37e7fd1bb31cdc4a64b009b7723c7bfbb82a90cd256cbd8f93dd89ba598899f6

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac7306ec6654c97aa1d410a6e189c32_JaffaCakes118.html
Size

143KB
MD5

eac7306ec6654c97aa1d410a6e189c32
SHA1

d9ce65db4267931c6d373d5af241d65a849885c5
SHA256

37e7fd1bb31cdc4a64b009b7723c7bfbb82a90cd256cbd8f93dd89ba598899f6
SHA512

021e10e943589e682cb386fc492621b6f93aa3a03624c66be334f3a9826d05ee8f834ad0823e9c6fde75feac728b3916cd9a4599ebc566e62613a0d41a9050df
SSDEEP

1536:SC4xf/0VpXH3JFyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:S11/sHzyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3112	msedge.exe
3112	msedge.exe
4328	identity_helper.exe
4328	identity_helper.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe
3112	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 1084	3112	msedge.exe	82
PID 3112 wrote to memory of 1084	3112	msedge.exe	82
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3696	3112	msedge.exe	83
PID 3112 wrote to memory of 3204	3112	msedge.exe	84
PID 3112 wrote to memory of 3204	3112	msedge.exe	84
PID 3112 wrote to memory of 2052	3112	msedge.exe	85
PID 3112 wrote to memory of 2052	3112	msedge.exe	85
PID 3112 wrote to memory of 2052	3112	msedge.exe	85
PID 3112 wrote to memory of 2052	3112	msedge.exe	85
PID 3112 wrote to memory of 2052	3112	msedge.exe	85
PID 3112 wrote to memory of 2052	3112	msedge.exe	85
PID 3112 wrote to memory of 2052	3112	msedge.exe	85
PID 3112 wrote to memory of 2052	3112	msedge.exe	85
PID 3112 wrote to memory of 2052	3112	msedge.exe	85
PID 3112 wrote to memory of 2052	3112	msedge.exe	85
PID 3112 wrote to memory of 2052	3112	msedge.exe	85
PID 3112 wrote to memory of 2052	3112	msedge.exe	85
PID 3112 wrote to memory of 2052	3112	msedge.exe	85
PID 3112 wrote to memory of 2052	3112	msedge.exe	85
PID 3112 wrote to memory of 2052	3112	msedge.exe	85
PID 3112 wrote to memory of 2052	3112	msedge.exe	85
PID 3112 wrote to memory of 2052	3112	msedge.exe	85
PID 3112 wrote to memory of 2052	3112	msedge.exe	85
PID 3112 wrote to memory of 2052	3112	msedge.exe	85
PID 3112 wrote to memory of 2052	3112	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eac7306ec6654c97aa1d410a6e189c32_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff305346f8,0x7fff30534708,0x7fff30534718
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,16306988209094671259,10716874085884859326,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,16306988209094671259,10716874085884859326,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,16306988209094671259,10716874085884859326,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16306988209094671259,10716874085884859326,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16306988209094671259,10716874085884859326,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,16306988209094671259,10716874085884859326,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,16306988209094671259,10716874085884859326,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16306988209094671259,10716874085884859326,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16306988209094671259,10716874085884859326,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3044 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16306988209094671259,10716874085884859326,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,16306988209094671259,10716874085884859326,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,16306988209094671259,10716874085884859326,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4756 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
de77862d9e4fc701ac6ffa2388f7ea4c

SHA1
ca3610b90f400bff29c38b8deddd20da2fe84548

SHA256
6fdca5f83dd068a3eb426c879849d2aadbd914d8dc582d05f34c7f58fa3ed770

SHA512
85de373155436f3e5707c2ba4465d3b0465b319bccf43a270e8b629229b60a2ef8a47c3c7f63656e1ccfa38b580c4b06d14115afa8ad36d6de50ea1c47edeb5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9320d99d5e20fd068b1463a19e068b53

SHA1
abfba3c95a09159408d038533587173736cb8de6

SHA256
9748a26a100567c98a68c9f83016ddec2ca30c27b331ceefd22b5d3af4f144ab

SHA512
3df92dfe1568715203155e9aedb9d8ca191bfc8d04ccf4e43e4f1393f4e855b1139edf042b4b21b996fc4ba3c654e752b66e3d7c36cd6228e2b3c61b0687ea9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2a7ccee18aeea71047767f24d256fbe0

SHA1
5fbf88262ec0d5c5a10e61cad310fd6c7f1a6f11

SHA256
f2a7699cd03943604900691170bf8c2d1b0f7cdbad75ef88275ffbe14b116e71

SHA512
50d72710998845855ff6349b9b21a30f853cf8c31be074e0ed044c24e106df66d5216e1128af32ae5f239bae14fd3624f53003c839fe14708d906d861e8c4546

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d6328516552c38f519b4eb561be3b108

SHA1
099983bd9691f8b1797b58b0207e594d0c0ee197

SHA256
cfd4536ac5382999832391d2595b2873a187780f4aee28f98cb02529ecdc5b02

SHA512
3b8f945ab798ea901631b4e6ac4010db37cc4a13bd9c6455d56f4f430b720f9df526044e064e71cd65e7d150f9df0ae9809932c15313c659f05a38a9bc2db04a

Download Submit