130716c9d9cce881cc0a4b60e4e8d066ead7c74ce942da6e9b27f1961f196c2a

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 09:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eafedbcaf72370e49995bc7f90ded0e6_JaffaCakes118.html
Size

461KB
MD5

eafedbcaf72370e49995bc7f90ded0e6
SHA1

4a385b41098a2a9f2fa9552cf9b3ff0093ed70e6
SHA256

130716c9d9cce881cc0a4b60e4e8d066ead7c74ce942da6e9b27f1961f196c2a
SHA512

fe2ccb7d23c8d8bc942e07386cc8ea13d682990996dc64639bfdef0a2071bcc43b475fdc44d5c7f350658058d2ee3871757d372882b1e71a56e64be1fb75fddb
SSDEEP

6144:SCsMYod+X3oI+Yx/sMYod+X3oI+Y6sMYod+X3oI+YLsMYod+X3oI+YQ:V5d+X3P5d+X3e5d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
2672	msedge.exe
2672	msedge.exe
1204	identity_helper.exe
1204	identity_helper.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 1920	2672	msedge.exe	84
PID 2672 wrote to memory of 1920	2672	msedge.exe	84
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4372	2672	msedge.exe	85
PID 2672 wrote to memory of 4704	2672	msedge.exe	86
PID 2672 wrote to memory of 4704	2672	msedge.exe	86
PID 2672 wrote to memory of 1804	2672	msedge.exe	87
PID 2672 wrote to memory of 1804	2672	msedge.exe	87
PID 2672 wrote to memory of 1804	2672	msedge.exe	87
PID 2672 wrote to memory of 1804	2672	msedge.exe	87
PID 2672 wrote to memory of 1804	2672	msedge.exe	87
PID 2672 wrote to memory of 1804	2672	msedge.exe	87
PID 2672 wrote to memory of 1804	2672	msedge.exe	87
PID 2672 wrote to memory of 1804	2672	msedge.exe	87
PID 2672 wrote to memory of 1804	2672	msedge.exe	87
PID 2672 wrote to memory of 1804	2672	msedge.exe	87
PID 2672 wrote to memory of 1804	2672	msedge.exe	87
PID 2672 wrote to memory of 1804	2672	msedge.exe	87
PID 2672 wrote to memory of 1804	2672	msedge.exe	87
PID 2672 wrote to memory of 1804	2672	msedge.exe	87
PID 2672 wrote to memory of 1804	2672	msedge.exe	87
PID 2672 wrote to memory of 1804	2672	msedge.exe	87
PID 2672 wrote to memory of 1804	2672	msedge.exe	87
PID 2672 wrote to memory of 1804	2672	msedge.exe	87
PID 2672 wrote to memory of 1804	2672	msedge.exe	87
PID 2672 wrote to memory of 1804	2672	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eafedbcaf72370e49995bc7f90ded0e6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffcfc5946f8,0x7ffcfc594708,0x7ffcfc594718
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,18262669376711622609,18338124853296504445,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,18262669376711622609,18338124853296504445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,18262669376711622609,18338124853296504445,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18262669376711622609,18338124853296504445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18262669376711622609,18338124853296504445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,18262669376711622609,18338124853296504445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,18262669376711622609,18338124853296504445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18262669376711622609,18338124853296504445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18262669376711622609,18338124853296504445,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18262669376711622609,18338124853296504445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,18262669376711622609,18338124853296504445,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,18262669376711622609,18338124853296504445,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2392 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9574e99d57358b14cab8e62b6a56f726

SHA1
46b7c1650dc8bccbb0311c0d2a83c280b1bbfe2f

SHA256
ba202b38e797767e4ce82fae98f4c4b825e5e10f632a90cf0cf5d8b7f9a8a5dd

SHA512
66ac8c7ac6a4b513196288bc5a4c2668948ca01dd46fb0f285973028edfb93008c2c5eeab3bd71218771383d262e993eed69ff54bb56742bec23eb18ff353093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0d341a4dfef67f69d9d5d07d2647d068

SHA1
3adcf0c6e866063a7a85699a3d8f516bdc435ee1

SHA256
8a47848c3dd580ec3108dfdd6cf723243615e4f4da5343f0cb0b977dbc4a33b3

SHA512
96a1d8b4f93ec12a2cd047886d84f214e2ccaa8c7ca5d0d2a4d294b9ded164fc2fe42cca2b86fe05046e258354422b94fbffdad04684117fada93919ee07b308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6a6f7ad840f82c8363c30b5798a78289

SHA1
7f40fd9d5d07d11987757a691674e0fb535bbbe8

SHA256
50e97f1b175ab2be703c4abe3d79bc33d5d14953ff8c31bc5e587e10ff78c15f

SHA512
f0b7e240b227773bb7469a178f136f8768215244e3930f20b1f9b4c0d301721bc0e7605ded2397e78dc6bdc3d3b090f48ce71f4a405ed1174e9ca363886faf43

Download Submit