5b4d89383bd59662643bf4e0711745336a963e3c369f5f66faa5948b15bc02dd

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 02:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f4f88d72844bf6556999ec86867da3c5_JaffaCakes118.html
Size

1.8MB
MD5

f4f88d72844bf6556999ec86867da3c5
SHA1

7c870a3cbd520158f94ef8475c1c1b6d4b4ef1ca
SHA256

5b4d89383bd59662643bf4e0711745336a963e3c369f5f66faa5948b15bc02dd
SHA512

5c82e596fa484d53fba26f36aa023c395274b2df7372823c404d7ba01317430859ecb8b8972e857adf06397d40834ef6e3755943e2312228e95330a7c842cad6
SSDEEP

12288:zJ5X1TBma+QnIEU27KB4ijJQfm0eSvqrGuI1E0CDRRl8:zPmoU2WB4ijJPSiIG0

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
676	msedge.exe
676	msedge.exe
1088	msedge.exe
1088	msedge.exe
2968	identity_helper.exe
2968	identity_helper.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 4432	1088	msedge.exe	82
PID 1088 wrote to memory of 4432	1088	msedge.exe	82
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 2928	1088	msedge.exe	83
PID 1088 wrote to memory of 676	1088	msedge.exe	84
PID 1088 wrote to memory of 676	1088	msedge.exe	84
PID 1088 wrote to memory of 4088	1088	msedge.exe	85
PID 1088 wrote to memory of 4088	1088	msedge.exe	85
PID 1088 wrote to memory of 4088	1088	msedge.exe	85
PID 1088 wrote to memory of 4088	1088	msedge.exe	85
PID 1088 wrote to memory of 4088	1088	msedge.exe	85
PID 1088 wrote to memory of 4088	1088	msedge.exe	85
PID 1088 wrote to memory of 4088	1088	msedge.exe	85
PID 1088 wrote to memory of 4088	1088	msedge.exe	85
PID 1088 wrote to memory of 4088	1088	msedge.exe	85
PID 1088 wrote to memory of 4088	1088	msedge.exe	85
PID 1088 wrote to memory of 4088	1088	msedge.exe	85
PID 1088 wrote to memory of 4088	1088	msedge.exe	85
PID 1088 wrote to memory of 4088	1088	msedge.exe	85
PID 1088 wrote to memory of 4088	1088	msedge.exe	85
PID 1088 wrote to memory of 4088	1088	msedge.exe	85
PID 1088 wrote to memory of 4088	1088	msedge.exe	85
PID 1088 wrote to memory of 4088	1088	msedge.exe	85
PID 1088 wrote to memory of 4088	1088	msedge.exe	85
PID 1088 wrote to memory of 4088	1088	msedge.exe	85
PID 1088 wrote to memory of 4088	1088	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f4f88d72844bf6556999ec86867da3c5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa08db46f8,0x7ffa08db4708,0x7ffa08db4718
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,8040175545494171386,16088521517416347365,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,8040175545494171386,16088521517416347365,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,8040175545494171386,16088521517416347365,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8040175545494171386,16088521517416347365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8040175545494171386,16088521517416347365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,8040175545494171386,16088521517416347365,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,8040175545494171386,16088521517416347365,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8040175545494171386,16088521517416347365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8040175545494171386,16088521517416347365,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8040175545494171386,16088521517416347365,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,8040175545494171386,16088521517416347365,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,8040175545494171386,16088521517416347365,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3168 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
410B

MD5
46cf334b40cc42d01af5c70d9a584a80

SHA1
b3fb0f8a3e6903cf2f6628222fa90a104734760e

SHA256
adce0576d974518ce811ae688f70cf06923eaee4c3638f6745e413247b9233bd

SHA512
af43ed0747b9a3ff3c00914ebc412a8c13048112d3689083716b339c1a4166734e0cf2e052657d22da0880efb984396e07f7cdedee8dbd93d4f7ef2291d31f0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d00cc014af3680bf97ba541cecf1189a

SHA1
ed42c2226ad3dd8dfbe95ce1095028ecfc019558

SHA256
06f96334df2d50771930319bb2506d71c5b646c8a89de92f2472b46d9329bedc

SHA512
17064e83a98392d0b8fe904da29cab98228c8a00283189a7ba53086588322d41c2e3713d694c6f3bccc38cb8d7aeaa97f8b53dbd12d0a82e6be9fb4c68ff7b13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
404b153ae3f19695291e77c2aa0dd855

SHA1
430154649aeb0827d5f157127a4880baf5e192f7

SHA256
659a84550cb29f568621ad0dba4f139bfc46f95727336a64d4dc8bf580c546b0

SHA512
e0c86f8d22843c832fa1d9fe8cd7632084922b40ed33f28af8a12477c586fe2ae70d4dbf1ac00c5f2f22e9a5c1fa18a57346a857d8941d52d7fa5072dcbcb386

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
be98b5945b6137195007f49c6b1c06b9

SHA1
fb8582411bcb2b5894cb4c7d07fba7ed328aab97

SHA256
947a6587cba6c4a525b29ffaba826beb3b8c24881320f484f8d90482e5c8ac8b

SHA512
278b1db03d4cf483aa75800e26990f194e874716f3ea1d19025b50efb1b0ee36165aeebe3f13aeb24cd422461907e405d9c7d77d48b07587694f06ff3cf34b0f

Download Submit