009165b89cbb79e5aa54b8245c5050b0aef3039a6082ce1533420ba57a57d4e2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 07:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f5881697abea64df7aaa4572ec7b8820_JaffaCakes118.html
Size

35KB
MD5

f5881697abea64df7aaa4572ec7b8820
SHA1

a1f7d4161da293eec7dbf6895919a8a5d5622ea7
SHA256

009165b89cbb79e5aa54b8245c5050b0aef3039a6082ce1533420ba57a57d4e2
SHA512

ea450a82c19bf44068f4cb958be71873066cd77306fb684ad5dc47f5427891a400d607b1ed23161ce40814314f5935e9e59af9985ba682dc4ea9e680845f638f
SSDEEP

768:zwx/MDTHsW88hAR+ZPX1E1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TUZOD6DJtxo6lLS:Q/DbJxNVru0S9/p85K

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
4712	msedge.exe
4712	msedge.exe
3640	identity_helper.exe
3640	identity_helper.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe
244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4032	4712	msedge.exe	82
PID 4712 wrote to memory of 4032	4712	msedge.exe	82
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 368	4712	msedge.exe	83
PID 4712 wrote to memory of 5020	4712	msedge.exe	84
PID 4712 wrote to memory of 5020	4712	msedge.exe	84
PID 4712 wrote to memory of 3460	4712	msedge.exe	85
PID 4712 wrote to memory of 3460	4712	msedge.exe	85
PID 4712 wrote to memory of 3460	4712	msedge.exe	85
PID 4712 wrote to memory of 3460	4712	msedge.exe	85
PID 4712 wrote to memory of 3460	4712	msedge.exe	85
PID 4712 wrote to memory of 3460	4712	msedge.exe	85
PID 4712 wrote to memory of 3460	4712	msedge.exe	85
PID 4712 wrote to memory of 3460	4712	msedge.exe	85
PID 4712 wrote to memory of 3460	4712	msedge.exe	85
PID 4712 wrote to memory of 3460	4712	msedge.exe	85
PID 4712 wrote to memory of 3460	4712	msedge.exe	85
PID 4712 wrote to memory of 3460	4712	msedge.exe	85
PID 4712 wrote to memory of 3460	4712	msedge.exe	85
PID 4712 wrote to memory of 3460	4712	msedge.exe	85
PID 4712 wrote to memory of 3460	4712	msedge.exe	85
PID 4712 wrote to memory of 3460	4712	msedge.exe	85
PID 4712 wrote to memory of 3460	4712	msedge.exe	85
PID 4712 wrote to memory of 3460	4712	msedge.exe	85
PID 4712 wrote to memory of 3460	4712	msedge.exe	85
PID 4712 wrote to memory of 3460	4712	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f5881697abea64df7aaa4572ec7b8820_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc194746f8,0x7ffc19474708,0x7ffc19474718
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4605928223082493252,5452874146884655692,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,4605928223082493252,5452874146884655692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,4605928223082493252,5452874146884655692,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4605928223082493252,5452874146884655692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4605928223082493252,5452874146884655692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4605928223082493252,5452874146884655692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4605928223082493252,5452874146884655692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4605928223082493252,5452874146884655692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4605928223082493252,5452874146884655692,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4605928223082493252,5452874146884655692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4605928223082493252,5452874146884655692,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4605928223082493252,5452874146884655692,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
613B

MD5
4581da6b5fb15335371c62ffb78c6211

SHA1
79ec0fda1c49bed8c1e4e86fefe9d72fa737aeb8

SHA256
611fcfcfd54844da1a2fe5ba177f1ef3c95f5ede0fb0ca7d5e1924e6306c00bc

SHA512
3966f2d21e6feb69111cfb483e486432908bac8f9340472ba2c563e36ac7bad11187e9a460807c9e53ca2dbea06c3ef98b2e9adce0dfd31abc5709385417e108

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0e0b6817754d9b940b15a11e474ac0ee

SHA1
012aef98a6b0943492be2480040dacb4b1a57d95

SHA256
cefc82bb3925e3fe3cb300dd70535779023c41e0785a63f5eb4ed7900cd34cb7

SHA512
251fb4ca9b6c5b58b5677b92c4a65ba833bc3e1097c54216cee02dd719f57046bb86787ba532bb668289cb09effb4b1a749215bc2fc2f9c88f6c4b7674987c2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
89b8ff233541059ed162350158105432

SHA1
887de308fcd9eb52e29b823fcf15e0445866a6ef

SHA256
fed9b63a1638707d09e58b616682d904e01a05cac13359ca73a2095c7981c446

SHA512
b01b36c1b2249da192b90007865c8f89461c27b7bc7f843e19d47cc5580f4ac9a699742bff1548533d2e0077c69bceb713a1c35a7f2c6dd508b0def3d4b1cc0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cca6a1171b70a2e84161351d50c2389e

SHA1
f5efecae423996e8d313e12c90a7968842cb890e

SHA256
a9cdc023e14f467685cb514d28744a466d01972f693f68ce4c2ea7fdb7544985

SHA512
d98d139971d8d57944a3c9e25af60c28b3a097d0c860d38fa3a4979bda85022133e996223872169fef951150f1696eef2a5dca81641995e03de3b3aa128c5192

Download Submit