14979995aa8a5222d4a460235a9c53c8181af1f4b55e95bdb9eef63eb0afa682

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 23:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ff7a5c8b4d7d02bde144743316c0f044_JaffaCakes118.html
Size

69KB
MD5

ff7a5c8b4d7d02bde144743316c0f044
SHA1

e0cc93ec19c0fde14fc5ac7f597cc397f79925f2
SHA256

14979995aa8a5222d4a460235a9c53c8181af1f4b55e95bdb9eef63eb0afa682
SHA512

6ea3823939f6261b08b7272bda6dd727c03b86f5effa40ae107e92d87a50cebe7bc75e3f9162dc9168153fc31ca405c3e50b74fb3c0af1786495163dc27cbf7a
SSDEEP

768:Ji3gcMWR3sI2PDDnd0g6IdRToTye1wCZkoTyMdtbBnfBgN8/lboiGhcRoQFVG8sB:J/KTvNen0tbrga90hcJNnspv

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe
760	msedge.exe
760	msedge.exe
2524	identity_helper.exe
2524	identity_helper.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe
760	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 2600	760	msedge.exe	82
PID 760 wrote to memory of 2600	760	msedge.exe	82
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 4152	760	msedge.exe	83
PID 760 wrote to memory of 3604	760	msedge.exe	84
PID 760 wrote to memory of 3604	760	msedge.exe	84
PID 760 wrote to memory of 2196	760	msedge.exe	85
PID 760 wrote to memory of 2196	760	msedge.exe	85
PID 760 wrote to memory of 2196	760	msedge.exe	85
PID 760 wrote to memory of 2196	760	msedge.exe	85
PID 760 wrote to memory of 2196	760	msedge.exe	85
PID 760 wrote to memory of 2196	760	msedge.exe	85
PID 760 wrote to memory of 2196	760	msedge.exe	85
PID 760 wrote to memory of 2196	760	msedge.exe	85
PID 760 wrote to memory of 2196	760	msedge.exe	85
PID 760 wrote to memory of 2196	760	msedge.exe	85
PID 760 wrote to memory of 2196	760	msedge.exe	85
PID 760 wrote to memory of 2196	760	msedge.exe	85
PID 760 wrote to memory of 2196	760	msedge.exe	85
PID 760 wrote to memory of 2196	760	msedge.exe	85
PID 760 wrote to memory of 2196	760	msedge.exe	85
PID 760 wrote to memory of 2196	760	msedge.exe	85
PID 760 wrote to memory of 2196	760	msedge.exe	85
PID 760 wrote to memory of 2196	760	msedge.exe	85
PID 760 wrote to memory of 2196	760	msedge.exe	85
PID 760 wrote to memory of 2196	760	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ff7a5c8b4d7d02bde144743316c0f044_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc9c6946f8,0x7ffc9c694708,0x7ffc9c694718
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,2266872681237220340,17788318042735689305,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,2266872681237220340,17788318042735689305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,2266872681237220340,17788318042735689305,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2266872681237220340,17788318042735689305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2266872681237220340,17788318042735689305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,2266872681237220340,17788318042735689305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,2266872681237220340,17788318042735689305,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2266872681237220340,17788318042735689305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2266872681237220340,17788318042735689305,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2266872681237220340,17788318042735689305,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2266872681237220340,17788318042735689305,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,2266872681237220340,17788318042735689305,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
723f518ed6414db1681e00a8f8ae1464

SHA1
66fba25c56217b820356301ab1de2b42e45f9b0a

SHA256
822d2813a182b2ae07ed08e2e6273676d3dd262c913fb08877ad3cdfc29eaeb9

SHA512
42c20f0f720fbd074da3f24ab3aa0b7eb4396d1da6389060305f152e6b441ad0544171e35081ab2db1ef7f5021425a20428ef2b2606aca61e957d14cb1dc0316

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ff1dd8679ec9f30c71cc439724eba2df

SHA1
e94e43bc92f7e06d1db82339b326827cf1216b1f

SHA256
301070cefa1002e50de3606869618f5f7290dbc4d72ebab466c4e6a495579e50

SHA512
905eeecd3e22424cc09d3f87f5f9dac9a354f8d1a49d107ae3f3bca6d8ec3d2451f71005e63502e620ab54954656b5c07351d030bea98961c94ba16df6766f7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
35d2b5af674b4a10bea490cb62be8f4e

SHA1
ca8901e5fede57158420b7893c6b2f880866bbf1

SHA256
dcf9d73075d86e95a91f480827134e79b7f0ced46a84c3cd29c62650eabac6b3

SHA512
2b32e7e11276356897861f8c161961a20636f3c3b7f0aa21a8487f436bc9b9f0632e42854b5e2c713d2ef9c43ebee84210845ff09169fecb569e93e057c80ed4

Download Submit