53024c727921c0b5e29e464d2571c3621b6edbc7d807e1ecbad1ba57b9459763

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eabb7370070ec0cd09a78216a36c47a1_JaffaCakes118.html
Size

43KB
MD5

eabb7370070ec0cd09a78216a36c47a1
SHA1

71d4988cb05b9eabf35fdc242a3d2fe5d17b8a9d
SHA256

53024c727921c0b5e29e464d2571c3621b6edbc7d807e1ecbad1ba57b9459763
SHA512

d86a52b191aa6434d1a2bc59c6f4e013e4896de5a441384291abd05ca6cf3506437b6fd12588013b52b82f644670613d9e3e1cfd38fba80059d05347817c58ec
SSDEEP

192:BOLTY+a/XjDnlFJ263gyZDxgVeOgHloNB88crI32oIVm3tmC0Kp+SBrnxXgg597y:BpbDpIyVieEmG5qSlxXJBMhtV

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2212	msedge.exe
2212	msedge.exe
4636	msedge.exe
4636	msedge.exe
3652	identity_helper.exe
3652	identity_helper.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe
4636	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 3132	4636	msedge.exe	82
PID 4636 wrote to memory of 3132	4636	msedge.exe	82
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 884	4636	msedge.exe	83
PID 4636 wrote to memory of 2212	4636	msedge.exe	84
PID 4636 wrote to memory of 2212	4636	msedge.exe	84
PID 4636 wrote to memory of 2704	4636	msedge.exe	85
PID 4636 wrote to memory of 2704	4636	msedge.exe	85
PID 4636 wrote to memory of 2704	4636	msedge.exe	85
PID 4636 wrote to memory of 2704	4636	msedge.exe	85
PID 4636 wrote to memory of 2704	4636	msedge.exe	85
PID 4636 wrote to memory of 2704	4636	msedge.exe	85
PID 4636 wrote to memory of 2704	4636	msedge.exe	85
PID 4636 wrote to memory of 2704	4636	msedge.exe	85
PID 4636 wrote to memory of 2704	4636	msedge.exe	85
PID 4636 wrote to memory of 2704	4636	msedge.exe	85
PID 4636 wrote to memory of 2704	4636	msedge.exe	85
PID 4636 wrote to memory of 2704	4636	msedge.exe	85
PID 4636 wrote to memory of 2704	4636	msedge.exe	85
PID 4636 wrote to memory of 2704	4636	msedge.exe	85
PID 4636 wrote to memory of 2704	4636	msedge.exe	85
PID 4636 wrote to memory of 2704	4636	msedge.exe	85
PID 4636 wrote to memory of 2704	4636	msedge.exe	85
PID 4636 wrote to memory of 2704	4636	msedge.exe	85
PID 4636 wrote to memory of 2704	4636	msedge.exe	85
PID 4636 wrote to memory of 2704	4636	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eabb7370070ec0cd09a78216a36c47a1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa94f546f8,0x7ffa94f54708,0x7ffa94f54718
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,13784070309855655255,12784542091166317826,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,13784070309855655255,12784542091166317826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,13784070309855655255,12784542091166317826,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13784070309855655255,12784542091166317826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13784070309855655255,12784542091166317826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,13784070309855655255,12784542091166317826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,13784070309855655255,12784542091166317826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13784070309855655255,12784542091166317826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13784070309855655255,12784542091166317826,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13784070309855655255,12784542091166317826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13784070309855655255,12784542091166317826,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,13784070309855655255,12784542091166317826,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5084 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
183B

MD5
a28fc8c7b408c9fec7eb29ba72319a1a

SHA1
2b1815d04fb077e076a7c078db984304b82cf50e

SHA256
1d26a34f3b686ef9b0f4402fd77dbbf4e517c3a60d31f19751f038953abe9e65

SHA512
6a6f10e0011b2e2f335d65b2b5da07e47e06aa5eeb22ac8950f63928c18242952d216526c8a2ba909ad04fdaf073215c4277272c6de2a28c7cb39a211f0a78bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1203e726abda76118a028414aa79a7fb

SHA1
8e36ee05229bccf567c91b8db0ff0d30e1ce86ff

SHA256
837128d47c514639ef60408c0c706f704972d15759ea7bbebb91960d747d7aac

SHA512
2a3dc21fd1e5c6fd85592368cbf36b9021fdd561cf28a6f397c13b4ed582a97b1ac1052ad4ed71880befbb35c8e68274a650cafdd62f0b9a0d42cb22e99b73fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
77b3409eb306c4583fd422d855347537

SHA1
51a594672a9981b78c88dad04abc0003a64df911

SHA256
4d572233f987dba9a52520d17a568f4054f164840e419b4629824c076f7f78c6

SHA512
33e5df8b1760e469d7d8a394f6f3acae9a18628fe25dd025ef707d3f3c7f86844346d779a1844c56a55af879872085b70f36979b7ebb0501c778d1adb2cc8583

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5a624e2365631908dde23a848ea94f85

SHA1
be8a8dcbb8ba6d3ad90171c86c211cef177138e1

SHA256
f44ca02d0e06264344799a21e89fe2924db7bb140d583d08f043c38b2ed9dd69

SHA512
10b3b35ee750d586efd8be4bbdb777d3d54ac40c732c1308c26e8895be3eec76a9ee44e4eddf75e2cc1c492ba67940f1622365d92d5d9156cd02185111ded8ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
445af6498195268c4ae52c4364212d70

SHA1
40270cc606e0616c386cfe60d4bf5402c97106a2

SHA256
1782a3f7c6bab60fa482cc9dbd01baaa9748b5becb4b8f3d4c0b3f3ee43de63a

SHA512
fc9df07aca66a38582606a4fb3140cefcf4e2418bead335c75235ce4022c7bbc28f8006cf56158bff2ab8c655ca2e63b38a6f6c0834fbd50703c529a0b94c092

Download Submit