6a8c9ba05bc1629613927eda075467ffa396ff82b25903a9127232f2baaa9a5b

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 08:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

eaeba41d48fb2a4d50e1bfe25b669510_JaffaCakes118.html
Size

56KB
MD5

eaeba41d48fb2a4d50e1bfe25b669510
SHA1

1a8eb2d6db0128626bae1d9383f7dfac121f85bc
SHA256

6a8c9ba05bc1629613927eda075467ffa396ff82b25903a9127232f2baaa9a5b
SHA512

8de84fed013392e82d06dad17ec9a7e9f88411817e500dbc54982f2cb1c4ea523d7e41ccbf21cab9a2f85dcb561ed04988d2aa71884fdf8990dcbf259368bb46
SSDEEP

768:wL3pHvvCIoolTkrneVmB1mq4A/Lq5/6K9gpgVT:wdHv7oKTkiVmB1mqy6K9r

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
3972	msedge.exe
3972	msedge.exe
2372	identity_helper.exe
2372	identity_helper.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe
4516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 4048	3972	msedge.exe	82
PID 3972 wrote to memory of 4048	3972	msedge.exe	82
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 3212	3972	msedge.exe	83
PID 3972 wrote to memory of 4728	3972	msedge.exe	84
PID 3972 wrote to memory of 4728	3972	msedge.exe	84
PID 3972 wrote to memory of 2492	3972	msedge.exe	85
PID 3972 wrote to memory of 2492	3972	msedge.exe	85
PID 3972 wrote to memory of 2492	3972	msedge.exe	85
PID 3972 wrote to memory of 2492	3972	msedge.exe	85
PID 3972 wrote to memory of 2492	3972	msedge.exe	85
PID 3972 wrote to memory of 2492	3972	msedge.exe	85
PID 3972 wrote to memory of 2492	3972	msedge.exe	85
PID 3972 wrote to memory of 2492	3972	msedge.exe	85
PID 3972 wrote to memory of 2492	3972	msedge.exe	85
PID 3972 wrote to memory of 2492	3972	msedge.exe	85
PID 3972 wrote to memory of 2492	3972	msedge.exe	85
PID 3972 wrote to memory of 2492	3972	msedge.exe	85
PID 3972 wrote to memory of 2492	3972	msedge.exe	85
PID 3972 wrote to memory of 2492	3972	msedge.exe	85
PID 3972 wrote to memory of 2492	3972	msedge.exe	85
PID 3972 wrote to memory of 2492	3972	msedge.exe	85
PID 3972 wrote to memory of 2492	3972	msedge.exe	85
PID 3972 wrote to memory of 2492	3972	msedge.exe	85
PID 3972 wrote to memory of 2492	3972	msedge.exe	85
PID 3972 wrote to memory of 2492	3972	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eaeba41d48fb2a4d50e1bfe25b669510_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6a6246f8,0x7ffc6a624708,0x7ffc6a624718
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,9374332838741143374,9257042456527987264,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,9374332838741143374,9257042456527987264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,9374332838741143374,9257042456527987264,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9374332838741143374,9257042456527987264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9374332838741143374,9257042456527987264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9374332838741143374,9257042456527987264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,9374332838741143374,9257042456527987264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,9374332838741143374,9257042456527987264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9374332838741143374,9257042456527987264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9374332838741143374,9257042456527987264,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9374332838741143374,9257042456527987264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,9374332838741143374,9257042456527987264,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,9374332838741143374,9257042456527987264,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4996 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
c06750e5c3a8ae15d9f0b106b472e261

SHA1
1a565deffb593fabad3d84638c89114d2c7847ef

SHA256
21597946ba0f55f5456acb346aa58e19cda4474f091fcaf620bcb76c61ac2b2c

SHA512
06971558c2d9a0d2794e7945cbe2dce0a0432200be6da563021b9354472ed38dba313bcc21e536072b43234d6f080b51ab16c8c2fb1385efd16ec6ee4d1e0236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a3e22bc10221e83331e854153abc1112

SHA1
510a3c12c627b2adfcbd1a4d15a4664ed3280d7f

SHA256
9eef2f242fa529d2e9c9fa2d3fa10482dca385687d91f1c587e3d423b4504c2c

SHA512
620b9489c3b71688ff8fe36708918abe9b4ca0498fb7bc994ff4b59e29ac36d7d21c5fba43f1137a86cff186f3fac455183c75c2a4595b1dbab93267f405fdc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9b53bf7fa49aacdcb8be7487ac9cf7b4

SHA1
ed423eb3502cabd92b9a3e023304539ccecc2354

SHA256
757e0407bc07cba40fc4906d0ab2fa0d54f53212c3a735187515a9a1c94386c3

SHA512
521b81e8fc2a1c496cd6682f7c299411359f4775879d4ddc38b9a40b8851da39a1e3e06f78845341f8693867c5897859f99f54620d1626d29856c9550761237b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aa3b0cf5d07364a08b171a3f5f34c11f

SHA1
f0f0815f1becbe7d5eb79ea47a85f0ef09f927b8

SHA256
da274a8f21463bd21c3a08a6641078541f1ab167389fd7f24c4fb50337d3bd36

SHA512
17d7ff55188e1bce10000d17b99cb8e781ad0d473b50662e95c39b9515cb8d8310313658d7b18ef5b73d13ffcda24126a29bd09ebdaffc0a09e2a8d586fed40a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
166a352955e9f1cb8e77bf73d52831be

SHA1
7ed97e3a8949f01a1bdfd7133e5d7ed04045cca4

SHA256
a918cbadf2d998c890916ef7519cca0e23d42913f4057287d41e147fc333b031

SHA512
741c967fc61dcc9096b007e1df0b184b61b4721f2e19c3be7740bd19d3f5bf0c468b4bfa408f0a36326d80e77ea6c6ba3ee4889bdc08353fd40bc385238f6ff6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ee08b08731b63d2d5318170adcdf98c8

SHA1
56164b92e4cb7bbcaba751380df1fd575161b2a9

SHA256
b5b3f3f67e087268a3a0a0a1051a2a0870ecdad51a356ced749b27eeb0c4811c

SHA512
cc2ade868e9346940fe2892c66afd6db958c71ab00e19dd0930042b3a93b3b43fa40e231142f6b1268e824def9a338b0cec9302394e18c1a1d385b7869f41535

Download Submit