c2e74a6366ca4ce13decb05a6dda4851f1b6abf119816c44d8218bb495c15f08

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 02:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0d97df6e8f2e0d22d501a1ebf954ba34_JaffaCakes118.html
Size

57KB
MD5

0d97df6e8f2e0d22d501a1ebf954ba34
SHA1

36f7f305e0f8dbd2d2ddf00993eb7176135a7442
SHA256

c2e74a6366ca4ce13decb05a6dda4851f1b6abf119816c44d8218bb495c15f08
SHA512

a8148871ea3e106066d9e516c61662accd5a3b0745951504f4f44bc5d68602284750bb75f15e1d958cb64f786463f82c21824ad8ffce8e6ff12941290469f103
SSDEEP

1536:tdEQ4o9qPmYa20HHtPx/52lCnTp0q6R8VGuh7:MQEP620HHtPx/52lCnTp0q6R8VGq

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe
4212	msedge.exe
4212	msedge.exe
600	identity_helper.exe
600	identity_helper.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 1844	4212	msedge.exe	82
PID 4212 wrote to memory of 1844	4212	msedge.exe	82
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5096	4212	msedge.exe	83
PID 4212 wrote to memory of 5116	4212	msedge.exe	84
PID 4212 wrote to memory of 5116	4212	msedge.exe	84
PID 4212 wrote to memory of 3368	4212	msedge.exe	85
PID 4212 wrote to memory of 3368	4212	msedge.exe	85
PID 4212 wrote to memory of 3368	4212	msedge.exe	85
PID 4212 wrote to memory of 3368	4212	msedge.exe	85
PID 4212 wrote to memory of 3368	4212	msedge.exe	85
PID 4212 wrote to memory of 3368	4212	msedge.exe	85
PID 4212 wrote to memory of 3368	4212	msedge.exe	85
PID 4212 wrote to memory of 3368	4212	msedge.exe	85
PID 4212 wrote to memory of 3368	4212	msedge.exe	85
PID 4212 wrote to memory of 3368	4212	msedge.exe	85
PID 4212 wrote to memory of 3368	4212	msedge.exe	85
PID 4212 wrote to memory of 3368	4212	msedge.exe	85
PID 4212 wrote to memory of 3368	4212	msedge.exe	85
PID 4212 wrote to memory of 3368	4212	msedge.exe	85
PID 4212 wrote to memory of 3368	4212	msedge.exe	85
PID 4212 wrote to memory of 3368	4212	msedge.exe	85
PID 4212 wrote to memory of 3368	4212	msedge.exe	85
PID 4212 wrote to memory of 3368	4212	msedge.exe	85
PID 4212 wrote to memory of 3368	4212	msedge.exe	85
PID 4212 wrote to memory of 3368	4212	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0d97df6e8f2e0d22d501a1ebf954ba34_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa23db46f8,0x7ffa23db4708,0x7ffa23db4718
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,1179996021951070051,8061828949466349831,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,1179996021951070051,8061828949466349831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,1179996021951070051,8061828949466349831,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1179996021951070051,8061828949466349831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1179996021951070051,8061828949466349831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,1179996021951070051,8061828949466349831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,1179996021951070051,8061828949466349831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1179996021951070051,8061828949466349831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1179996021951070051,8061828949466349831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1179996021951070051,8061828949466349831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1179996021951070051,8061828949466349831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,1179996021951070051,8061828949466349831,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1c7c3ab6-b41b-4e2d-819c-0307b1711d08.tmp

Filesize
6KB

MD5
c4f0009e1e74be2c56dbabdf23b1e1f2

SHA1
520176c79b2386bc7660d996bb483118441850f0

SHA256
080ede79814d6527fa50689deed89b30bbe8d153e0a6018d18f58562b8cc3ecd

SHA512
da2a9ff41b64cd93b7dc494bf29d52d39b500501b6c52fc89a467185f703967f989283227d3094f530267ea106e5273e7f2e78b4340c1f00a801c6b4c7d18c17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
00933a6383ee7bca726cc062cdebf497

SHA1
445850a21949f3e686bd6c839447387d79338238

SHA256
6433740b0ff9dd77ec5d096ea64e01ac42c053802365a6fd3af86834518e2989

SHA512
7879adcaebed02c4349b74b721e057b7f54db0dae92336fbcdb78571b33163ee20609dddc6fa328b9648c88e3650e357dad0b80e81cc893230cc25731479d738

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ac93f0c02cbf8311dfbd8f00f55f97fc

SHA1
eaf7291f94851c231a23e24d9847b7283f9f33e1

SHA256
d79bba247f275da8f236650fcd5484da7dde8c5db3672809c3e07e9e762605d8

SHA512
fc2fdd7a367b5e709bc199dd672010c5dfa0d161d10fc3b75a017868df3733a25d675945ded92467223c68ca90eef0ba60be76b4e2138bffc52f8330ac43754c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3bc0e5626c0029d22d287b47ec87c6cc

SHA1
30c96feec4e10733b560acfdeceaf7068ec4c3a1

SHA256
165b26bcfa220aa483e0c98e44be98c3a4110beea6f75cd7e0cf355571afd6a3

SHA512
ac94e545bad641de03a1a2c9601b4e856f18f6c0da6a45a376d81e9867095d4f0fbe2479b71c808c8727094c1b6cca26e51cbc21378cfe9b70eac1387c61301c

Download Submit