3cecc6f830d7bed295d9bdc5fa112b22f365a300d4f32a2ee1558a35694d8ea8

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 06:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

eac259a04fc34aae4d7cf7eb105da2b5_JaffaCakes118.html
Size

31KB
MD5

eac259a04fc34aae4d7cf7eb105da2b5
SHA1

471d8fa7ab4acad84c6ad7a949913c50e5558fc9
SHA256

3cecc6f830d7bed295d9bdc5fa112b22f365a300d4f32a2ee1558a35694d8ea8
SHA512

3b944b2fe495c81024160ed312d48c444577c820c638cc2c11942e1e13b31799325e7e4ff0befd2726671a703d73629a99612ae86a24fdcfcf40acb26736b25c
SSDEEP

768:z2Dfg4JFV1ZACcqa1MrOOLrY3ZFnAzNs8ytNT:z2Df7JFV1ZACcqa1MrOOLU3fnAatNT

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
4644	msedge.exe
4644	msedge.exe
3652	identity_helper.exe
3652	identity_helper.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 2348	4644	msedge.exe	82
PID 4644 wrote to memory of 2348	4644	msedge.exe	82
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1388	4644	msedge.exe	83
PID 4644 wrote to memory of 1184	4644	msedge.exe	84
PID 4644 wrote to memory of 1184	4644	msedge.exe	84
PID 4644 wrote to memory of 4764	4644	msedge.exe	85
PID 4644 wrote to memory of 4764	4644	msedge.exe	85
PID 4644 wrote to memory of 4764	4644	msedge.exe	85
PID 4644 wrote to memory of 4764	4644	msedge.exe	85
PID 4644 wrote to memory of 4764	4644	msedge.exe	85
PID 4644 wrote to memory of 4764	4644	msedge.exe	85
PID 4644 wrote to memory of 4764	4644	msedge.exe	85
PID 4644 wrote to memory of 4764	4644	msedge.exe	85
PID 4644 wrote to memory of 4764	4644	msedge.exe	85
PID 4644 wrote to memory of 4764	4644	msedge.exe	85
PID 4644 wrote to memory of 4764	4644	msedge.exe	85
PID 4644 wrote to memory of 4764	4644	msedge.exe	85
PID 4644 wrote to memory of 4764	4644	msedge.exe	85
PID 4644 wrote to memory of 4764	4644	msedge.exe	85
PID 4644 wrote to memory of 4764	4644	msedge.exe	85
PID 4644 wrote to memory of 4764	4644	msedge.exe	85
PID 4644 wrote to memory of 4764	4644	msedge.exe	85
PID 4644 wrote to memory of 4764	4644	msedge.exe	85
PID 4644 wrote to memory of 4764	4644	msedge.exe	85
PID 4644 wrote to memory of 4764	4644	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eac259a04fc34aae4d7cf7eb105da2b5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe318f46f8,0x7ffe318f4708,0x7ffe318f4718
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,7107961521738971718,12499051752122284294,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,7107961521738971718,12499051752122284294,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,7107961521738971718,12499051752122284294,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7107961521738971718,12499051752122284294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7107961521738971718,12499051752122284294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7107961521738971718,12499051752122284294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7107961521738971718,12499051752122284294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,7107961521738971718,12499051752122284294,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,7107961521738971718,12499051752122284294,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7107961521738971718,12499051752122284294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7107961521738971718,12499051752122284294,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7107961521738971718,12499051752122284294,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7107961521738971718,12499051752122284294,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,7107961521738971718,12499051752122284294,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5000 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d51cc0ba79263143adfc12c4a182552b

SHA1
76efbbd4aaae532d5a7204a9a3b484da6056da36

SHA256
090863c285a991b67e0110a4ec713a71966799eca65612b0497141f03b42418b

SHA512
c720556e6111da1dbc992af4761123f73cc9df17aa106d93cf93f9f13c92c2140020f833783f301ab27e49b004753a8decbf3a3e79f80723f6f217691f3f1d9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a1f69048857ea1a78446e7ae0e8c2dd4

SHA1
f16029a6e85d45da012a0e0d251f7038dc2ca67a

SHA256
77b73dd71e529dfe7c8a2cf090052137347395a12d7074c2e00747fecdba12a6

SHA512
7156c6e455942815e4e97ee1cfbefeda8d2c9de4f66849f0ec2c505ad92ef5e7a5d8942d4f77ad52eed6d6c8611d5ff840f5af9d4ee3038a885f79c68c5400b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a3dfb5d564452458b8836fdd6c50a48e

SHA1
446c038e415a47f67266ad378211570d58b60134

SHA256
ae491d44a82ccbc3d9584ed9f67adae12732135e3e91234e32c33bd74babe179

SHA512
91066a28945fe06e558b5b3f83e6b7119fce227bd72055a2680b4c196abc1e57024fd2739b56a1e481bc11fbd998df300e5a99a7027d0a8169dd06c125d949cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
67c5cc8072d064eaf51a421f7ea49e84

SHA1
b9ec9b7cffc457a176285f933b7d4137a7315a31

SHA256
276a5042997ffcf12f61af650b4d7729cbbfacb400e19438873fec2502056d84

SHA512
bd8256eed7fbe117efd83b249923224997b96e1a8f36a0a96f96c65562db063eeaa7b7a8e1ba36ffc40e2560c601df0f8b01e2cbe75b2c226a2c13d6d777b941

Download Submit