45497ae799336f5f59732a783b5904568417578090ae0d6496afa54ef5402a57

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9aa284e9ac6c76a9967d4f5ce22a207_JaffaCakes118.html
Size

24KB
MD5

f9aa284e9ac6c76a9967d4f5ce22a207
SHA1

19feabad20c920191906253ed7ba4d50adddd4b2
SHA256

45497ae799336f5f59732a783b5904568417578090ae0d6496afa54ef5402a57
SHA512

ccbd044118faa1337dceede8b465aa09feab6ccc6c05d5194f83d6d688d40c6d6d231a7fb03b4d0d3afc50a78e9f04b2eb40327a01da7396c535894c517be49a
SSDEEP

768:GF3Xj5mpCWChChCiCKCqCwCYCmC+CsCdEEYRjsFAuIlKm:GF3z5mpl229hFvN99baY2FAuIlT

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
980	msedge.exe
980	msedge.exe
536	msedge.exe
536	msedge.exe
4520	identity_helper.exe
4520	identity_helper.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 3480	536	msedge.exe	82
PID 536 wrote to memory of 3480	536	msedge.exe	82
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 3280	536	msedge.exe	83
PID 536 wrote to memory of 980	536	msedge.exe	84
PID 536 wrote to memory of 980	536	msedge.exe	84
PID 536 wrote to memory of 2144	536	msedge.exe	85
PID 536 wrote to memory of 2144	536	msedge.exe	85
PID 536 wrote to memory of 2144	536	msedge.exe	85
PID 536 wrote to memory of 2144	536	msedge.exe	85
PID 536 wrote to memory of 2144	536	msedge.exe	85
PID 536 wrote to memory of 2144	536	msedge.exe	85
PID 536 wrote to memory of 2144	536	msedge.exe	85
PID 536 wrote to memory of 2144	536	msedge.exe	85
PID 536 wrote to memory of 2144	536	msedge.exe	85
PID 536 wrote to memory of 2144	536	msedge.exe	85
PID 536 wrote to memory of 2144	536	msedge.exe	85
PID 536 wrote to memory of 2144	536	msedge.exe	85
PID 536 wrote to memory of 2144	536	msedge.exe	85
PID 536 wrote to memory of 2144	536	msedge.exe	85
PID 536 wrote to memory of 2144	536	msedge.exe	85
PID 536 wrote to memory of 2144	536	msedge.exe	85
PID 536 wrote to memory of 2144	536	msedge.exe	85
PID 536 wrote to memory of 2144	536	msedge.exe	85
PID 536 wrote to memory of 2144	536	msedge.exe	85
PID 536 wrote to memory of 2144	536	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f9aa284e9ac6c76a9967d4f5ce22a207_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e8a146f8,0x7ff8e8a14708,0x7ff8e8a14718
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,2113324062329525944,6024419965068667250,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,2113324062329525944,6024419965068667250,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,2113324062329525944,6024419965068667250,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2113324062329525944,6024419965068667250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2113324062329525944,6024419965068667250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,2113324062329525944,6024419965068667250,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,2113324062329525944,6024419965068667250,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2113324062329525944,6024419965068667250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2113324062329525944,6024419965068667250,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2113324062329525944,6024419965068667250,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2113324062329525944,6024419965068667250,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,2113324062329525944,6024419965068667250,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6108 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
48363293459058600940c970319a122b

SHA1
88d9bbdc1477fc05711752e0c493d0c2df568f70

SHA256
41ee459fa56c58fe6628794f930e20e254999bc710e8c3041da097b586790f3d

SHA512
dc81f5d0c4e883789c124299dd4fc5357eb1aaab9f47c2eadc9516e67579e667005cb75490cef4422d35386ee8fd4bede34621de72fe95e64206e5e93dc6ecd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
999b4212f968f9ebd4d37b24feb79281

SHA1
0e6c125c062575fe12b05b520831d40663946350

SHA256
d5030840fcd78abca079006a80ea95105668b3887f8caecb0d57ab7c0e1b484d

SHA512
bb472b5e1037549f8c500e578d49a8e5648d510a0c117ea9364753e0869d04f94398bbccb7c78d2691288bf30a63e891f4dc86fad961f69c5d42c7ba2efd9268

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b97f70b5-b408-4b81-9d52-e5ecb6d4d7bf.tmp

Filesize
6KB

MD5
66d4d336db645c33eceea131191552d0

SHA1
bbd07907bbe1992424586d21b330cfba8baf67a1

SHA256
90b112eb6a63ee42399b0425e0ec781fd19919b126271d157878d085e14b01ab

SHA512
2564d40cac1af6db04fc311864f82af490aee83e07c6dde36691edebae39da2c396280e763d1497599b080b7ba7859be6c63c9d12dad148167bb01120d5b9b0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1189d2e2287113cfe934604b4795a043

SHA1
23df5328591d88249d71ee09a659c75084755089

SHA256
0a11b45df1b6f35702b16a03b9c554662138bc521073a8045f9e60b194b995b6

SHA512
793b4a69329f57b449cf2626505d9fbf36136a7fd7a5bd4fcbed6563a5f55ae05adbdbfba30f13e2ca084dfa1e8f52617838ed0cb98acc6052d1f7b3c5ba6245

Download Submit