6283679c727cb193b66b739a04b27d0038c5a9ba1c90eda185253067b607d7b4

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

264a7724da0be2ffe3f9e104e43eba30_JaffaCakes118.html
Size

43KB
MD5

264a7724da0be2ffe3f9e104e43eba30
SHA1

911b2fd6ca0beeb34edcb5d08e55da454d15e337
SHA256

6283679c727cb193b66b739a04b27d0038c5a9ba1c90eda185253067b607d7b4
SHA512

353e373a6042154f04b9641c94198006d5f4be0480c06a757cef695415af2641a125ce0920d55f1d50d48017717a83ecf4e4fd8afefe50a8f402ada374efcd1f
SSDEEP

768:JPxTdcqpX/pJdghncAJfGiy2jy879k9k9k9P+YoyWUiaNtH:JPxTdcqpvNgZcAJfGiy2jy8hEke+YhFt

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2936	msedge.exe
2936	msedge.exe
4800	msedge.exe
4800	msedge.exe
528	identity_helper.exe
528	identity_helper.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 5040	4800	msedge.exe	85
PID 4800 wrote to memory of 5040	4800	msedge.exe	85
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 116	4800	msedge.exe	86
PID 4800 wrote to memory of 2936	4800	msedge.exe	87
PID 4800 wrote to memory of 2936	4800	msedge.exe	87
PID 4800 wrote to memory of 3372	4800	msedge.exe	88
PID 4800 wrote to memory of 3372	4800	msedge.exe	88
PID 4800 wrote to memory of 3372	4800	msedge.exe	88
PID 4800 wrote to memory of 3372	4800	msedge.exe	88
PID 4800 wrote to memory of 3372	4800	msedge.exe	88
PID 4800 wrote to memory of 3372	4800	msedge.exe	88
PID 4800 wrote to memory of 3372	4800	msedge.exe	88
PID 4800 wrote to memory of 3372	4800	msedge.exe	88
PID 4800 wrote to memory of 3372	4800	msedge.exe	88
PID 4800 wrote to memory of 3372	4800	msedge.exe	88
PID 4800 wrote to memory of 3372	4800	msedge.exe	88
PID 4800 wrote to memory of 3372	4800	msedge.exe	88
PID 4800 wrote to memory of 3372	4800	msedge.exe	88
PID 4800 wrote to memory of 3372	4800	msedge.exe	88
PID 4800 wrote to memory of 3372	4800	msedge.exe	88
PID 4800 wrote to memory of 3372	4800	msedge.exe	88
PID 4800 wrote to memory of 3372	4800	msedge.exe	88
PID 4800 wrote to memory of 3372	4800	msedge.exe	88
PID 4800 wrote to memory of 3372	4800	msedge.exe	88
PID 4800 wrote to memory of 3372	4800	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\264a7724da0be2ffe3f9e104e43eba30_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd4b146f8,0x7ffbd4b14708,0x7ffbd4b14718
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,4488083717704585775,10029384494018347407,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,4488083717704585775,10029384494018347407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,4488083717704585775,10029384494018347407,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4488083717704585775,10029384494018347407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4488083717704585775,10029384494018347407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,4488083717704585775,10029384494018347407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,4488083717704585775,10029384494018347407,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4488083717704585775,10029384494018347407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4488083717704585775,10029384494018347407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4488083717704585775,10029384494018347407,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4488083717704585775,10029384494018347407,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,4488083717704585775,10029384494018347407,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4928 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
181B

MD5
57038b08df22f2c42536035231093386

SHA1
43a2fbeb0fe009bd82d42355436599a3b5d3a212

SHA256
e288f13264e78b55850890ba700d2a4226ebd377b5082e939ee9abfc288252dd

SHA512
0115947f8289408b25d68ee754784d5e723dd6b55267fc1ec1afda2c75139f34bfba7bfaefe3763befea8cd82468f2a4099b32553aba53dc1447cbb3c2582fe0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
92b79d9aacb9f9295fc6507a5bfd8fbc

SHA1
c7f1957efd05921c33bdf03e3b6b841bbe61a22b

SHA256
ad7f10143cfbf8dc84bf77dfdb705ce662291fa6a24f588e854d41ab335e31a0

SHA512
95873ad6d20cf4845684b5e53f3f8a6ab5b8e843775f7e6e78ee9d12aea6f368255c4f6751f959e33bffb2e25ce19f8f388874a60f4173c1ff08d930180203d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f659f32380e6416aa5493acc6c0716b8

SHA1
77a8d1ae3d59e2effbfd71de0e8513aeaf65a360

SHA256
f7fda5014c728ce9c9f6db787bfd1832dcad1e106093d4afac73061c0bf6a171

SHA512
6a7a4b0baa113ba6a48a2ed09b95eadfcdc0414380c7fe792628089ecfcde163997fce2af87ef9d01570a3daaeb23ed4e9e8cf8e22f737f4357be793906f1826

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
67b3239f1b0a4f419beba232804bd454

SHA1
9beb66e951c296fac449fbfde85c3515cfdc8f68

SHA256
452c002528ce8b278f37ded0ef980f85bc83431ac8db2e1c46c4e03d493640e8

SHA512
dd7629f7d9b11748bbd97fda2f565afb689c8054b2b518c281ebbd16b4cff405df791e7f4a974142ab028e7bb05f36a5f0e99754fdc173a2bcfe8fdf7f19043e

Download Submit