2812e7c4bcf64711841f0bcd402c81cc1dbefc976588433d1cdab334ebb9f0fee4f9d8df7c8bac5d735c22afbd6579cc165e056fc5552a756b68ea292b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
decc0096b30f513c4f025c3b689ee6dc

SHA1
247d5280d6ef7c1cb02f9bc77ab5e4686d0bf978

SHA256
320f3deab8de8aaa29781cb0ef13d02bf7a56391ba663ae88f0c06f0f451e7b3

SHA512
9071cab24a2fe8fb8c0a1ee7588e47a00f15080496e556539b595174cd8115de672a4008abd640381a1a63d321a94eef49cf946679bcb1c9e8ee1755d63710f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2e3e337c881e41f216854c3996c602c4

SHA1
eb9579637213bc999028eeeb570eaeca950a93cc

SHA256
9300b50f78005969e356464f28342771ffdd41177bfe793fdb86bd5a87344523

SHA512
c0540445da3394ef88e8d5177dcef7fa02eeae23e294dcba33da73d660741f1a034fb69cd513eb7a9e42d137fe7cd0021635ba141461812c234bb791e4266148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
490229ac7c2e29ffc1c0dfcb1edd1152

SHA1
4a6fa1bb971e25391bb857c098ac7e76b24d8ca5

SHA256
f4f775d5fa2d87937b1fd1d8df9b72d02d87ace075cf224ecd543d454dc30c7b

SHA512
d8805d10e7f3786a9d8c679bb070aa9f87a43152990324cdd5a54eea3a586c0d9da24516593a64617ac3efa2c5499a5ec774004d9f416315d1c0c9ababd9bede

Download Submit