84c9e394d6239c907e4262b5afe033ae5ddedb91b96a6f04867c8a836c5579e0

Analysis

max time kernel
145s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

27054c1d95bec2b054e3e721f62b843f_JaffaCakes118.html
Size

2KB
MD5

27054c1d95bec2b054e3e721f62b843f
SHA1

9117a9c42c09670c784934620908b5a1d75963bf
SHA256

84c9e394d6239c907e4262b5afe033ae5ddedb91b96a6f04867c8a836c5579e0
SHA512

308d341f3e5cacbaae05d0335fb379bbb8d578ffa60e5ec7230fdc2fe34ee53cab1493ee6821c9caddcb181da90bf3ab88a958d47b8092fcd897ad8df1f9364f

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
1460	msedge.exe
1460	msedge.exe
716	identity_helper.exe
716	identity_helper.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe
3776	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe
1460	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 1544	1460	msedge.exe	83
PID 1460 wrote to memory of 1544	1460	msedge.exe	83
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 2480	1460	msedge.exe	85
PID 1460 wrote to memory of 5064	1460	msedge.exe	86
PID 1460 wrote to memory of 5064	1460	msedge.exe	86
PID 1460 wrote to memory of 3400	1460	msedge.exe	87
PID 1460 wrote to memory of 3400	1460	msedge.exe	87
PID 1460 wrote to memory of 3400	1460	msedge.exe	87
PID 1460 wrote to memory of 3400	1460	msedge.exe	87
PID 1460 wrote to memory of 3400	1460	msedge.exe	87
PID 1460 wrote to memory of 3400	1460	msedge.exe	87
PID 1460 wrote to memory of 3400	1460	msedge.exe	87
PID 1460 wrote to memory of 3400	1460	msedge.exe	87
PID 1460 wrote to memory of 3400	1460	msedge.exe	87
PID 1460 wrote to memory of 3400	1460	msedge.exe	87
PID 1460 wrote to memory of 3400	1460	msedge.exe	87
PID 1460 wrote to memory of 3400	1460	msedge.exe	87
PID 1460 wrote to memory of 3400	1460	msedge.exe	87
PID 1460 wrote to memory of 3400	1460	msedge.exe	87
PID 1460 wrote to memory of 3400	1460	msedge.exe	87
PID 1460 wrote to memory of 3400	1460	msedge.exe	87
PID 1460 wrote to memory of 3400	1460	msedge.exe	87
PID 1460 wrote to memory of 3400	1460	msedge.exe	87
PID 1460 wrote to memory of 3400	1460	msedge.exe	87
PID 1460 wrote to memory of 3400	1460	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\27054c1d95bec2b054e3e721f62b843f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbfdcb46f8,0x7ffbfdcb4708,0x7ffbfdcb4718
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,6049706938505084436,13886811829044223205,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,6049706938505084436,13886811829044223205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,6049706938505084436,13886811829044223205,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6049706938505084436,13886811829044223205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6049706938505084436,13886811829044223205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6049706938505084436,13886811829044223205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,6049706938505084436,13886811829044223205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,6049706938505084436,13886811829044223205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6049706938505084436,13886811829044223205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6049706938505084436,13886811829044223205,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6049706938505084436,13886811829044223205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6049706938505084436,13886811829044223205,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,6049706938505084436,13886811829044223205,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
759126cf473a4d846d6210187148c479

SHA1
8eb5c3fc12ca2432997428a9e2fca7c3244e3f11

SHA256
1c063fce37e5ea4f69d5d285135bc20759312f29f8a75929607eb7c21296823d

SHA512
32b29d1020936721554616376531fc4c0c643491bf7e74627dd013b63d7fe2d65b840639218c766cc534ba61bd1e127666f37619b484599864627b24ff774359

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
11b3397f9b8222cb486fa58a3990d549

SHA1
e2b78a67cf849022f436f9932d8570ac9543d7d4

SHA256
fa29a42d1069da4df0d72bef8919d756c5c32ee1512ce96c3e7677c4d3537519

SHA512
5799f9badfc01503cf76f77d92b7849b45e0e56038b2e8e14f4c0538e82459e2a8b649c03c742a638b4b8eb6fd62f2ce142079c93a551d54a284d450b11bcd80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3a2019c6c4cf31d6e3a97ebf568e2fd8

SHA1
681c96060336d51f82e11fde8395b9f105f4a1e9

SHA256
b2f16c576cc4ce65a5ffa5258624df2018a7f988428e1ab817be4a12d5782bb2

SHA512
0561dd541a0c128126d8b14b0b20b86350f14eb3cc2c324585c8cf094e7ebf47f5351605ad88a366f1285f1fbb612f5592e00fd3c9c1342463c3ba02c96e1d18

Download Submit