516949a8c9e6e1135bf559757591422aa30e0388cb22bdc9edcac7646a990271

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 08:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef6aac49a6abbccf68a02b4604c6fac4_JaffaCakes118.html
Size

30KB
MD5

ef6aac49a6abbccf68a02b4604c6fac4
SHA1

1869cd9e9a94edd69b0aeaabf9f4e5869f7daafd
SHA256

516949a8c9e6e1135bf559757591422aa30e0388cb22bdc9edcac7646a990271
SHA512

3800baba91a05c3a3f2e8ac439cfb1c3754f2f67f11cdc085e5ddb15fd09a82194afcf2660a2c81c70b67c871d1b18c412af944ed93f33ed92b4958002bbfd25
SSDEEP

768:fqjAJR/axfyS2Ka02htwJm9w9mVhJCGkJHerMagX/ifQDqaNw5a/7fj2s51c3DJq:fqjAJR/axfyS2Ka0swJEwsUBJHerMag/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4704	msedge.exe
4704	msedge.exe
1724	identity_helper.exe
1724	identity_helper.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe
4784	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4388	4704	msedge.exe	82
PID 4704 wrote to memory of 4388	4704	msedge.exe	82
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4616	4704	msedge.exe	83
PID 4704 wrote to memory of 4296	4704	msedge.exe	84
PID 4704 wrote to memory of 4296	4704	msedge.exe	84
PID 4704 wrote to memory of 1976	4704	msedge.exe	85
PID 4704 wrote to memory of 1976	4704	msedge.exe	85
PID 4704 wrote to memory of 1976	4704	msedge.exe	85
PID 4704 wrote to memory of 1976	4704	msedge.exe	85
PID 4704 wrote to memory of 1976	4704	msedge.exe	85
PID 4704 wrote to memory of 1976	4704	msedge.exe	85
PID 4704 wrote to memory of 1976	4704	msedge.exe	85
PID 4704 wrote to memory of 1976	4704	msedge.exe	85
PID 4704 wrote to memory of 1976	4704	msedge.exe	85
PID 4704 wrote to memory of 1976	4704	msedge.exe	85
PID 4704 wrote to memory of 1976	4704	msedge.exe	85
PID 4704 wrote to memory of 1976	4704	msedge.exe	85
PID 4704 wrote to memory of 1976	4704	msedge.exe	85
PID 4704 wrote to memory of 1976	4704	msedge.exe	85
PID 4704 wrote to memory of 1976	4704	msedge.exe	85
PID 4704 wrote to memory of 1976	4704	msedge.exe	85
PID 4704 wrote to memory of 1976	4704	msedge.exe	85
PID 4704 wrote to memory of 1976	4704	msedge.exe	85
PID 4704 wrote to memory of 1976	4704	msedge.exe	85
PID 4704 wrote to memory of 1976	4704	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ef6aac49a6abbccf68a02b4604c6fac4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffead0b46f8,0x7ffead0b4708,0x7ffead0b4718
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,156878217830933731,5996167732251699045,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2256,156878217830933731,5996167732251699045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2256,156878217830933731,5996167732251699045,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,156878217830933731,5996167732251699045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,156878217830933731,5996167732251699045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2256,156878217830933731,5996167732251699045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2256,156878217830933731,5996167732251699045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,156878217830933731,5996167732251699045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,156878217830933731,5996167732251699045,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,156878217830933731,5996167732251699045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,156878217830933731,5996167732251699045,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,156878217830933731,5996167732251699045,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4900 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
196B

MD5
0fcfc4521589492fb6c9beb7df392a00

SHA1
06ef714036e5077372906eb5a5b758dc1b20ef4f

SHA256
bc0c430bc03f85fee84b340273e757c3c954a1dc300542015fa0e569e2be8ce8

SHA512
edbf9b541047b5b54bdb7c4bcdfc9ecd08117c90ebf7f6be117e5241bc51900a1f11cffec385f40a5aafe6fc0eeaf9a6520f1805caf1bdb802a96f4318fb7f99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d9bbf618159eca18a61547e309c1196d

SHA1
c9a3e6aa6f4bea8fe622cc8333759ef0382358f2

SHA256
f6a281f7464ff3e088ea54d46d1bdbe6f107d65e28ab34cc796af9020ef807c6

SHA512
5f375a3ccdaea83ab9c34c524f1946d13b0069cfd250350d7e9a809586fd27e58e78279e63f6a866a47c4410b040343328743c0b3689bc762b0d8f657c4a347b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d4b106f51ae54fd76397a4d297af67d9

SHA1
0737d0237c53cba0c6507ddd1df113549aa8aeaf

SHA256
d86eaf50b50dca5f8cf451caff9695d626e94210fc66884b07d160f7778fc0a0

SHA512
356afb7338cf710b6929917c8767d8626f68b53a93d8856abc4907227468b52b03a51a9c723e591f3611e91de9023c0efee82fcdc68596e371c57d013b9860c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
04f0b65669d42cda60a9453a9302de37

SHA1
b45f2a5fa035a1c06df5c08faa27ec9ba9523352

SHA256
a4475a34feee1e32e24916cf870262d2ba06c49d4aca326a7abd0774e598cb69

SHA512
36130a2d3de1998da6876040919446f949cbefcc72e3fdfdf9a337d492165a1da1a66ca6ccad7a110b4f91745f0656ac6c0dded4d800cc6fe83152f2e8574c2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3ac129b141f6fa2582cef4dcedda028b

SHA1
208ccb29dd32f253747ef741a9efe613b42b2eaf

SHA256
39f86971dedc8b0a83305a7511070f7e1d7cd6b4633fc37d6c6e5faf2999e9ff

SHA512
5701c7740bf580504e8e9f9124a0ed675e7d9cc0f4ad196869c2a5cc5aaaff22d09014b6365d85f5697c3fece63d817afbd928054940ba5a2794d3434c3bb79d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
360b80f32f5799635a5dd7cd11bf8411

SHA1
0f3a3e3e9d2b58277a3894d8eaeda523cea5cc41

SHA256
ba6ddb519804dd81c9d2625103b362526d53f4d04c78ff56e14de587645371d3

SHA512
8118d3e033f9afa28a446ef03c6911bb9368bf64af9da6d522144bc8fe69071733ead53c25081d36c735d79192b58db26f6df3465b0457d190ae4525eb201c11

Download Submit