f6f0af29671d842027f4c9c750c913e8b1c5e88e5c07e9b88f2c2232da203e15

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b41ac7cb3fd207666506f4b2c599638_JaffaCakes118.html
Size

32KB
MD5

0b41ac7cb3fd207666506f4b2c599638
SHA1

ed42409678a8afd1262403deb015e7f8c124b627
SHA256

f6f0af29671d842027f4c9c750c913e8b1c5e88e5c07e9b88f2c2232da203e15
SHA512

d45a647bf7184861b0334c69d932eaac96b2547ee72133654a4b4f5e9885de1e0d83c2b03e7de841acc185cf4bcdda948695d61004a4d862898fecebf8d790eb
SSDEEP

768:GlIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZNC:aIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4976	msedge.exe
4976	msedge.exe
1124	msedge.exe
1124	msedge.exe
2740	identity_helper.exe
2740	identity_helper.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 2952	1124	msedge.exe	82
PID 1124 wrote to memory of 2952	1124	msedge.exe	82
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 1616	1124	msedge.exe	83
PID 1124 wrote to memory of 4976	1124	msedge.exe	84
PID 1124 wrote to memory of 4976	1124	msedge.exe	84
PID 1124 wrote to memory of 436	1124	msedge.exe	85
PID 1124 wrote to memory of 436	1124	msedge.exe	85
PID 1124 wrote to memory of 436	1124	msedge.exe	85
PID 1124 wrote to memory of 436	1124	msedge.exe	85
PID 1124 wrote to memory of 436	1124	msedge.exe	85
PID 1124 wrote to memory of 436	1124	msedge.exe	85
PID 1124 wrote to memory of 436	1124	msedge.exe	85
PID 1124 wrote to memory of 436	1124	msedge.exe	85
PID 1124 wrote to memory of 436	1124	msedge.exe	85
PID 1124 wrote to memory of 436	1124	msedge.exe	85
PID 1124 wrote to memory of 436	1124	msedge.exe	85
PID 1124 wrote to memory of 436	1124	msedge.exe	85
PID 1124 wrote to memory of 436	1124	msedge.exe	85
PID 1124 wrote to memory of 436	1124	msedge.exe	85
PID 1124 wrote to memory of 436	1124	msedge.exe	85
PID 1124 wrote to memory of 436	1124	msedge.exe	85
PID 1124 wrote to memory of 436	1124	msedge.exe	85
PID 1124 wrote to memory of 436	1124	msedge.exe	85
PID 1124 wrote to memory of 436	1124	msedge.exe	85
PID 1124 wrote to memory of 436	1124	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0b41ac7cb3fd207666506f4b2c599638_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bcad46f8,0x7ff8bcad4708,0x7ff8bcad4718
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,10377216406756427266,10576915122066385251,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,10377216406756427266,10576915122066385251,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,10377216406756427266,10576915122066385251,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10377216406756427266,10576915122066385251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10377216406756427266,10576915122066385251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,10377216406756427266,10576915122066385251,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,10377216406756427266,10576915122066385251,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10377216406756427266,10576915122066385251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10377216406756427266,10576915122066385251,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10377216406756427266,10576915122066385251,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,10377216406756427266,10576915122066385251,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,10377216406756427266,10576915122066385251,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1360 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
718B

MD5
e235d590ef7cd96a531da69bdfe8187e

SHA1
e03ec93437853ec7236887e2d4a114ade041ee38

SHA256
d96dfdc3e05f0936f5fa5302f8fd92a54974e63285e74cb309a8ecb88f01a832

SHA512
64464f6f868414279d69480bc8e7338022e12fd1b0756674abef08e8e20d361304f74ae5bb820aa668d7bbaae96910571c015c39533ffa134d6ec643382e0f8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c8675187a5adafeb41ebbedddc6a6e24

SHA1
702a7de6d70b587aca0dc76bc438b29597bc7f15

SHA256
ce3a38e08bec24cfc25ae505eb2b15b2645f53adfb995c837ea46ae2a4f93466

SHA512
cf7b150d5d43d52764f2947d6e85956f7282d0b3ff6fd4118650424efe18966df7c3234fe7402e42b81c0b6cb29dbbd77acd147ba41f41034eaf927ca3bcca51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d7336b79fdabbd284a56578ca34d99a8

SHA1
c754055e0441f5b121c2b62c0d0e0f1eed176fae

SHA256
ec14d595a3b4aa24670dd9fbfe7546bc80f915d9b191ab34aed195d9352b3a0b

SHA512
013ddeabf5f7e768f833b06281bb552e9a7951ea716ed5dab3a38dec5761fb1e4d5213458861a10f2d3e361654543e575b4ede6e40366c8f323e483f79cfa219

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e9cc5d2a48aefa3c8792ed8ff95d65a4

SHA1
dd870434c1a0ba2872dc4788892a81ad7a7cb8b1

SHA256
2384628d1652150dccd4dde610c21fc1c5e7e19e92008ee65cdf7d52d760d896

SHA512
484996c760bd45d498ba5e0731fc8ba6e1c56aadfecc53a4b84354a20c34a39b233b651683f03b738bfc39d03c303233bf492efceca122031288e3d84166c747

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
494da42893c380fbd8577043020dadea

SHA1
2841c1c8b154523304636645a207147f3826d5a0

SHA256
efa5cce9829d7b5f118882ff71e10becedee95efcd0f10106ce78bbff7cf8d93

SHA512
8e9a8e37497c03bece186446222aa2bf3138bb9774c4edd588b3fb974e48083cae8d9f6aa25d8e1665e3fd6eb1fcf18bfda6649324e4ff68e68583f7de539eb6

Download Submit