78c456e157dd60c151e3dba4b280c0482edd34c56f7699ea0fb566de8e96d334

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2024 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07097830b51f251ebbbd277fb7dad1b2_JaffaCakes118.html
Size

9KB
MD5

07097830b51f251ebbbd277fb7dad1b2
SHA1

6f4df8acfc11bde7f939e02fb514bed499f34f6e
SHA256

78c456e157dd60c151e3dba4b280c0482edd34c56f7699ea0fb566de8e96d334
SHA512

268f4b75dc3588762d11c0b2c02926c5c35abb70157fe4741456c412c1fb2d0336ac6dd41c928d292dd89380140a1ba232b16726fc337688b07b111beea7cd01
SSDEEP

192:rvUf0uC/QrPF+pcpyVZXzGB2zZTiZYjc1E:IVUQrPF+pc0VtzHNiZY4C

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1544	msedge.exe
1544	msedge.exe
916	msedge.exe
916	msedge.exe
2012	identity_helper.exe
2012	identity_helper.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe
916	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 3512	916	msedge.exe	82
PID 916 wrote to memory of 3512	916	msedge.exe	82
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 3440	916	msedge.exe	83
PID 916 wrote to memory of 1544	916	msedge.exe	84
PID 916 wrote to memory of 1544	916	msedge.exe	84
PID 916 wrote to memory of 2104	916	msedge.exe	85
PID 916 wrote to memory of 2104	916	msedge.exe	85
PID 916 wrote to memory of 2104	916	msedge.exe	85
PID 916 wrote to memory of 2104	916	msedge.exe	85
PID 916 wrote to memory of 2104	916	msedge.exe	85
PID 916 wrote to memory of 2104	916	msedge.exe	85
PID 916 wrote to memory of 2104	916	msedge.exe	85
PID 916 wrote to memory of 2104	916	msedge.exe	85
PID 916 wrote to memory of 2104	916	msedge.exe	85
PID 916 wrote to memory of 2104	916	msedge.exe	85
PID 916 wrote to memory of 2104	916	msedge.exe	85
PID 916 wrote to memory of 2104	916	msedge.exe	85
PID 916 wrote to memory of 2104	916	msedge.exe	85
PID 916 wrote to memory of 2104	916	msedge.exe	85
PID 916 wrote to memory of 2104	916	msedge.exe	85
PID 916 wrote to memory of 2104	916	msedge.exe	85
PID 916 wrote to memory of 2104	916	msedge.exe	85
PID 916 wrote to memory of 2104	916	msedge.exe	85
PID 916 wrote to memory of 2104	916	msedge.exe	85
PID 916 wrote to memory of 2104	916	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\07097830b51f251ebbbd277fb7dad1b2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7d1746f8,0x7fff7d174708,0x7fff7d174718
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,9735588193842484142,14451940824735545514,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,9735588193842484142,14451940824735545514,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,9735588193842484142,14451940824735545514,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9735588193842484142,14451940824735545514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9735588193842484142,14451940824735545514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9735588193842484142,14451940824735545514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9735588193842484142,14451940824735545514,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,9735588193842484142,14451940824735545514,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,9735588193842484142,14451940824735545514,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9735588193842484142,14451940824735545514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9735588193842484142,14451940824735545514,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,9735588193842484142,14451940824735545514,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1344 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e8f3ce459471f3bea53ce51e723bec8e

SHA1
b6aefdaa7972352fe606c3d22e838c665a890989

SHA256
dd113b1fd7139c78d7d8ce4a37fb7e2dcd1aff3d5def34cb027bcb85639d8489

SHA512
b5ed9529340002957de9616d8189d1e52e1f7bee46732da4c7d7a07287daf5ebdb9589699d8beceebaa741eecd4a37c709d628cf2c0ba29b1d4698a436031604

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dadec13c16b900732b00d9d9e5491a84

SHA1
1f0f165bec761c69762f822e066da6d75c4c9c37

SHA256
b78b96f664b3df28f37a054f301fc140c5234fb3f3120705c7beadadffbaac5f

SHA512
01b704d06405e1a385aa88e6e845941d3a8af3461bcfd20cf14c5a4ac62e7ac4ebe7c1ce3c7a823b9c834ed24eb91321c872bfc487b6fdc14caed928ada81c9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3563239dd856838652b0c78f33aba41a

SHA1
1e07ca1948f685d36fe3a0dfd2c0ca7ba6b2b6eb

SHA256
5196dc9ae2f1a39c4235263b07da80e852b89c5b663934a23ae26762b349c52c

SHA512
cc7248a86ca24f77019b983ed1b27f00d946b386d47788b77be507572bd8f3ecf65b5c902d2a978c99ca5a460a036a50a4422545931ee16d100a0c1c996e8dec

Download Submit