61a08df1309df82b9d6a91291654876a9eadb65121365f0d06df2faf497d8f5b

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 05:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eab2e460e4f0e554fe254f0de063efaa_JaffaCakes118.html
Size

50KB
MD5

eab2e460e4f0e554fe254f0de063efaa
SHA1

43d615f07eff3e56265f2598d8a6c7f8bf34604b
SHA256

61a08df1309df82b9d6a91291654876a9eadb65121365f0d06df2faf497d8f5b
SHA512

9a085297a7732e20d9a9d285b8a7aa71be7edeb9ae56f489155d2b6d2f231f8aa2b835b6ece47d974905ca70e77eea0179d63218c70174014750f2b220a29d0b
SSDEEP

1536:ya5eYt7bJvWdV+T8S4LOWkJdf6t25rBFS0GGF+ag4+cKB8:yafvy+T8S4LOPdf6t25rBFBGGOcKB8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1804	msedge.exe
1804	msedge.exe
2892	msedge.exe
2892	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
2464	identity_helper.exe
2464	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 4820	2892	msedge.exe	82
PID 2892 wrote to memory of 4820	2892	msedge.exe	82
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1004	2892	msedge.exe	83
PID 2892 wrote to memory of 1804	2892	msedge.exe	84
PID 2892 wrote to memory of 1804	2892	msedge.exe	84
PID 2892 wrote to memory of 2652	2892	msedge.exe	85
PID 2892 wrote to memory of 2652	2892	msedge.exe	85
PID 2892 wrote to memory of 2652	2892	msedge.exe	85
PID 2892 wrote to memory of 2652	2892	msedge.exe	85
PID 2892 wrote to memory of 2652	2892	msedge.exe	85
PID 2892 wrote to memory of 2652	2892	msedge.exe	85
PID 2892 wrote to memory of 2652	2892	msedge.exe	85
PID 2892 wrote to memory of 2652	2892	msedge.exe	85
PID 2892 wrote to memory of 2652	2892	msedge.exe	85
PID 2892 wrote to memory of 2652	2892	msedge.exe	85
PID 2892 wrote to memory of 2652	2892	msedge.exe	85
PID 2892 wrote to memory of 2652	2892	msedge.exe	85
PID 2892 wrote to memory of 2652	2892	msedge.exe	85
PID 2892 wrote to memory of 2652	2892	msedge.exe	85
PID 2892 wrote to memory of 2652	2892	msedge.exe	85
PID 2892 wrote to memory of 2652	2892	msedge.exe	85
PID 2892 wrote to memory of 2652	2892	msedge.exe	85
PID 2892 wrote to memory of 2652	2892	msedge.exe	85
PID 2892 wrote to memory of 2652	2892	msedge.exe	85
PID 2892 wrote to memory of 2652	2892	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eab2e460e4f0e554fe254f0de063efaa_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb6cbf46f8,0x7ffb6cbf4708,0x7ffb6cbf4718
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,13360491249516169176,14110653691114661643,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2264,13360491249516169176,14110653691114661643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2264,13360491249516169176,14110653691114661643,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3032 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,13360491249516169176,14110653691114661643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,13360491249516169176,14110653691114661643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,13360491249516169176,14110653691114661643,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,13360491249516169176,14110653691114661643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1804 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,13360491249516169176,14110653691114661643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1804 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,13360491249516169176,14110653691114661643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,13360491249516169176,14110653691114661643,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,13360491249516169176,14110653691114661643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,13360491249516169176,14110653691114661643,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:2896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3a8afb9d-7761-48c5-b4b1-65a053e99d65.tmp

Filesize
5KB

MD5
f48d856e3fbb10641b83bdde0e5f182a

SHA1
52173dc732f1a62bb869e8b0468e9dfda8b62a7d

SHA256
173b924df4f5ed9ae16d42be40ca9b5445d57ac272477fae6e530b2459fa699d

SHA512
5e72a7cd8cab97ec69eb30ae18133f70b8e05b22523c1dfd3b0a0e6198287df338bec32c30f0076e1fba6bbe0057c87e73a592cd2c8f2cd83384dc5dfc7ed7d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2117b1b68848c1253f7417df7f301811

SHA1
08c632d0680f80d20611a4a9ce222ca3c59194d8

SHA256
37506d2955a869ce7638364ace712aa24e9eacacf18b80bf2f9906374e3c515a

SHA512
5f1d17bc1619333457ff596f717def5bd059038c1eeb62eb8326038ff01bfa4d76fb2d22c2e1ac271e14f1a761e0c4389dd9199ab38a6763863e1d146b55eb45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a68d9a5f3b4f53a656b6b03d79a18898

SHA1
891d5825675ca93b6d56bde6cfd6aa4e69887954

SHA256
58f2c6c538b880c9dc184caf43b57668199ab216a4c0407f65ed3f326b5322ec

SHA512
b8e82132d22de663c993c475a577deb1b0fd14e37896de6f19b1be613700064f498f7c1c9d69114a016a591c24764dff4f78a8378f9d47434c109bf777596591

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea4781a7eafb1c6bf83e32c4dff2dfdb

SHA1
fed62885c0bee4bf6e34b810151ee7d1e1c668bf

SHA256
719001f77fdaa3d199f9c91cd86c0c4eb99e5aa42266770a0c0dc28c59b3de95

SHA512
f5c55bc141794cfa2c0bb87511839120ceb10a0e1d8e6f3cad01c9d5101b4e40f76c9f23b150608f4e5ec65582e3b42ead0c284aa4fe0a085976d6360825ccb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
29bba31fe0d2a2c20e1687161bf2332e

SHA1
09813a0fce1b2d80e0e045d86586e61b54d75e8e

SHA256
655242761ef746151928b506caa790cbebc9b573f88f4666c5bf216581ea057e

SHA512
6ce32f1cd62423bdc180a2e6eed70a4855db0abfcf04160ba49ae24769a8194653dadcd360c8befcf42a347f822020655e353db1ab91fc0ad9200a6adac5025a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a1ec523d9084a440f7b3728c102c68d7

SHA1
944ab2a44cf5a206908695af00eb2607376c5340

SHA256
9b3c0f0db9b394dfe4d995243b24c0402578347f5b8df1ce2af131ce7b072708

SHA512
287be0cfdb0409ded4c4585f4eb0abfdf1ba41a69e70065d69d97b45eda9b677e792d9eefda53ef97669ffcd29ecece3484bb11ccbd5b09bbe852c2831fd09fe

Download Submit