345aed774d4508d3e6c4237d8412c4a76255976ebad9e0090143a249e3cedd6d

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 07:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ead2806c128f41e6638389099e6c9e02_JaffaCakes118.html
Size

48KB
MD5

ead2806c128f41e6638389099e6c9e02
SHA1

26dcc771f024fa2cc8772645a03800869ed09947
SHA256

345aed774d4508d3e6c4237d8412c4a76255976ebad9e0090143a249e3cedd6d
SHA512

c75517143f6a3a6baa2c27324b542161f93f2a97243dc9c1ec6926a361bebe858ae0fef3093e8787e11ac0c15e2f2dd444d20d6b6a1077ca388ce33c69eca187
SSDEEP

1536:S47hotdc205+bdhFCFR4/z/eY/1/X/1/9drQfTSL:S47hCj1pvp9dcfG

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
2896	msedge.exe
2896	msedge.exe
960	identity_helper.exe
960	identity_helper.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 3372	4672	msedge.exe	82
PID 4672 wrote to memory of 3372	4672	msedge.exe	82
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 1972	4672	msedge.exe	83
PID 4672 wrote to memory of 2896	4672	msedge.exe	84
PID 4672 wrote to memory of 2896	4672	msedge.exe	84
PID 4672 wrote to memory of 4904	4672	msedge.exe	85
PID 4672 wrote to memory of 4904	4672	msedge.exe	85
PID 4672 wrote to memory of 4904	4672	msedge.exe	85
PID 4672 wrote to memory of 4904	4672	msedge.exe	85
PID 4672 wrote to memory of 4904	4672	msedge.exe	85
PID 4672 wrote to memory of 4904	4672	msedge.exe	85
PID 4672 wrote to memory of 4904	4672	msedge.exe	85
PID 4672 wrote to memory of 4904	4672	msedge.exe	85
PID 4672 wrote to memory of 4904	4672	msedge.exe	85
PID 4672 wrote to memory of 4904	4672	msedge.exe	85
PID 4672 wrote to memory of 4904	4672	msedge.exe	85
PID 4672 wrote to memory of 4904	4672	msedge.exe	85
PID 4672 wrote to memory of 4904	4672	msedge.exe	85
PID 4672 wrote to memory of 4904	4672	msedge.exe	85
PID 4672 wrote to memory of 4904	4672	msedge.exe	85
PID 4672 wrote to memory of 4904	4672	msedge.exe	85
PID 4672 wrote to memory of 4904	4672	msedge.exe	85
PID 4672 wrote to memory of 4904	4672	msedge.exe	85
PID 4672 wrote to memory of 4904	4672	msedge.exe	85
PID 4672 wrote to memory of 4904	4672	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ead2806c128f41e6638389099e6c9e02_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd83a46f8,0x7ffcd83a4708,0x7ffcd83a4718
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,2760252183553665359,737969831314824658,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,2760252183553665359,737969831314824658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,2760252183553665359,737969831314824658,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2476 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2760252183553665359,737969831314824658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2760252183553665359,737969831314824658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3096 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,2760252183553665359,737969831314824658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,2760252183553665359,737969831314824658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2760252183553665359,737969831314824658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2760252183553665359,737969831314824658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2760252183553665359,737969831314824658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,2760252183553665359,737969831314824658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,2760252183553665359,737969831314824658,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
470B

MD5
d2f6585dc5da918796bf6f43ee1aea23

SHA1
3561216bb43a6593e288b2d4a9d0f415104e6ac2

SHA256
969af1061e7fe1448bb2953b6ed4efe3330f397ec9d9454199bfe3fa27c818c5

SHA512
c14cb981b01fb10c8be1840f2304c7ed1a1c4249dde46df5cb148614788650b894b35ebc30259d6b6e0f9902485418b9ed0b7817743d5d9a9f3b270162e8582e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dcecdda4fa487f0ecbbfd843263e0918

SHA1
463bf9f9b50c5235a62bfd1b0ec7a7fc24010989

SHA256
802f5c801107c122b68a6af09f3eef8fdc5eebe2f018f08beb45e012d0009744

SHA512
d7d6fb789e5bfd0886081b2401463b14dfffed8dd89e50701d30a822feee0852b3545ee7f44fd63d6383811d86321163f5bd8fef17886263106f954aae4343aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
09295086c23da897d90cbbfa8a6ecb11

SHA1
7340d1e9082e24e46b2611267fc8bdaef74e0661

SHA256
99684b6a7d5a1e8649f6890dd1178d771073544ebd287319eef0d54be13154f7

SHA512
dbe6c3f6302417cd8510416fde0efb168ff829166ee4f3859440f2f7663367442135ee857b542ae901b7ade321a8fd75a10ea5834a2feb3fb31e12ca17c9b750

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
23a3c8149694112ed40cee95c31ac993

SHA1
c752626beb696b1822678851a4bd58256fcc8093

SHA256
695be63c26f286d6de63e7df683e742efb8bc516d3dc03e839cd5cc21e313184

SHA512
e2ee0e27e17635f22ca22cd36ae951df8953dd7a5197dd70d43e4c05a894802b8441c0df92036d98d78ac89ab499e9c36966e712a92c81f6ccf5d338e59e103b

Download Submit