703bb072fe31ce04f3d404a417ca55043b1ffed36df85b5dda1d1b9c38c8aabe

Analysis

max time kernel
144s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ebfb83b975b80cd9f7841dc085762201_JaffaCakes118.html
Size

251KB
MD5

ebfb83b975b80cd9f7841dc085762201
SHA1

590309b2e86adf5ce498ee7cc332d2b2975281f3
SHA256

703bb072fe31ce04f3d404a417ca55043b1ffed36df85b5dda1d1b9c38c8aabe
SHA512

fd82b6285752c057c29fe06339eb259c808c270cd0eae57b07d88c9f0ab3e344d628958f1e6159b4bdfe346c31b67751e4561b123858a698357eec094ef9475f
SSDEEP

6144:LQPOhwsNW0/SF9ALaN2qiHuBJgI+U3xWPPWnD:LQmhwsNWCSLALaN2hucI+UBWI

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
4068	msedge.exe
4068	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
4496	identity_helper.exe
4496	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 3536	4068	msedge.exe	82
PID 4068 wrote to memory of 3536	4068	msedge.exe	82
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 3396	4068	msedge.exe	83
PID 4068 wrote to memory of 1680	4068	msedge.exe	84
PID 4068 wrote to memory of 1680	4068	msedge.exe	84
PID 4068 wrote to memory of 3176	4068	msedge.exe	85
PID 4068 wrote to memory of 3176	4068	msedge.exe	85
PID 4068 wrote to memory of 3176	4068	msedge.exe	85
PID 4068 wrote to memory of 3176	4068	msedge.exe	85
PID 4068 wrote to memory of 3176	4068	msedge.exe	85
PID 4068 wrote to memory of 3176	4068	msedge.exe	85
PID 4068 wrote to memory of 3176	4068	msedge.exe	85
PID 4068 wrote to memory of 3176	4068	msedge.exe	85
PID 4068 wrote to memory of 3176	4068	msedge.exe	85
PID 4068 wrote to memory of 3176	4068	msedge.exe	85
PID 4068 wrote to memory of 3176	4068	msedge.exe	85
PID 4068 wrote to memory of 3176	4068	msedge.exe	85
PID 4068 wrote to memory of 3176	4068	msedge.exe	85
PID 4068 wrote to memory of 3176	4068	msedge.exe	85
PID 4068 wrote to memory of 3176	4068	msedge.exe	85
PID 4068 wrote to memory of 3176	4068	msedge.exe	85
PID 4068 wrote to memory of 3176	4068	msedge.exe	85
PID 4068 wrote to memory of 3176	4068	msedge.exe	85
PID 4068 wrote to memory of 3176	4068	msedge.exe	85
PID 4068 wrote to memory of 3176	4068	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ebfb83b975b80cd9f7841dc085762201_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9931e46f8,0x7ff9931e4708,0x7ff9931e4718
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,643435367881335787,1608024901358776410,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,643435367881335787,1608024901358776410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,643435367881335787,1608024901358776410,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,643435367881335787,1608024901358776410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,643435367881335787,1608024901358776410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,643435367881335787,1608024901358776410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,643435367881335787,1608024901358776410,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,643435367881335787,1608024901358776410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,643435367881335787,1608024901358776410,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,643435367881335787,1608024901358776410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,643435367881335787,1608024901358776410,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3824 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,643435367881335787,1608024901358776410,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,643435367881335787,1608024901358776410,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:3136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
69bce8311b1a1db4672b97c91f22bf38

SHA1
1de12e20f17f4112e62c9986f9069834401a75a3

SHA256
afc6630ca062af478a6b5bf42f140dc039fd352a416b4f50b1438a5f3005e2e3

SHA512
41e524df08057e4cd4dacacef727f76349e37fc6014c7c74b8b28581f1a2e96e8d58e0f946e5c824117817454860c3992f5297ef1c50aa0855a0a57517ed79ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5f48410f2fe4e6f807b9596066ff39c7

SHA1
471a41708348fb83674d3ad8a2ffa0113caa3757

SHA256
1f102af5c7f9997eed2d4afa3e7179a8f76e314a436e6e11756cbb1e7dba955a

SHA512
4aa830a501fb4942cc575a935ba8d01a118659f07a5b088d72f46109b82aef468b281a6a0f46744003897d8332cc7d5776feb4af7820acda70b366728499f48b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f94d07e55dfae962f23255fc5531e39d

SHA1
b2f6183eb9b015cff7639cabfa39bd52af30609f

SHA256
40155e5c54704e69f2fe8ae3a58927f3b5b0f3b269a380b303de030f13686c5a

SHA512
d82db4b611c85899394f0a65fe09fc02076da25719ba02be5d0d804d60ede5055256208f2914406705f8fae7900e2d9597d14c71ad7b7937b0473e234187728e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f4526d2cb7ca417fea707e8f8a29dc76

SHA1
310ffc83b3121aada88367714616d5944017c9de

SHA256
cbe9c01d3ee7e4141b6df7ec839833dda90b196be6c96a4f3fa8f7dd4599b620

SHA512
3e11f84542f61d67eed0725c6b66d7dc15a942f1c0371b0738de94faa0d5e2f4f3db7175113e90b987393988e965a11944e1f91f3f04233e024316c4e0522ebc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
113394cc5180888e8b2b9ca2cc8a7696

SHA1
5942819415fa0adcb8637c1d3247a7409b85c53b

SHA256
7510ffc6c6c1d0517c53b70533e266fd0d817cf03a3e6267445924f38cb8ac01

SHA512
8432b4826e6d856718284c2675a2b357568e47520801b168a687f38b21a8c5607d7989dea0fb8ab5b7366ff97116a1b943b7cc46e6f2de7ccd006cff58e41417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
eeb80cbf5795a70ec8e866db34a9fa68

SHA1
b47a6d1a52a95e3f851d6f7fe55d92920cd23616

SHA256
496c56178dd0762504fe85ffeef779b9a479e158e7c04c2bde2403a3ab2907f6

SHA512
bb6c958f033fb4672df267564626166a31d0591b3e5d63109ee3fd6aaafd7b73344e76c859354234b4bff73223bdeb81329653d6fab96d02ba21c813bacf525e

Download Submit