9ca2f80a02c36148b4fa35eaadd0371e0baf703d39ca14609237d4e1eadb05d3

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0aeb8d65fd50553bc3b10fdedb661d04_JaffaCakes118.html
Size

6KB
MD5

0aeb8d65fd50553bc3b10fdedb661d04
SHA1

8a76111d1da7c34257354e761a9f9cd6ccf33ebb
SHA256

9ca2f80a02c36148b4fa35eaadd0371e0baf703d39ca14609237d4e1eadb05d3
SHA512

994e9f7bac79be596a214057cdc5a1ddd875c40e6373ffefe6fadce9e306379409d64ead693df2cf1de48701242a4b6507a6bd203d371c60a5d0ce1683997bbf
SSDEEP

96:uzVs+ux7QTLLY1k9o84d12ef7CSTUpZcEZ7ru7f:csz7QTAYS/0b76f

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
624	msedge.exe
624	msedge.exe
4992	identity_helper.exe
4992	identity_helper.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe
624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 2748	624	msedge.exe	82
PID 624 wrote to memory of 2748	624	msedge.exe	82
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 3336	624	msedge.exe	83
PID 624 wrote to memory of 5088	624	msedge.exe	84
PID 624 wrote to memory of 5088	624	msedge.exe	84
PID 624 wrote to memory of 896	624	msedge.exe	85
PID 624 wrote to memory of 896	624	msedge.exe	85
PID 624 wrote to memory of 896	624	msedge.exe	85
PID 624 wrote to memory of 896	624	msedge.exe	85
PID 624 wrote to memory of 896	624	msedge.exe	85
PID 624 wrote to memory of 896	624	msedge.exe	85
PID 624 wrote to memory of 896	624	msedge.exe	85
PID 624 wrote to memory of 896	624	msedge.exe	85
PID 624 wrote to memory of 896	624	msedge.exe	85
PID 624 wrote to memory of 896	624	msedge.exe	85
PID 624 wrote to memory of 896	624	msedge.exe	85
PID 624 wrote to memory of 896	624	msedge.exe	85
PID 624 wrote to memory of 896	624	msedge.exe	85
PID 624 wrote to memory of 896	624	msedge.exe	85
PID 624 wrote to memory of 896	624	msedge.exe	85
PID 624 wrote to memory of 896	624	msedge.exe	85
PID 624 wrote to memory of 896	624	msedge.exe	85
PID 624 wrote to memory of 896	624	msedge.exe	85
PID 624 wrote to memory of 896	624	msedge.exe	85
PID 624 wrote to memory of 896	624	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0aeb8d65fd50553bc3b10fdedb661d04_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff877946f8,0x7fff87794708,0x7fff87794718
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,9016441061259305867,15645364285851392123,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,9016441061259305867,15645364285851392123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,9016441061259305867,15645364285851392123,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:8
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9016441061259305867,15645364285851392123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9016441061259305867,15645364285851392123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,9016441061259305867,15645364285851392123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,9016441061259305867,15645364285851392123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9016441061259305867,15645364285851392123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9016441061259305867,15645364285851392123,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9016441061259305867,15645364285851392123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9016441061259305867,15645364285851392123,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,9016441061259305867,15645364285851392123,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eaec91ab6d8777b9795b3c190b69b27a

SHA1
0389f5d2ad4868699ebfe3d035984d4d9d9452ab

SHA256
43475d79e977685d7caeba41d28c35f055dea3331a143a15f039ca7613a84181

SHA512
2cb9bc7ba29bfe8bdd07274cec62cc94ea8f497b93cb95ee3b0b1c7d505b9523655f90b3d78b5091708b5906afd2ee666e112022af3f3b15941770ccf8d47c34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4af32a8e4a79db7f9984c462445c69d7

SHA1
48200d2034cf0ee7f8204a18b8de8c512fc11698

SHA256
23c1debebca399dec3081999d0b00b56f85b3a07fbe0846e911a620b74ae491f

SHA512
44c6d2aeefa8df8f4fd8ae86aff77adb203461cfde0fb43b3f687ef2d0832ea6646071fefab9ac47e4437a1dd3c13a9ef859b68b3b403c157cab11b312e5ab82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c8183b2f618094bd668a580993c6f1b0

SHA1
8c27fc881b036abec0dea2f34ade9298011f85a4

SHA256
1f9d3dd8e1829a3b88f5cd42ff756a0aafb0f03e8362df567b86dc47e915252c

SHA512
6981c9e5eb0aec6827c69792f0251f82c899336e847a9ae331e78e412fc5672f8fce1686a1e18ecd4d976bea6e99c5083b3e368a6747192649eb900445ed613b

Download Submit