0e0dc400a398da814f9fed21ee61498afa0fcc6570d232d225a97dce0b9eec85

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 16:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f032008ecbf5f659c12b46d1c5fbb46f_JaffaCakes118.html
Size

267KB
MD5

f032008ecbf5f659c12b46d1c5fbb46f
SHA1

39dbf57134c43f0ef6ed58f1e67c1d23345f4081
SHA256

0e0dc400a398da814f9fed21ee61498afa0fcc6570d232d225a97dce0b9eec85
SHA512

c7ef674c1ab4301d506569506c07bd45f8bf401e53dd621133d575c7da2831e2d67551f30398b405d845f0918f163ecf59195aa5973be77b38434699539d5814
SSDEEP

3072:c8pMAMdhDfAO/rF1IlspldOg9wKhXoh2j:cXDfTIlspldPhYA

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1668	msedge.exe
1668	msedge.exe
3996	msedge.exe
3996	msedge.exe
1776	identity_helper.exe
1776	identity_helper.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe
1384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 2012	3996	msedge.exe	82
PID 3996 wrote to memory of 2012	3996	msedge.exe	82
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 2432	3996	msedge.exe	83
PID 3996 wrote to memory of 1668	3996	msedge.exe	84
PID 3996 wrote to memory of 1668	3996	msedge.exe	84
PID 3996 wrote to memory of 4204	3996	msedge.exe	85
PID 3996 wrote to memory of 4204	3996	msedge.exe	85
PID 3996 wrote to memory of 4204	3996	msedge.exe	85
PID 3996 wrote to memory of 4204	3996	msedge.exe	85
PID 3996 wrote to memory of 4204	3996	msedge.exe	85
PID 3996 wrote to memory of 4204	3996	msedge.exe	85
PID 3996 wrote to memory of 4204	3996	msedge.exe	85
PID 3996 wrote to memory of 4204	3996	msedge.exe	85
PID 3996 wrote to memory of 4204	3996	msedge.exe	85
PID 3996 wrote to memory of 4204	3996	msedge.exe	85
PID 3996 wrote to memory of 4204	3996	msedge.exe	85
PID 3996 wrote to memory of 4204	3996	msedge.exe	85
PID 3996 wrote to memory of 4204	3996	msedge.exe	85
PID 3996 wrote to memory of 4204	3996	msedge.exe	85
PID 3996 wrote to memory of 4204	3996	msedge.exe	85
PID 3996 wrote to memory of 4204	3996	msedge.exe	85
PID 3996 wrote to memory of 4204	3996	msedge.exe	85
PID 3996 wrote to memory of 4204	3996	msedge.exe	85
PID 3996 wrote to memory of 4204	3996	msedge.exe	85
PID 3996 wrote to memory of 4204	3996	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f032008ecbf5f659c12b46d1c5fbb46f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8cd7946f8,0x7ff8cd794708,0x7ff8cd794718
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,16019757544005628930,9299989470160289505,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,16019757544005628930,9299989470160289505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,16019757544005628930,9299989470160289505,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,16019757544005628930,9299989470160289505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,16019757544005628930,9299989470160289505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,16019757544005628930,9299989470160289505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,16019757544005628930,9299989470160289505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,16019757544005628930,9299989470160289505,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,16019757544005628930,9299989470160289505,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,16019757544005628930,9299989470160289505,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,16019757544005628930,9299989470160289505,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,16019757544005628930,9299989470160289505,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
498B

MD5
735ab15a1c95145ae80736eb9f539288

SHA1
1e522a0222b0235e7d9f6a67e50cfaf7979e3fa0

SHA256
0d12db3a422241a9657e24711eae6d740da4721d2628ab94835244942b924eed

SHA512
25842cd046c9c1f51b9061ebb845a6526f7e26384383b201e0c0d385ce438fbc5a3cb019767e3dd95b83c0cd43da757f79315de7e690518f252fc82e65b15d7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c6e4bec25f5b7a3373f8b3e10afd5357

SHA1
60405fba9990bc27d57d8d3b414113ddfa3576f4

SHA256
728aa0058d8c78d5f64a2fe72862cef4e04b7ca16e860a5da516f34734fb4c87

SHA512
ff54d43b63ce91820c2dc354c50c0ea8d82238a8c79a2b0ec24e44faa386d0410590b1825cdd57844fda3f6c8c3db222bcac79082a287afecc81144e83e31c23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8ba52c23b4ec66106042a6d0d5d126ef

SHA1
38670de0a681161a6df773335b64cce46adf30e4

SHA256
04e643ec603d6fe4c0a199de61f4eea691e521cc8eefaba48ac607ec6b4d3145

SHA512
2b2c4c3845fd7b4cd65ce40c7effb7f908288faf0a11837ecb0c718a66882e1f6499deb764356075fd952413c46e0200789b117f7379416e52aeae3ed6c5d862

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4ecbea4f564860f340bd6e018bd65e1a

SHA1
9cf96e129eb60d793868c5902a81b528f2d6798e

SHA256
a90d73251cb9331cad6fa88891a98f89e767b91724a0b8ab27ab468247f57180

SHA512
cd088dc9407693934eb7073eb057927412addcf9d2c62885e52c976c447fa3e5c5e781003ec837a37796acf9b8a14424e6db06c64626fafc78db2a38982e1118

Download Submit