e819a9e9f4e8fd91209ee3f609c4c12a62633be4a586b175b5b013f1a6891e22

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2024 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fede445849770af78ccc641363eb560_JaffaCakes118.html
Size

26KB
MD5

0fede445849770af78ccc641363eb560
SHA1

4d302720737dead46f9d0f8d6774b8693a8e368c
SHA256

e819a9e9f4e8fd91209ee3f609c4c12a62633be4a586b175b5b013f1a6891e22
SHA512

4c599dba7b7a8d7151d10a3502f9e16974db061e909e4b3bdf139653f3375b8f48070a8f11a1f1182aedc03d7040fbe073986dd37371c8aa7aae48fda286cab9
SSDEEP

768:SzFtNyAtSFPkcz+qrDwn5XtDjEq+VhgYD637T2o2:SzFtUAtSFP5z+qrDwn5XtDjEq+VhgYDz

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
4596	msedge.exe
4596	msedge.exe
4228	identity_helper.exe
4228	identity_helper.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe
3232	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 1748	4596	msedge.exe	82
PID 4596 wrote to memory of 1748	4596	msedge.exe	82
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 4868	4596	msedge.exe	83
PID 4596 wrote to memory of 1624	4596	msedge.exe	84
PID 4596 wrote to memory of 1624	4596	msedge.exe	84
PID 4596 wrote to memory of 2724	4596	msedge.exe	85
PID 4596 wrote to memory of 2724	4596	msedge.exe	85
PID 4596 wrote to memory of 2724	4596	msedge.exe	85
PID 4596 wrote to memory of 2724	4596	msedge.exe	85
PID 4596 wrote to memory of 2724	4596	msedge.exe	85
PID 4596 wrote to memory of 2724	4596	msedge.exe	85
PID 4596 wrote to memory of 2724	4596	msedge.exe	85
PID 4596 wrote to memory of 2724	4596	msedge.exe	85
PID 4596 wrote to memory of 2724	4596	msedge.exe	85
PID 4596 wrote to memory of 2724	4596	msedge.exe	85
PID 4596 wrote to memory of 2724	4596	msedge.exe	85
PID 4596 wrote to memory of 2724	4596	msedge.exe	85
PID 4596 wrote to memory of 2724	4596	msedge.exe	85
PID 4596 wrote to memory of 2724	4596	msedge.exe	85
PID 4596 wrote to memory of 2724	4596	msedge.exe	85
PID 4596 wrote to memory of 2724	4596	msedge.exe	85
PID 4596 wrote to memory of 2724	4596	msedge.exe	85
PID 4596 wrote to memory of 2724	4596	msedge.exe	85
PID 4596 wrote to memory of 2724	4596	msedge.exe	85
PID 4596 wrote to memory of 2724	4596	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0fede445849770af78ccc641363eb560_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff87df646f8,0x7ff87df64708,0x7ff87df64718
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,16888087661754440457,7669091246890920878,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,16888087661754440457,7669091246890920878,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,16888087661754440457,7669091246890920878,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16888087661754440457,7669091246890920878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16888087661754440457,7669091246890920878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,16888087661754440457,7669091246890920878,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,16888087661754440457,7669091246890920878,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16888087661754440457,7669091246890920878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16888087661754440457,7669091246890920878,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16888087661754440457,7669091246890920878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16888087661754440457,7669091246890920878,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,16888087661754440457,7669091246890920878,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5240 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dbd671e28d8d5a69232b166e976c8ef5

SHA1
fafe6f851ac16bbed83843f4ce065cd2f7b519c6

SHA256
19d30c692b41ac80c31830e61c45151e00c2f7cd5e8294f6f2c52581608fe19c

SHA512
93dbeae17a3d78d564b93b1d8f8aeaac2ec1f845640f16ed6f5108ff67c3a1e8b8e1c530c27f28fb46a94745beef78d9858a54ec90db9ca7ecff805842763bc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
708b1cdeb294cca54a430296ce5d5c32

SHA1
71d37aadb8d4b7aea6c26918882d9a10e4bda60b

SHA256
0395ae46f9f5cbce280de1086d1ab818cb85af7b25d9b10fafe4f6f552828f53

SHA512
6ff9d885c55390010ed18aac4430b2bba09bb187733e2f0a2192c75e317c8d0eac5d9a0c36dfbec0d9f9fd0a639eaff3cd5fbce6a71ce79995861db4f0db1bea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
41fe954aeced1164f8fbb837e885c45e

SHA1
b287df956cb81195f2f02e171cbaa2d068f58918

SHA256
ce04ee3ee53321232accc175e342be3b10836af8763c7da87b86a002ab0cf83e

SHA512
4e934173a51fed7f31a4b615237fff33262c61af467909b89ba4b31c701b6d7722f8b40d912fef6370a67bcb69e3b9e6e2cca510c940fa00bc676a611ac48328

Download Submit