6f583ba60721e1f6b9a3344c3413afb7910245186c0da425e5fbfed1cace78cd

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 09:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5c132ff6b7ff37604827c5f30d23984_JaffaCakes118.html
Size

222KB
MD5

f5c132ff6b7ff37604827c5f30d23984
SHA1

96ffb9a05c76283d1f2ac503c5fb324b778206ad
SHA256

6f583ba60721e1f6b9a3344c3413afb7910245186c0da425e5fbfed1cace78cd
SHA512

6991c4ecb9eca57c6bb3e68fce36a861e3a2ac6790bb60518f6ae24f50a7e0a99910a74534bbea9e9c05b5114d6d3b07546633fd9e79c8d8f01b4fd78cbfa610
SSDEEP

6144:fqvUekZdwe1aAvkqDX3oyq5BrieD0OT6S286Vl1Eb:fqEZdwe1aAvkqDX3oyq5BrieD0OT6S2y

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2092	msedge.exe
2092	msedge.exe
3332	msedge.exe
3332	msedge.exe
316	identity_helper.exe
316	identity_helper.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 5020	3332	msedge.exe	84
PID 3332 wrote to memory of 5020	3332	msedge.exe	84
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 3172	3332	msedge.exe	85
PID 3332 wrote to memory of 2092	3332	msedge.exe	86
PID 3332 wrote to memory of 2092	3332	msedge.exe	86
PID 3332 wrote to memory of 4980	3332	msedge.exe	87
PID 3332 wrote to memory of 4980	3332	msedge.exe	87
PID 3332 wrote to memory of 4980	3332	msedge.exe	87
PID 3332 wrote to memory of 4980	3332	msedge.exe	87
PID 3332 wrote to memory of 4980	3332	msedge.exe	87
PID 3332 wrote to memory of 4980	3332	msedge.exe	87
PID 3332 wrote to memory of 4980	3332	msedge.exe	87
PID 3332 wrote to memory of 4980	3332	msedge.exe	87
PID 3332 wrote to memory of 4980	3332	msedge.exe	87
PID 3332 wrote to memory of 4980	3332	msedge.exe	87
PID 3332 wrote to memory of 4980	3332	msedge.exe	87
PID 3332 wrote to memory of 4980	3332	msedge.exe	87
PID 3332 wrote to memory of 4980	3332	msedge.exe	87
PID 3332 wrote to memory of 4980	3332	msedge.exe	87
PID 3332 wrote to memory of 4980	3332	msedge.exe	87
PID 3332 wrote to memory of 4980	3332	msedge.exe	87
PID 3332 wrote to memory of 4980	3332	msedge.exe	87
PID 3332 wrote to memory of 4980	3332	msedge.exe	87
PID 3332 wrote to memory of 4980	3332	msedge.exe	87
PID 3332 wrote to memory of 4980	3332	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f5c132ff6b7ff37604827c5f30d23984_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd101246f8,0x7ffd10124708,0x7ffd10124718
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13583176025010351369,314105123057186913,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,13583176025010351369,314105123057186913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,13583176025010351369,314105123057186913,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13583176025010351369,314105123057186913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13583176025010351369,314105123057186913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13583176025010351369,314105123057186913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13583176025010351369,314105123057186913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13583176025010351369,314105123057186913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13583176025010351369,314105123057186913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13583176025010351369,314105123057186913,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13583176025010351369,314105123057186913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13583176025010351369,314105123057186913,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13583176025010351369,314105123057186913,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5440 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
993B

MD5
7650e57a63cfad6a53577cfa6e2b9dcc

SHA1
b107b244b6098b61da4a42a3698a74fb55e8d7f6

SHA256
6890c3e57cfa8845eb338f8dbc034601fbeeee74fe88a6187d7eda5ced57fdfb

SHA512
a57adbeac1d4990839eeb7b15e13d56aa4be35533b23c0914e1a1536636a95673e9b1cf726c842c18020ca164755cb3f39c467e3dccc87025cdd7c181d6a3a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9885f4bbafc50bcb028a9cba96aff879

SHA1
eb307331696b399ba3d52531eac4e5f4c7e5acf4

SHA256
b41eb3cd8ef4fce8a6bca9cb84fe4112185e7f53824d5a413e73203ecf6850c7

SHA512
bf681f06b799dcedba410c469d7d1fb580679f58d12495ac013c5a7f532faa71b824ecdfd78d32471c73e5593fb45268625073df05bf91d6d0d7dfe65034e8d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cb1400583115648d661b5d88b06d9c61

SHA1
e943138bacb2d4de7e2264271b0653e3df480a9e

SHA256
88e7d838141a1dc42bba14748085de4803ea7ef01229eae30d6e94acaf81a296

SHA512
9b6253c3464c7bfb181fd62b69e0b0c8197e487bc82534b3da37fac4fef40d3657e8a4a85c73cf689e6497620fb635055e4b825b8bf87130e47dbb6bc742f7a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3019aa1f0602df10b2277ff02eeca66d

SHA1
bfe9a52022b5dee25aa8de12b3cdd443d50ecaca

SHA256
f2513c2d0d8d03bb83493e7969d9caefa1d1f4793108b26003fec06050d8931b

SHA512
3a67315e47bb82e769419133437ccf105543819922876241219d8d46a74294a1596b3c3cdb4e301cc9666e31eec3a1e1344d4bd4bd304d3a1cf3377f5c8b0829

Download Submit