64be2c58f542e31a5b277b02ed9f851be76c002580883140adeb2530fc217bf0

Analysis

max time kernel
145s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 19:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ff324b1e2db8557a13ca221fd6aae277_JaffaCakes118.html
Size

1KB
MD5

ff324b1e2db8557a13ca221fd6aae277
SHA1

72694587c9fb121fd5394b9c407fa87e482f9c53
SHA256

64be2c58f542e31a5b277b02ed9f851be76c002580883140adeb2530fc217bf0
SHA512

5b8393d4eb67c4088392a981a706c3fffe0b697da44758f515f45be8cc2f65ef0122de5918098b1b562aab99a6dab58aae42732968795c8c33e7beb17b965b71

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
2632	msedge.exe
2632	msedge.exe
4968	identity_helper.exe
4968	identity_helper.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe
380	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe
2632	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 4928	2632	msedge.exe	83
PID 2632 wrote to memory of 4928	2632	msedge.exe	83
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 1388	2632	msedge.exe	84
PID 2632 wrote to memory of 4848	2632	msedge.exe	85
PID 2632 wrote to memory of 4848	2632	msedge.exe	85
PID 2632 wrote to memory of 876	2632	msedge.exe	86
PID 2632 wrote to memory of 876	2632	msedge.exe	86
PID 2632 wrote to memory of 876	2632	msedge.exe	86
PID 2632 wrote to memory of 876	2632	msedge.exe	86
PID 2632 wrote to memory of 876	2632	msedge.exe	86
PID 2632 wrote to memory of 876	2632	msedge.exe	86
PID 2632 wrote to memory of 876	2632	msedge.exe	86
PID 2632 wrote to memory of 876	2632	msedge.exe	86
PID 2632 wrote to memory of 876	2632	msedge.exe	86
PID 2632 wrote to memory of 876	2632	msedge.exe	86
PID 2632 wrote to memory of 876	2632	msedge.exe	86
PID 2632 wrote to memory of 876	2632	msedge.exe	86
PID 2632 wrote to memory of 876	2632	msedge.exe	86
PID 2632 wrote to memory of 876	2632	msedge.exe	86
PID 2632 wrote to memory of 876	2632	msedge.exe	86
PID 2632 wrote to memory of 876	2632	msedge.exe	86
PID 2632 wrote to memory of 876	2632	msedge.exe	86
PID 2632 wrote to memory of 876	2632	msedge.exe	86
PID 2632 wrote to memory of 876	2632	msedge.exe	86
PID 2632 wrote to memory of 876	2632	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ff324b1e2db8557a13ca221fd6aae277_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae52946f8,0x7ffae5294708,0x7ffae5294718
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,9943573896596798425,11462809019863800960,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,9943573896596798425,11462809019863800960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,9943573896596798425,11462809019863800960,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9943573896596798425,11462809019863800960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9943573896596798425,11462809019863800960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9943573896596798425,11462809019863800960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,9943573896596798425,11462809019863800960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,9943573896596798425,11462809019863800960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9943573896596798425,11462809019863800960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9943573896596798425,11462809019863800960,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9943573896596798425,11462809019863800960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9943573896596798425,11462809019863800960,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,9943573896596798425,11462809019863800960,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
d97369b652e0c80ee35757694bb62b44

SHA1
f78f36fc4945701eb1e6fdcd2336ff1547e332d9

SHA256
b376c6901b6c39d2d47d6534ec03ee7dfd51d3a30a269e3fdc3f6b500c0a3826

SHA512
b89906daae74342bdf98d080f86b35b48f161305a7e84b11da5655057a3d7596cc5e2dad592e45377ccebee7407e3095162e476d111ee48d9412c1fc632698fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
334B

MD5
25b581ccec9fbe2691de09fbadaca746

SHA1
5a008473e27df7cc17f64328a2adf82c0ab62749

SHA256
b1d11028048f716f3d793c97351abc39eadd9c01766392e0ddde907d51e91403

SHA512
b5a6bc0f64e62afc5eebfbf47022f829e01a3082ee2757fb62a1c00116c3e6ce2c226e22ec989513425f46364609b071db2d59e793051a340cceb7ef8975ebd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8a8ae9746c251c6ce205369e110b7d07

SHA1
daf3d76de237f20efe9a4a4f2ce3b4f6cb2ed1ab

SHA256
6975e5baff523e4fb4e25628f869ab42db0288be0e6879e0a218f1c3db479895

SHA512
ae3313271f717eec070745ff8cd005ab56df62b50082164d2bd4a1be18e2d74d45ad73eea696d4eff5a4aeb80a19dfabf2a659b25f3da5ae909e92b12e2da2f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6ba6be3a17b024e7d6080070e84575a3

SHA1
efe2d7aeb0d21cacf58dd3437ea00c613ee80327

SHA256
b43a21529935e4b943ebd3b67c03bb190fa0deb5553dfb4ac1719596566df871

SHA512
d527fc732eaaacbd819d08f953c7eef5632eae5bc195dd981476028daba43dea88ab8fc767c693ae36599567cb2ee1c93447bb342f50dd8bcc8c5d718877af7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
298d80b99352293c57503cda6699a9f0

SHA1
24201a3b7d237014b1f011f3565a9d88b6cd0adf

SHA256
9b5abfdf0772d2fc6712fb9041683cc911bef1a595b3e1c897a1db2e92f52fba

SHA512
f3b508cf8174eb16c2ae587180d4c57051d1f792c9db5337df2528503cc9cc36e06323dd6ed982d9dc582a6251f3efc7136066e77b55c35d78902820f52587b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ff7079a4f5b03fe1a4ed37476b49f746

SHA1
4175225acf692b558a3b6ec5f39aae542e1599c3

SHA256
4117d7c0614130cd9c27c43b4cfbaf0d9432c0530645016172d3452c6038a912

SHA512
35ec0e52cc81453426b22597c562dfe3f98575b24aa18342d7228cd4980f81a27c948765f6ae9bbc5d4b804f8139ebe0d7c64a3de1f173bb65a858405802108b

Download Submit