068475702c566bd8294892791ed954d1439c94bbb12122f1d181c8fc904ccaa9

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac57e32e3defd157d4459e63007bbee_JaffaCakes118.html
Size

4KB
MD5

eac57e32e3defd157d4459e63007bbee
SHA1

42df2c1c38b1d985a15a4fd372ad15aa76f6f16b
SHA256

068475702c566bd8294892791ed954d1439c94bbb12122f1d181c8fc904ccaa9
SHA512

16886449f062b27d471c8caf7efa163026f831663b4d7659a45bcd8d4c34df4087008cf6db87ac21f11f756999c6fa0478006b7ac51ab00cd3a5f2df59747e62
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8opMZIyd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDT

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
1500	msedge.exe
1500	msedge.exe
4400	identity_helper.exe
4400	identity_helper.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 3536	1500	msedge.exe	82
PID 1500 wrote to memory of 3536	1500	msedge.exe	82
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2820	1500	msedge.exe	83
PID 1500 wrote to memory of 2956	1500	msedge.exe	84
PID 1500 wrote to memory of 2956	1500	msedge.exe	84
PID 1500 wrote to memory of 4804	1500	msedge.exe	85
PID 1500 wrote to memory of 4804	1500	msedge.exe	85
PID 1500 wrote to memory of 4804	1500	msedge.exe	85
PID 1500 wrote to memory of 4804	1500	msedge.exe	85
PID 1500 wrote to memory of 4804	1500	msedge.exe	85
PID 1500 wrote to memory of 4804	1500	msedge.exe	85
PID 1500 wrote to memory of 4804	1500	msedge.exe	85
PID 1500 wrote to memory of 4804	1500	msedge.exe	85
PID 1500 wrote to memory of 4804	1500	msedge.exe	85
PID 1500 wrote to memory of 4804	1500	msedge.exe	85
PID 1500 wrote to memory of 4804	1500	msedge.exe	85
PID 1500 wrote to memory of 4804	1500	msedge.exe	85
PID 1500 wrote to memory of 4804	1500	msedge.exe	85
PID 1500 wrote to memory of 4804	1500	msedge.exe	85
PID 1500 wrote to memory of 4804	1500	msedge.exe	85
PID 1500 wrote to memory of 4804	1500	msedge.exe	85
PID 1500 wrote to memory of 4804	1500	msedge.exe	85
PID 1500 wrote to memory of 4804	1500	msedge.exe	85
PID 1500 wrote to memory of 4804	1500	msedge.exe	85
PID 1500 wrote to memory of 4804	1500	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eac57e32e3defd157d4459e63007bbee_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9931e46f8,0x7ff9931e4708,0x7ff9931e4718
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,5616938462780341160,6364106365495061300,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,5616938462780341160,6364106365495061300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,5616938462780341160,6364106365495061300,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5616938462780341160,6364106365495061300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5616938462780341160,6364106365495061300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,5616938462780341160,6364106365495061300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,5616938462780341160,6364106365495061300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5616938462780341160,6364106365495061300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5616938462780341160,6364106365495061300,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5616938462780341160,6364106365495061300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5616938462780341160,6364106365495061300,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,5616938462780341160,6364106365495061300,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5500 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
292B

MD5
e8ad18683672c1fc08de4a32187a6a6c

SHA1
8cd1324088403b5b6c0549469129d1168fc67d1f

SHA256
fc4a7ebfedc05516711f4dc4315513840d6d4dcb2945bb8f4fbc60b3ec093d46

SHA512
4b6638759622decaa39d3307931ee9bf9f415c0262cbb77a41df66924d1e609f62ea17321a59b883eea59b90df9ade83ea2991e97a8eaad77640a521dab45e2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
de0428daab37c67c48a90d2f9f33601c

SHA1
8dee72277b56bb0218861eaa99f09b4cb7012350

SHA256
6b4c1f9b1819551201d51ae6442f7776124ac0955c6e80c1f26768a8518babb4

SHA512
7a484cb17c90ab0cdaf91a26a3126c7b55e93136691c2e0c57c1692715ab07660e465dd1d509d015cc116fb3c8ad288181b74948b2bd844349973514872badca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0c39b23d3709199bfbd05f41abf3f31a

SHA1
edd7d36d465abe79b3618119786bd69f89656797

SHA256
42cace0963fa186b0298e838b7fd67d25035d5acc6717bf3918541080063d0c6

SHA512
5462b5412f96ac0229a93bd92949767056b235de8cab38b99bacc7fe7ecc469b36752c1bd4b5115f0a6546737f2ed3babf637243772e1f24576721dca5bb4ce9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
785452e8b8f080c5d68b1a1786406b5b

SHA1
31587c5a7d995c0532f017e8689b5fbd50a3371f

SHA256
c4974c842dae78152f8d2d4511cf35a909382bf742e348f02693534d7e7835de

SHA512
59c7daff5af8641365e1ce0dd7d30e4e6d82c7e87e44cadf6838a5ec5f335ccaa5061f859a2ac0bef2d779d8b4a1815cec4fb43e7d9a4774fde7925bfb5c4222

Download Submit