e0dd7e9fef100e97e1300ee7b54b0673b646c80fb45c029e1cafea328cf96144

Analysis

max time kernel
139s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 10:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12e52cdbe5ac0a8500165610c81f0aa9_JaffaCakes118.html
Size

16KB
MD5

12e52cdbe5ac0a8500165610c81f0aa9
SHA1

d48e087e6cf2d5b7ea09e977cfbd8d6f1fddb6fa
SHA256

e0dd7e9fef100e97e1300ee7b54b0673b646c80fb45c029e1cafea328cf96144
SHA512

ab10c7d068accd223bfd170af8a944dc01bcb05d39cb8cf77f1d99661e0e78f678d36b9953c0fa8de25a68c7004676327f4ab18fe58ee9c1523dbbd1705a10f7
SSDEEP

384:SIIUypLFIpuiti1jFHj7NyaRkfdbV+OjmgTZ8G1RsXCGFo:SpyuitAvNyaRIS8meZHpGm

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
3552	msedge.exe
3552	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
2080	identity_helper.exe
2080	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 3920	3552	msedge.exe	82
PID 3552 wrote to memory of 3920	3552	msedge.exe	82
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 3700	3552	msedge.exe	83
PID 3552 wrote to memory of 2176	3552	msedge.exe	84
PID 3552 wrote to memory of 2176	3552	msedge.exe	84
PID 3552 wrote to memory of 4848	3552	msedge.exe	85
PID 3552 wrote to memory of 4848	3552	msedge.exe	85
PID 3552 wrote to memory of 4848	3552	msedge.exe	85
PID 3552 wrote to memory of 4848	3552	msedge.exe	85
PID 3552 wrote to memory of 4848	3552	msedge.exe	85
PID 3552 wrote to memory of 4848	3552	msedge.exe	85
PID 3552 wrote to memory of 4848	3552	msedge.exe	85
PID 3552 wrote to memory of 4848	3552	msedge.exe	85
PID 3552 wrote to memory of 4848	3552	msedge.exe	85
PID 3552 wrote to memory of 4848	3552	msedge.exe	85
PID 3552 wrote to memory of 4848	3552	msedge.exe	85
PID 3552 wrote to memory of 4848	3552	msedge.exe	85
PID 3552 wrote to memory of 4848	3552	msedge.exe	85
PID 3552 wrote to memory of 4848	3552	msedge.exe	85
PID 3552 wrote to memory of 4848	3552	msedge.exe	85
PID 3552 wrote to memory of 4848	3552	msedge.exe	85
PID 3552 wrote to memory of 4848	3552	msedge.exe	85
PID 3552 wrote to memory of 4848	3552	msedge.exe	85
PID 3552 wrote to memory of 4848	3552	msedge.exe	85
PID 3552 wrote to memory of 4848	3552	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\12e52cdbe5ac0a8500165610c81f0aa9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8fa446f8,0x7ffa8fa44708,0x7ffa8fa44718
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,10508569454179217730,546606654046982104,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,10508569454179217730,546606654046982104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,10508569454179217730,546606654046982104,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10508569454179217730,546606654046982104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10508569454179217730,546606654046982104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10508569454179217730,546606654046982104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3036 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,10508569454179217730,546606654046982104,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5004 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,10508569454179217730,546606654046982104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,10508569454179217730,546606654046982104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10508569454179217730,546606654046982104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10508569454179217730,546606654046982104,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10508569454179217730,546606654046982104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,10508569454179217730,546606654046982104,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:2772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1983dec4-4a39-4a15-bee6-07c1d8399439.tmp

Filesize
10KB

MD5
36cf8835200771f40c04ef9f91f1bdee

SHA1
c31c4a27f58f139fd4b9a5147570dfce26be1fe9

SHA256
2c36cd804fd11e24244b89205a410ea2b434a0f5e6020f086bf0a94bac0a1a3a

SHA512
28cba147aff62a2a47e95fc226e081d2afb43a81cd2e9c66175ee9602c55ab03b47afe80123f18f6fc0bb114b906b47558aef9af0b516720350922acd852657d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6795642639c71e1d85c024f0ebf3075f

SHA1
a99d7ef20cc31ca36f68ca91ca10cacf95bf3fbb

SHA256
7bae42ab3698011c66510ca4a952005b87235b4a2119cc95506306bc5994d3ac

SHA512
160cebceca6b680f03e87b8630d21be11331405a6d0f2b433d2766c78ade57b6b46adda1930f0e17f7d908002b03a94c0c4bf998a42913fcc21eb0965ea98514

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
db386b2466c0744837e7503a6a804449

SHA1
80cb48dc8cf349da38c923268c858a87e31836f9

SHA256
47399468970f1b702b0c295d2f18e1b2b12195f273757bd9dd020218cfca2300

SHA512
80a3d9bee7447e05a6853c58638597178ac96b602ec950fcb027a57d4548dfd99a592a8df5e17fee073edc6dc5f4d950ca4b49fa7df65889b1d544f46e2be10d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a220c915815422329b9faf32623bbfbe

SHA1
827c86a725f0e9a25cd44fae6c5e975f3e147f01

SHA256
8c3cfcb9e77cf982567f55a8a228e4d91e6dae607fe208b176297e0694b10422

SHA512
9e982e5cfa5804cbbfd6728ee90a4808070e99c0abe8e708785cea149f3821c004b5cc996a0a5b85ebd9cac70bd388041bc6ccb873ebb0ae41280f8141b3859f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit