2553575de1ab8dee2c1de911a1b68faf5c57ff28b8d4b7f23deacc3421a5678c

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 16:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6702dfb6f24fc00fbf49a0d81921611_JaffaCakes118.html
Size

128KB
MD5

f6702dfb6f24fc00fbf49a0d81921611
SHA1

46061fb10a57df256500e8e0fb7b4aa1d1f31e5b
SHA256

2553575de1ab8dee2c1de911a1b68faf5c57ff28b8d4b7f23deacc3421a5678c
SHA512

924daafb659b2dc8d220528e6c4143967bde26c08a42b31f500c360b4ebe679027fb640bd6cd45d2bce203b16c2b304e7e472ec3206c281c121e4f74a6a641da
SSDEEP

1536:SJbIcMqyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9w:SJbLMqyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4520	msedge.exe
4520	msedge.exe
4772	msedge.exe
4772	msedge.exe
4132	identity_helper.exe
4132	identity_helper.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 2916	4772	msedge.exe	81
PID 4772 wrote to memory of 2916	4772	msedge.exe	81
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 316	4772	msedge.exe	82
PID 4772 wrote to memory of 4520	4772	msedge.exe	83
PID 4772 wrote to memory of 4520	4772	msedge.exe	83
PID 4772 wrote to memory of 4424	4772	msedge.exe	84
PID 4772 wrote to memory of 4424	4772	msedge.exe	84
PID 4772 wrote to memory of 4424	4772	msedge.exe	84
PID 4772 wrote to memory of 4424	4772	msedge.exe	84
PID 4772 wrote to memory of 4424	4772	msedge.exe	84
PID 4772 wrote to memory of 4424	4772	msedge.exe	84
PID 4772 wrote to memory of 4424	4772	msedge.exe	84
PID 4772 wrote to memory of 4424	4772	msedge.exe	84
PID 4772 wrote to memory of 4424	4772	msedge.exe	84
PID 4772 wrote to memory of 4424	4772	msedge.exe	84
PID 4772 wrote to memory of 4424	4772	msedge.exe	84
PID 4772 wrote to memory of 4424	4772	msedge.exe	84
PID 4772 wrote to memory of 4424	4772	msedge.exe	84
PID 4772 wrote to memory of 4424	4772	msedge.exe	84
PID 4772 wrote to memory of 4424	4772	msedge.exe	84
PID 4772 wrote to memory of 4424	4772	msedge.exe	84
PID 4772 wrote to memory of 4424	4772	msedge.exe	84
PID 4772 wrote to memory of 4424	4772	msedge.exe	84
PID 4772 wrote to memory of 4424	4772	msedge.exe	84
PID 4772 wrote to memory of 4424	4772	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f6702dfb6f24fc00fbf49a0d81921611_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe024c46f8,0x7ffe024c4708,0x7ffe024c4718
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,5322207396545485970,9984380819744323738,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,5322207396545485970,9984380819744323738,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,5322207396545485970,9984380819744323738,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5322207396545485970,9984380819744323738,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5322207396545485970,9984380819744323738,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,5322207396545485970,9984380819744323738,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,5322207396545485970,9984380819744323738,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5322207396545485970,9984380819744323738,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5322207396545485970,9984380819744323738,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5322207396545485970,9984380819744323738,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5322207396545485970,9984380819744323738,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,5322207396545485970,9984380819744323738,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2964 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ccb5bc5aa04acaf7a39417cd07fab4aa

SHA1
c6b92b3738afe1ad9f397dedfaea2478813c7ae7

SHA256
1b9f3cf705094328eced466fff26e39441e7fe1d8bfbf5479f0321b142229d71

SHA512
af43df0ea7e0102403062dd30f675a097f00c82993c7c497aca8fcfa4fa12dca00e5642dc2a2322d56b68e9654257319327b138b26dbea71f03b316456fc4968

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fc19d0bdd4c0048ce4a1b14a2ba607b6

SHA1
d16e29684a70d62b7cf2448f811c88011498d87c

SHA256
569b0307738b893bfa13a11efaeee197cf149834b894e808a1135dce6f340bc0

SHA512
6fbe04c53a205e3698c152bd6b9b93c6033d3e2969034837657da8e36000c25b6eeb6a4d1c9f98a9f24ac65d0a4d3102f719224bba05a136082fa3bbdb726382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
68186b147ceef734689454203648588d

SHA1
bf3a85d3cbd7538d900e50f61626cb63159fb5ca

SHA256
312d5ad08e32d397b7b6e2443d248a3025547fbf136a9e307f77bffcc4deb5f0

SHA512
26f8264928135f124b39b94a8717e7e381d3b1ca6d366b1e5a38c82bd25674ece1a01875a3e5b4e175bfdcb783446ab7abd8b19b8358ac5ea80a901ab659afa2

Download Submit