629389363b66672f3fc838b66ddebb906080aa38cf969671d34cdd1310f48914

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 05:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0e2a51a9796f2329cb64c276676bde92_JaffaCakes118.html
Size

19KB
MD5

0e2a51a9796f2329cb64c276676bde92
SHA1

baa335c64f8d1b46a3626623604061cb8b05a9c1
SHA256

629389363b66672f3fc838b66ddebb906080aa38cf969671d34cdd1310f48914
SHA512

39f2a84b4a08ee28f5b67fa2343ae00668b41426e5b9c9aefc4bafa33d774af3689029ff75b0f5ef2a16e5554496a39430ab5d6f4bed8b57273c719d3e9aa820
SSDEEP

384:SISCFxH+gOrR1Vx65sNvEY2JKn92ZXfiJqwMBYfDIqBE:SHMpQ1DlPLHE

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3608	msedge.exe
3608	msedge.exe
3716	msedge.exe
3716	msedge.exe
2420	identity_helper.exe
2420	identity_helper.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 3820	3716	msedge.exe	82
PID 3716 wrote to memory of 3820	3716	msedge.exe	82
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 1040	3716	msedge.exe	83
PID 3716 wrote to memory of 3608	3716	msedge.exe	84
PID 3716 wrote to memory of 3608	3716	msedge.exe	84
PID 3716 wrote to memory of 2188	3716	msedge.exe	85
PID 3716 wrote to memory of 2188	3716	msedge.exe	85
PID 3716 wrote to memory of 2188	3716	msedge.exe	85
PID 3716 wrote to memory of 2188	3716	msedge.exe	85
PID 3716 wrote to memory of 2188	3716	msedge.exe	85
PID 3716 wrote to memory of 2188	3716	msedge.exe	85
PID 3716 wrote to memory of 2188	3716	msedge.exe	85
PID 3716 wrote to memory of 2188	3716	msedge.exe	85
PID 3716 wrote to memory of 2188	3716	msedge.exe	85
PID 3716 wrote to memory of 2188	3716	msedge.exe	85
PID 3716 wrote to memory of 2188	3716	msedge.exe	85
PID 3716 wrote to memory of 2188	3716	msedge.exe	85
PID 3716 wrote to memory of 2188	3716	msedge.exe	85
PID 3716 wrote to memory of 2188	3716	msedge.exe	85
PID 3716 wrote to memory of 2188	3716	msedge.exe	85
PID 3716 wrote to memory of 2188	3716	msedge.exe	85
PID 3716 wrote to memory of 2188	3716	msedge.exe	85
PID 3716 wrote to memory of 2188	3716	msedge.exe	85
PID 3716 wrote to memory of 2188	3716	msedge.exe	85
PID 3716 wrote to memory of 2188	3716	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0e2a51a9796f2329cb64c276676bde92_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce26946f8,0x7ffce2694708,0x7ffce2694718
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11144985573681949293,3785976102718200011,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,11144985573681949293,3785976102718200011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,11144985573681949293,3785976102718200011,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11144985573681949293,3785976102718200011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11144985573681949293,3785976102718200011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11144985573681949293,3785976102718200011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,11144985573681949293,3785976102718200011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,11144985573681949293,3785976102718200011,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11144985573681949293,3785976102718200011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11144985573681949293,3785976102718200011,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11144985573681949293,3785976102718200011,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11144985573681949293,3785976102718200011,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11144985573681949293,3785976102718200011,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
a8a60cfb1d2d5a978b3c5cfd86bc9f64

SHA1
9c6c65815d55f553ce58bf5819282db701e1f00c

SHA256
e6f48424f36188d44fe50aeb3f155f21d300a17b74804ed3ac037e7bfc8446a5

SHA512
43f7ff21ffce9d118164a62a58f26ba20bcbacb994e8c007eb73270e0af0313744eb155450516a057e8a47bd64d09e5344b59cfa52bb4ca3364ab9886ed04f14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
644B

MD5
96b8e97f611dc6a38e14cd48e541f4a5

SHA1
1ed2d1ca848ba3aeb928a45e42b8d20eb76de284

SHA256
6b28f0cfe803496089a13a29dfb3f5ca31495d8009cbaf3a08999a6128691a0f

SHA512
26d6bd949c17266e4ea349197310bd7dab8c38c4930d81039726a583898634d03d45c9aca76adf8755f3aebba115be6e9c195bf5a1ffcb74b6366f7f35765e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
872607d5af1774da2d0a0342bff55818

SHA1
65d91f67d867cd7b60287a119f35499229c5ea72

SHA256
0940b5d6e28578b3d65a6e7cf8678735f951c029ac5fd01b66d058d7d9618a63

SHA512
10377b0fb0ae1d063b9376e2e15ed4793e4a7033ec4c00bb3c66f4e30da606fcbf71c10dcb08fcbdc18ed883fa25b9da69e2310058e6ecb7c45ef97d34a72505

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
585c062db49e1e91fc22ec0deea47691

SHA1
5a008e1c734f4cf6f8a7ee2eaac285df1427e06f

SHA256
000fc1c038a3691b39547f34b5998957259cf33bf92cfcebd404df3340f95818

SHA512
892e224742514413430300312a29cc11a8579173d9a18502bfc053f74d8abe3d53457ac71c6884043f1bc174be8fc398e6e0dfe5f0633d9d91a62d496cc3cc78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
681cd3f50c671cb8b528f5fcbc04baa4

SHA1
742c514ee37025d9501ba0b5f94c37b2a2314fb9

SHA256
47c013a197a37f7c1a01c19dbb0ad0aad1ab899b200d89d69532863891cdc422

SHA512
37c785bda44cc18b81809cbbcb8a501d15cb10cfaa8060633b123f70959e528bfe8e497d3586b117bb6f42b2e8535a3173e5d4fb02c97a45274605e2ed1f4d5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b7beea9cf00b1695c5632e6030f0861e

SHA1
fcd3b1734a37697e5f15b77e1e28ab4ec683a72a

SHA256
e4194751e07965a6d1f148bdc671a645ea7a45633b4384cbabad1cdfb441f5ba

SHA512
c31189cbb66e6e25944d227b1354d115c52c24ee6e3726c6ca55f02d6d15004ab9a55d6c1d247e8c04b05e3c44118177342b84506945ce6317c752200795e655

Download Submit