560ef893bc357fa06b9395060c12a10dfbb8348d46540d5695a38e628a511a1b

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eabcf53a3cf02dbf8d3a6683e76bcdec_JaffaCakes118.html
Size

238KB
MD5

eabcf53a3cf02dbf8d3a6683e76bcdec
SHA1

61339577310bd612365695b2adef08768f66a983
SHA256

560ef893bc357fa06b9395060c12a10dfbb8348d46540d5695a38e628a511a1b
SHA512

9a485566f6d79fda94b0b673ecc0be6acaebd7912d99c0d9996d79f165f24e8ff96dcccc8cf36167889dcdc66b670d6c9308b8505e3b89584a593a0af100309b
SSDEEP

3072:R11vYa7bdqmMkEa0bTdtjVTHKzJXa+QB6lYbg/6s7r7fNWHX:nEa0yvr7fNWHX

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
756	msedge.exe
756	msedge.exe
4472	msedge.exe
4472	msedge.exe
4772	identity_helper.exe
4772	identity_helper.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe
2208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 2260	4472	msedge.exe	82
PID 4472 wrote to memory of 2260	4472	msedge.exe	82
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 3064	4472	msedge.exe	83
PID 4472 wrote to memory of 756	4472	msedge.exe	84
PID 4472 wrote to memory of 756	4472	msedge.exe	84
PID 4472 wrote to memory of 3176	4472	msedge.exe	85
PID 4472 wrote to memory of 3176	4472	msedge.exe	85
PID 4472 wrote to memory of 3176	4472	msedge.exe	85
PID 4472 wrote to memory of 3176	4472	msedge.exe	85
PID 4472 wrote to memory of 3176	4472	msedge.exe	85
PID 4472 wrote to memory of 3176	4472	msedge.exe	85
PID 4472 wrote to memory of 3176	4472	msedge.exe	85
PID 4472 wrote to memory of 3176	4472	msedge.exe	85
PID 4472 wrote to memory of 3176	4472	msedge.exe	85
PID 4472 wrote to memory of 3176	4472	msedge.exe	85
PID 4472 wrote to memory of 3176	4472	msedge.exe	85
PID 4472 wrote to memory of 3176	4472	msedge.exe	85
PID 4472 wrote to memory of 3176	4472	msedge.exe	85
PID 4472 wrote to memory of 3176	4472	msedge.exe	85
PID 4472 wrote to memory of 3176	4472	msedge.exe	85
PID 4472 wrote to memory of 3176	4472	msedge.exe	85
PID 4472 wrote to memory of 3176	4472	msedge.exe	85
PID 4472 wrote to memory of 3176	4472	msedge.exe	85
PID 4472 wrote to memory of 3176	4472	msedge.exe	85
PID 4472 wrote to memory of 3176	4472	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eabcf53a3cf02dbf8d3a6683e76bcdec_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9931e46f8,0x7ff9931e4708,0x7ff9931e4718
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,12236207330203013670,2080727217531862485,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,12236207330203013670,2080727217531862485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,12236207330203013670,2080727217531862485,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12236207330203013670,2080727217531862485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12236207330203013670,2080727217531862485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,12236207330203013670,2080727217531862485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,12236207330203013670,2080727217531862485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12236207330203013670,2080727217531862485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12236207330203013670,2080727217531862485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12236207330203013670,2080727217531862485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12236207330203013670,2080727217531862485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12236207330203013670,2080727217531862485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,12236207330203013670,2080727217531862485,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
465B

MD5
86af6c5250ebc84d0361edcff4f9ec13

SHA1
413cf1280cc3c2474627bca7a5b59da243881be2

SHA256
db275bf84063ef08157d2e0169fba454594b803d5fa3c8a587bedab7b24e2ffb

SHA512
c52d09e143e7feb226b6dc77bb3fcc01e0f092a140fe56572d681b0345b086599bbe7c98209f43bc816525cb0c3944bc4154c80b6c64c93d390c3d92318fea2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b191878e888d0a213cb9ad529af6d68c

SHA1
a3991384f955cffc8a9c308a80ec0a1f837fac35

SHA256
143c20c5b6e3743cfab67556f8f14931baa4e5e9f62c3705deaa3cce00d4f301

SHA512
18daf02f5181ef41f8086e227d0392000230863b0774022ccea94b9333742b210161375692d1f8b9cf69796a7982eef65dfd19954269c2387b0d1d48a2a6cc53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
092725134156ccb731650f836efa9e1e

SHA1
87ea55e06433b15c51530690a254d469b8bbef22

SHA256
8fe1180fb27616cba3ffedb67d11578542537bc31a459b9269d4ef6479bed0e2

SHA512
6f579123e92b26d661a2d377a90155efe98d332b40c4a3561ee21ddb8b40920c82dea510f2a8fef5c089c56cfe69cd23adc8b257f85435ae767d478b5c04b17b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f40d74ddd56b788b79eca70910cf4998

SHA1
cfdc3b087baf5da6339bbe8de1607418755181f6

SHA256
be25ca7dcbea30744b4dad57569762c28a0e7f0895abbf6b419f8ec74139fea0

SHA512
672ae5a8f6180ae2db309df488448df23574e1822360675c7d7e14a3bed9cf911b7a4555ee94227d0198a51730b8f974aea773aa46c4ea2b82c28ff16ff2b4af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
81b11a3f1b028e0295e422418e9d99a5

SHA1
6b0c9c69286e984230549b481d771222c0731e09

SHA256
560e1688a6bb6e9a75f21e7f3c779a5b9f4b5eeb45d2b35ac9c9eb3c4d726510

SHA512
196b6256329eab3ccef8224b73e3183d0b6505b54640debdfb621fbcb7855ed49f2b682c12d408a8c19f7b4f5a5085bda76f31e1a476ec16bf306289c132e8ff

Download Submit