d700ef30e92897ecb5e94edb325c2b624c8889dcc6497bd92b481d2ccf7a318b

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 05:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef1debb4948c845a369aa04d023db569_JaffaCakes118.html
Size

33KB
MD5

ef1debb4948c845a369aa04d023db569
SHA1

55f96ef81ac0f260d445cef60df10e92785f05ec
SHA256

d700ef30e92897ecb5e94edb325c2b624c8889dcc6497bd92b481d2ccf7a318b
SHA512

b471051bbc348b54c42e3fdb6245b9cb93ccf24778e67e282042c686127bea73e5b0e3090107a93ac3a3406c98e65461c592f2950f29c387012af5ca6136cdcb
SSDEEP

384:SaxUKYoUzqRLN7SvuFqYlV0AV1H7W2QZhPpf2iB37dd0Mgeo8GQhs+FT0/kUHiN:SaCNuVN7SvH6TVFZEf2clIkUHiN

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4612	msedge.exe
4612	msedge.exe
4776	msedge.exe
4776	msedge.exe
4368	identity_helper.exe
4368	identity_helper.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 4176	4776	msedge.exe	82
PID 4776 wrote to memory of 4176	4776	msedge.exe	82
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4076	4776	msedge.exe	83
PID 4776 wrote to memory of 4612	4776	msedge.exe	84
PID 4776 wrote to memory of 4612	4776	msedge.exe	84
PID 4776 wrote to memory of 1408	4776	msedge.exe	85
PID 4776 wrote to memory of 1408	4776	msedge.exe	85
PID 4776 wrote to memory of 1408	4776	msedge.exe	85
PID 4776 wrote to memory of 1408	4776	msedge.exe	85
PID 4776 wrote to memory of 1408	4776	msedge.exe	85
PID 4776 wrote to memory of 1408	4776	msedge.exe	85
PID 4776 wrote to memory of 1408	4776	msedge.exe	85
PID 4776 wrote to memory of 1408	4776	msedge.exe	85
PID 4776 wrote to memory of 1408	4776	msedge.exe	85
PID 4776 wrote to memory of 1408	4776	msedge.exe	85
PID 4776 wrote to memory of 1408	4776	msedge.exe	85
PID 4776 wrote to memory of 1408	4776	msedge.exe	85
PID 4776 wrote to memory of 1408	4776	msedge.exe	85
PID 4776 wrote to memory of 1408	4776	msedge.exe	85
PID 4776 wrote to memory of 1408	4776	msedge.exe	85
PID 4776 wrote to memory of 1408	4776	msedge.exe	85
PID 4776 wrote to memory of 1408	4776	msedge.exe	85
PID 4776 wrote to memory of 1408	4776	msedge.exe	85
PID 4776 wrote to memory of 1408	4776	msedge.exe	85
PID 4776 wrote to memory of 1408	4776	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ef1debb4948c845a369aa04d023db569_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3ab646f8,0x7ffd3ab64708,0x7ffd3ab64718
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,11289847074042361435,15492733547298417208,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,11289847074042361435,15492733547298417208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,11289847074042361435,15492733547298417208,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11289847074042361435,15492733547298417208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11289847074042361435,15492733547298417208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11289847074042361435,15492733547298417208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1332 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11289847074042361435,15492733547298417208,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,11289847074042361435,15492733547298417208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,11289847074042361435,15492733547298417208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11289847074042361435,15492733547298417208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11289847074042361435,15492733547298417208,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,11289847074042361435,15492733547298417208,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4912 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
c8ce52aeb238cbea52b17eedcb7df885

SHA1
0e6a4a6b6f1afe34f2dbd49c801b59eb51c83eca

SHA256
1d325d83251de6d0b9060ed1c2dfa3c8f5ca86b2293144edb9c7fb5e7fdda1e4

SHA512
bf00d69a249601ac5e678f54251c96c1ab6963e9225693e7b34e1ecc63203fd4e620bb2cbae998b1c70aad7ecd136c62ffa5cdbb236bb7f40f06b024bba61bae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
217e76e2c2041664766e27ca05034f92

SHA1
fa1bae22375a22c0ad5a2ec4e2b59e0fd7acf7a0

SHA256
a7d464395d56ca868f72ea2db60b46debfb708f73d1db1883481847fa4b431dd

SHA512
6066d0ed415516b511354ab724c8aa118be10b0ac8ec3c2176a5272f7d40286684542b02a3c268acd0faf8f463525b5ababc7bdd889d3e0bed69e2fcc0758525

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2d89f312-8b28-456c-87ab-513de74205c5.tmp

Filesize
6KB

MD5
582adeff9c79415b42d2f422d92683c4

SHA1
9a2d684a66a729a3254b449167db192086bbc913

SHA256
594c04e77545bdd895a45962cd012fd56aedb98060387af9477552cd3bdf58fa

SHA512
dbbbc1aea9430a207ff7242cd82316219d5ef3944f5aefa5c0bbf607a110ca685126b41d51f0e72ab816a3c78afcabf3e1101a977a0fbd3bc44560ca3f2a179e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
611B

MD5
0f7cd3ca8a524ff443bf34241d37e581

SHA1
f29d4ad1ae66e95cc9de70ca148add4e49a28c02

SHA256
11d1c8a57cabe168e4317dfe83c4389e0f632b1e228a24e5b183396e3d9baa75

SHA512
083d46bf18fb8abaeaed418a8bc7670334e874a2b4a8777f926093dac4cb6cb86c7f18b0fe4996ea014379b0b5f8727c01e70b8b496bd9f102ed2dee4b572371

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
56ed71ae6f42d59c4b222e456ac18e8d

SHA1
5b83c18d15886b61779a74e355a34b84c60965f6

SHA256
18d475154d223cf73c2ad0cdd007b58137a824d1929541277dd9389f4d1dad4d

SHA512
5286decbe54bae7a455ea1aa3dd47ba5fb8e406c948965ec37ac2a70140dd63ca3354a37f1b41c9b653a2e72fcfb659efd3d1557fe3906cced214e5960b9b05a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5308eb3275f3b566af46f689476c09a2

SHA1
e1aca0708df67e4fcf5eff4c53f8da3a75d26b85

SHA256
82f1abdd607afddb1977dc35366d5a996c1f26548c2c762fe503a8fc1162f9a7

SHA512
443c9bf9c8934ec7ac67f1d128110e35c6073a3398162a3e3fb54550450aca6981b3ff41988cd6c4f35f73c05dbfe1f17610e4483116066fd8d115a8c3480ea1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8c82f4cde29cfb681e0105c041deb9f6

SHA1
902b10562b9adaa97ccd5040672f24aa3ca39723

SHA256
763f7284acbd4725e949a028fa9c78965de690dd5db38902903356021b5b45ad

SHA512
6cd0eb98c0e4941961285049b7a13f4382d61045bd0f146f9a80f568273f8a585cf26d1bf23ebc7fa545be44bf6d0f12348255bfd670b80182de1c3362681908

Download Submit