2a3a03b8066df0510ec766d88ff07a03dbddd9dec988dd94730deecf27edc86d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f98e4d6da6e106dd3a83b3bfcd398221_JaffaCakes118.html
Size

54KB
MD5

f98e4d6da6e106dd3a83b3bfcd398221
SHA1

899a18bc8e568eb63556b44e2f7262bf18c924d1
SHA256

2a3a03b8066df0510ec766d88ff07a03dbddd9dec988dd94730deecf27edc86d
SHA512

307f779ffdd4ea2938682105010affa1569111861df0600ca9be1a1dbcd4dfc3e2b49cd1452b81de8c1ae3f8efe27a48014fff9e8b15b236069d7e4c8997ca94
SSDEEP

1536:RTDJzHGiYgAxZ2IiQ5GmA8zhMJtqCAFnezq2mX:pDJzHleXKQ5zFHnezqvX

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3220	msedge.exe
3220	msedge.exe
4476	msedge.exe
4476	msedge.exe
224	identity_helper.exe
224	identity_helper.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 8	4476	msedge.exe	82
PID 4476 wrote to memory of 8	4476	msedge.exe	82
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 2332	4476	msedge.exe	83
PID 4476 wrote to memory of 3220	4476	msedge.exe	84
PID 4476 wrote to memory of 3220	4476	msedge.exe	84
PID 4476 wrote to memory of 3244	4476	msedge.exe	85
PID 4476 wrote to memory of 3244	4476	msedge.exe	85
PID 4476 wrote to memory of 3244	4476	msedge.exe	85
PID 4476 wrote to memory of 3244	4476	msedge.exe	85
PID 4476 wrote to memory of 3244	4476	msedge.exe	85
PID 4476 wrote to memory of 3244	4476	msedge.exe	85
PID 4476 wrote to memory of 3244	4476	msedge.exe	85
PID 4476 wrote to memory of 3244	4476	msedge.exe	85
PID 4476 wrote to memory of 3244	4476	msedge.exe	85
PID 4476 wrote to memory of 3244	4476	msedge.exe	85
PID 4476 wrote to memory of 3244	4476	msedge.exe	85
PID 4476 wrote to memory of 3244	4476	msedge.exe	85
PID 4476 wrote to memory of 3244	4476	msedge.exe	85
PID 4476 wrote to memory of 3244	4476	msedge.exe	85
PID 4476 wrote to memory of 3244	4476	msedge.exe	85
PID 4476 wrote to memory of 3244	4476	msedge.exe	85
PID 4476 wrote to memory of 3244	4476	msedge.exe	85
PID 4476 wrote to memory of 3244	4476	msedge.exe	85
PID 4476 wrote to memory of 3244	4476	msedge.exe	85
PID 4476 wrote to memory of 3244	4476	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f98e4d6da6e106dd3a83b3bfcd398221_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fc5b46f8,0x7ff8fc5b4708,0x7ff8fc5b4718
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,13717726683791902603,14310686114989789744,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,13717726683791902603,14310686114989789744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,13717726683791902603,14310686114989789744,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13717726683791902603,14310686114989789744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13717726683791902603,14310686114989789744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,13717726683791902603,14310686114989789744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,13717726683791902603,14310686114989789744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13717726683791902603,14310686114989789744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13717726683791902603,14310686114989789744,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13717726683791902603,14310686114989789744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,13717726683791902603,14310686114989789744,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,13717726683791902603,14310686114989789744,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5648 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
446B

MD5
1a1778f9170a1c8f34fbd9f8c22da6a3

SHA1
54bd237139d73ef375249474d74eba404bc0f9b1

SHA256
3a6a8f2e0c789ce2b11d2f6c9eb6b1505948cdd7e85f127484dd0d7613149261

SHA512
4f8b4c5ed723ab6da351f698e692597ab0a836b2575be68f3ff18901854dbf54c72b7dd897cf8b1ddc14a4feeefafe11215b427458fa0e7100b75e7c891354e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
294983972c27091c7720a6e29ccb3b6e

SHA1
1f6cc5a556ba2f86619924954abc459a56238905

SHA256
8ade5377a4248d0b9c28ebd9f38de5db71ef854f9d6c8c7c25531f94150b3a0c

SHA512
7e1f67de8cfc2f86e0f2bba58cf2a6ea9ce99e49cf6186997ff16d0b856e943e2a3d501db058d6ac68c10c1f991f571888e64dd3351eab7b20fb33b40c4f9634

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
16408aa74fc2416f23442e23e7b49fe9

SHA1
ff91395ed6c4822f101aaab792a795f9fb5f111a

SHA256
55cea1ec76f0dfdb886b96fee7bf4e3820c41d5dcc22dcbc2fb2dcdc75624d6d

SHA512
943a6ed8ec6978100dec437780e6da4c58f5b7591e475a127bbe76a66dd02bdb4aa1c5e8cf31802111ba8eb5230db7d7622929733c3f024afa847d8cad6cfa4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
98ea0afde3bf8f1dabaa62a41f8568b7

SHA1
b5c6dff9e1a20bf23ad07462019a63c8ebfed4dd

SHA256
5d75691264b36983bb743c6efc6543dc1baa8aa448de800be083dc0415ab4cc8

SHA512
34babef86c05f34ce0517fdda1b6dde4d85ca59dbf613bdd550f09e8be8e53496c73ca071fbcb1a912cacef8ae204d9f08334a871658d356c231bd551ba084cb

Download Submit