1a3ed29645a127a67c95b9d87b91be79edc1ecdb44c3441001aba875d24da211

Analysis

max time kernel
148s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02fbd8196ac62f30551fc86223a19b86_JaffaCakes118.html
Size

51KB
MD5

02fbd8196ac62f30551fc86223a19b86
SHA1

984064d567a07dae1dd6163b23b2f92bba3ab1ca
SHA256

1a3ed29645a127a67c95b9d87b91be79edc1ecdb44c3441001aba875d24da211
SHA512

8ee582dee3ae8ff394bf87d383b38f95cda5ccb89e92bf3256d2f564e450bc527813e7e51c35d7a1215250eae58e75753337879a39c17116279394cfb02f3e9a
SSDEEP

768:SKCQBX4de/uVBixtqGgeKpclClX2JE+FZHZpbQ90Y4L4c:SCBIde/uVBixtq6lClX2JnXHY4L1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
3432	msedge.exe
3432	msedge.exe
4660	identity_helper.exe
4660	identity_helper.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe
868	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe
3432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 2476	3432	msedge.exe	82
PID 3432 wrote to memory of 2476	3432	msedge.exe	82
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3092	3432	msedge.exe	83
PID 3432 wrote to memory of 3920	3432	msedge.exe	84
PID 3432 wrote to memory of 3920	3432	msedge.exe	84
PID 3432 wrote to memory of 1532	3432	msedge.exe	85
PID 3432 wrote to memory of 1532	3432	msedge.exe	85
PID 3432 wrote to memory of 1532	3432	msedge.exe	85
PID 3432 wrote to memory of 1532	3432	msedge.exe	85
PID 3432 wrote to memory of 1532	3432	msedge.exe	85
PID 3432 wrote to memory of 1532	3432	msedge.exe	85
PID 3432 wrote to memory of 1532	3432	msedge.exe	85
PID 3432 wrote to memory of 1532	3432	msedge.exe	85
PID 3432 wrote to memory of 1532	3432	msedge.exe	85
PID 3432 wrote to memory of 1532	3432	msedge.exe	85
PID 3432 wrote to memory of 1532	3432	msedge.exe	85
PID 3432 wrote to memory of 1532	3432	msedge.exe	85
PID 3432 wrote to memory of 1532	3432	msedge.exe	85
PID 3432 wrote to memory of 1532	3432	msedge.exe	85
PID 3432 wrote to memory of 1532	3432	msedge.exe	85
PID 3432 wrote to memory of 1532	3432	msedge.exe	85
PID 3432 wrote to memory of 1532	3432	msedge.exe	85
PID 3432 wrote to memory of 1532	3432	msedge.exe	85
PID 3432 wrote to memory of 1532	3432	msedge.exe	85
PID 3432 wrote to memory of 1532	3432	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\02fbd8196ac62f30551fc86223a19b86_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93cf746f8,0x7ff93cf74708,0x7ff93cf74718
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,17241605990364828798,14759018507725044954,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,17241605990364828798,14759018507725044954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,17241605990364828798,14759018507725044954,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,17241605990364828798,14759018507725044954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,17241605990364828798,14759018507725044954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,17241605990364828798,14759018507725044954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,17241605990364828798,14759018507725044954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,17241605990364828798,14759018507725044954,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,17241605990364828798,14759018507725044954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,17241605990364828798,14759018507725044954,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,17241605990364828798,14759018507725044954,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,17241605990364828798,14759018507725044954,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,17241605990364828798,14759018507725044954,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6056 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
183B

MD5
a28fc8c7b408c9fec7eb29ba72319a1a

SHA1
2b1815d04fb077e076a7c078db984304b82cf50e

SHA256
1d26a34f3b686ef9b0f4402fd77dbbf4e517c3a60d31f19751f038953abe9e65

SHA512
6a6f10e0011b2e2f335d65b2b5da07e47e06aa5eeb22ac8950f63928c18242952d216526c8a2ba909ad04fdaf073215c4277272c6de2a28c7cb39a211f0a78bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea44aa2cb85ffcb400005a0ff87d7bc7

SHA1
fdbbff8af5a41daec5d8810b635974e7600e3d78

SHA256
fc09b1fc320c001832bbfe78a0e88ee551e97a888a9bc90d89db187ee3900a35

SHA512
48d25d4939b4c608206ff3814d062631fe6f50550ff5c7fc8b2ebf02a0adc23e77109ffc5b90c65aad6d8a0dbb4c6489fea3929808ba19fc328b99631ceba731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5af788617115e22ff9609715539167ad

SHA1
bde648918f20e6040e10272459b64074de961273

SHA256
3d43a24d960d113acb232b48e0b7f0ef5a1886f96491b11177d039bfe666d5d8

SHA512
c35133dadaa93a436ba9b036482e007f2c2a1e98647f5e9ad7a38f77662ae56683e8bd0283c2befb1a06c83284449363509d3ed6a5451c4ded691a211f8ea57f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d7033320236046a51fa6844ef247a1ef

SHA1
ac90523528d18649fbde2975bcdb5246ea6cdca1

SHA256
c47dc6c26356f11dae4585e28b1c694cee714dbb66714426aa427285dc1ebf02

SHA512
484ddc6f0d0725d1851a912668031786be621a388bb7952faa3a83923ca08881ff25b392b8608253d2b62f7f6720d2547cdcf60938e03bbdf9c3e5e4d6005b5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ab5b41bcfadc995519be6eda90b8ab28

SHA1
b05de0908bdf6eecc19fc5d6339dabae44709775

SHA256
54268454d1aa77392804411bc9cc79bf24f1a45cce056f95a6a5ddb51cb18289

SHA512
fd33bcddc7f48362670c17f561ad2250ea465c303ab839b9a8169e717936d972a94685ee1972629dc11a1d54f01d460415116e127ae889a3699cebe5deb20a76

Download Submit