3581a653efaf245fd7755b73b2f42dad60f2c81352b87c45eb06e033512d9363

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff566c754334c8b0f729ab8716a9c7b5_JaffaCakes118.html
Size

13KB
MD5

ff566c754334c8b0f729ab8716a9c7b5
SHA1

7bdd95a7b562e079d075b61e27073a4f88b6c2af
SHA256

3581a653efaf245fd7755b73b2f42dad60f2c81352b87c45eb06e033512d9363
SHA512

afc7589b058ab630ea5b8ae2712070593afa1acfe676d86b4e857b8aa9e03e7ac0e11b139ddebf44b79968331752b1aeec8647fb49ba339de25b8e143d204813
SSDEEP

192:6smmcnm29aIdepMyMy2O5L9I5VnDuruCXOEYzEJoGESKoyVf9aEKbNkLExb:6smZnd90GfKlYIiGEgyVfXGOEd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2544	msedge.exe
2544	msedge.exe
992	msedge.exe
992	msedge.exe
656	identity_helper.exe
656	identity_helper.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 1148	992	msedge.exe	82
PID 992 wrote to memory of 1148	992	msedge.exe	82
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 760	992	msedge.exe	83
PID 992 wrote to memory of 2544	992	msedge.exe	84
PID 992 wrote to memory of 2544	992	msedge.exe	84
PID 992 wrote to memory of 2976	992	msedge.exe	85
PID 992 wrote to memory of 2976	992	msedge.exe	85
PID 992 wrote to memory of 2976	992	msedge.exe	85
PID 992 wrote to memory of 2976	992	msedge.exe	85
PID 992 wrote to memory of 2976	992	msedge.exe	85
PID 992 wrote to memory of 2976	992	msedge.exe	85
PID 992 wrote to memory of 2976	992	msedge.exe	85
PID 992 wrote to memory of 2976	992	msedge.exe	85
PID 992 wrote to memory of 2976	992	msedge.exe	85
PID 992 wrote to memory of 2976	992	msedge.exe	85
PID 992 wrote to memory of 2976	992	msedge.exe	85
PID 992 wrote to memory of 2976	992	msedge.exe	85
PID 992 wrote to memory of 2976	992	msedge.exe	85
PID 992 wrote to memory of 2976	992	msedge.exe	85
PID 992 wrote to memory of 2976	992	msedge.exe	85
PID 992 wrote to memory of 2976	992	msedge.exe	85
PID 992 wrote to memory of 2976	992	msedge.exe	85
PID 992 wrote to memory of 2976	992	msedge.exe	85
PID 992 wrote to memory of 2976	992	msedge.exe	85
PID 992 wrote to memory of 2976	992	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ff566c754334c8b0f729ab8716a9c7b5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf28c46f8,0x7ffaf28c4708,0x7ffaf28c4718
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,5128746417804129542,4760939104768189665,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,5128746417804129542,4760939104768189665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,5128746417804129542,4760939104768189665,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5128746417804129542,4760939104768189665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5128746417804129542,4760939104768189665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,5128746417804129542,4760939104768189665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,5128746417804129542,4760939104768189665,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5128746417804129542,4760939104768189665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5128746417804129542,4760939104768189665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5128746417804129542,4760939104768189665,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,5128746417804129542,4760939104768189665,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,5128746417804129542,4760939104768189665,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4944 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
663B

MD5
0497428bff3fb4590fed97dc9fcd7ae1

SHA1
7328e9c7dae06ab0599239c379ca2fa0d8f29fd1

SHA256
e2b22fbe7a1df4e8bd7b863221aa4d79aeb213c6d5757c9c408da6bcb1c370b1

SHA512
6fa7d104bea5c2a8531e64d9dcdbdbf774633e7fba491e7c2ca4f54f36a8a524213991ea7b2ada465cbe928ca03fa4293c42bdcdfe184d9e8e4e7e7edf64f583

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b24d52eb14997100112240c104b141a9

SHA1
bdaa0d69d441bb04d2954275a17ecc7c6dff19d5

SHA256
b9f77166d1a1be1b2b4fe55cb26836dc725ce1d722f9feeb4dcaf90d6b7dab7a

SHA512
20df8237d459da365328b829c865095ed51e8d79230ff8c8f01bf52731a658e45d342cda3e7d07a7d18451ba32a187f06592b5301839471426c72ba13d69ea24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
742957533718cb5a782a75e3ec1e0031

SHA1
bad5ade944e1e865fbd352a7746ac2e98ebaa94c

SHA256
89c2e26c2749d2235363198466df19aa39e1cb73aaf40aa0b6d596d8eb958026

SHA512
2f77b2cf605889d9f4fabef975bac30dd03c136386d1f0f1a73af483a32a5a24963da857e2588aa4f6adf40148eb0f0b2b2a02c2007cb1dca9fa2aae9afa43b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
66d0ddb3c2ae6d791d9adb395b214526

SHA1
c7e558f278b7e086d3be6b7608ffdb016655103e

SHA256
346337709fbc3d5981ab3296cbabad609cce3d15f593e9c74a6704d2a72db883

SHA512
65736aeb428676cd5e2e07a723970358d439f4c6bce0f259802f8a83924b8a2eddc61ab3195c5ced56ba5301d2d887df49f6148909b4492d7f8d14230b9f271c

Download Submit