7c175b7f2e71f564a4222508788a47bf56d89a669a00242215ce1873194b8530

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaba588894b7282c6868c202597ea1cd_JaffaCakes118.html
Size

24KB
MD5

eaba588894b7282c6868c202597ea1cd
SHA1

8f1b5e5d1c12ce3296eb179b30355b2a1d7d0bc8
SHA256

7c175b7f2e71f564a4222508788a47bf56d89a669a00242215ce1873194b8530
SHA512

cbba0dd15edc315c6be6c1a8c89ecb03c4c666372ae369595cfc61b537a1b4afb38b933a0dea7cf6b8544198a99466780f8312feee1a7a706f8f88e05409c66d
SSDEEP

768:gwG3ZGNTbDh7jjkST+9O1KFjIFIXGsagpAkfimpgpAkfimQWtJ4phZgt4:/cZGNTbDh7jjkST+9O1KFjIgGs3AkfiQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4120	msedge.exe
4120	msedge.exe
4848	msedge.exe
4848	msedge.exe
4292	identity_helper.exe
4292	identity_helper.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4600	4848	msedge.exe	82
PID 4848 wrote to memory of 4600	4848	msedge.exe	82
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 3120	4848	msedge.exe	83
PID 4848 wrote to memory of 4120	4848	msedge.exe	84
PID 4848 wrote to memory of 4120	4848	msedge.exe	84
PID 4848 wrote to memory of 224	4848	msedge.exe	85
PID 4848 wrote to memory of 224	4848	msedge.exe	85
PID 4848 wrote to memory of 224	4848	msedge.exe	85
PID 4848 wrote to memory of 224	4848	msedge.exe	85
PID 4848 wrote to memory of 224	4848	msedge.exe	85
PID 4848 wrote to memory of 224	4848	msedge.exe	85
PID 4848 wrote to memory of 224	4848	msedge.exe	85
PID 4848 wrote to memory of 224	4848	msedge.exe	85
PID 4848 wrote to memory of 224	4848	msedge.exe	85
PID 4848 wrote to memory of 224	4848	msedge.exe	85
PID 4848 wrote to memory of 224	4848	msedge.exe	85
PID 4848 wrote to memory of 224	4848	msedge.exe	85
PID 4848 wrote to memory of 224	4848	msedge.exe	85
PID 4848 wrote to memory of 224	4848	msedge.exe	85
PID 4848 wrote to memory of 224	4848	msedge.exe	85
PID 4848 wrote to memory of 224	4848	msedge.exe	85
PID 4848 wrote to memory of 224	4848	msedge.exe	85
PID 4848 wrote to memory of 224	4848	msedge.exe	85
PID 4848 wrote to memory of 224	4848	msedge.exe	85
PID 4848 wrote to memory of 224	4848	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eaba588894b7282c6868c202597ea1cd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa591d46f8,0x7ffa591d4708,0x7ffa591d4718
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,8925339222419899277,7409454448703501823,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,8925339222419899277,7409454448703501823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,8925339222419899277,7409454448703501823,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8925339222419899277,7409454448703501823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8925339222419899277,7409454448703501823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,8925339222419899277,7409454448703501823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1368 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,8925339222419899277,7409454448703501823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8925339222419899277,7409454448703501823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8925339222419899277,7409454448703501823,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8925339222419899277,7409454448703501823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8925339222419899277,7409454448703501823,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2620 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,8925339222419899277,7409454448703501823,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4060 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
594B

MD5
d56def628c2e81c977c2c5fbc5ea2eb7

SHA1
5a7fe71ed38c983096dd88c31e129d9659f1794d

SHA256
c514a508f0e713f949d08f20832408b1b6f1d703a330ff06e6b9332648435016

SHA512
a6c60ee81294aa63ed87abaefcc3fb6c89e9f9a4efc28f66ad584428d827de68bc099c6ef61e84978af2a0cdc926b529cb48e1261c2c5cd47528c0d35937ec67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
70ecbf29a23b0e86f8ddca474c57087f

SHA1
3797c1f905c39f08478bafe3113bd6c2ead78de0

SHA256
3f57a752fb8a65148436d6fe9b55c3e86714a0ab8b6d91d392cccba0a94f8409

SHA512
5a6f73cc400a1f8182a38b43ce982a6cad325bddd401003bae4b70afecf98d84ec7cbb2a68c88f32e0d63b851e0a5ad826e5a9d50a8e4dd048334eac275041e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ee3753420c09cca3f49d0e59c97ac04e

SHA1
08dc3290d74bb7b67dd75140c282bc3032d15dbb

SHA256
4b8968e39eaa604912d42b5e510059269883cf0733eaa6327b8f8de058466500

SHA512
aae5261afe6d209992893a067810ff0fa1366130c00f3cc4334cc4dd033cc437321b24d3a1604783502c1d40751308ee7866c6b4a34ed2d91b4edbaa37228879

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ec9765963989a06b61c162f8094a6413

SHA1
f2310ad8c40c7d785299947811dd8f102ee03ad2

SHA256
8362d853a08d0eeeea4c3f1b478897a85157fdec73c1cb5c98f24e4f65cdbbec

SHA512
adea171e9a310f8cddf6955bff0bfc636142104d710ed88a9c11c8e486218bb4968f7c7c821755800b0a2958bec5582f94c39a050b4e8116e54d99ae4e0df983

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
92e7cc8aa6c901058d365ca8a66aecd9

SHA1
a9c7d32e7049dded1bfb8f940006f422646f6ba5

SHA256
bd32e7c0c80cbbeed192b4830a73f56c00e4400c87d82eb1af20e2a6b93259f8

SHA512
50747eb6d4678ba431b71ab18825b322f814555e5496830c93e46c9e72d3cfd4466fe6fa2c8c18780206367badb7380213fbf36b70634be5fa2d4caa91e8dc19

Download Submit