4202734fd960c4f8efc5bc38e76981ccb457b3171fa9931505831490fb5f3b1b

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

275de94081babaed410d2be2c1e214a6_JaffaCakes118.html
Size

19KB
MD5

275de94081babaed410d2be2c1e214a6
SHA1

1abcd7a2975b74b07c86bc55e9f361e812b30376
SHA256

4202734fd960c4f8efc5bc38e76981ccb457b3171fa9931505831490fb5f3b1b
SHA512

41bbf1e0eae837de1a7f8ec3aa130366b9c5915bbd2b33def0acf437588d680d3bf9994971e217df5c92168b3d985352204fcc1023aa4cf275d12c48fca338f1
SSDEEP

384:pid3I2FOXL539uLo91ULAQ/mhPu/bOGxF2LUUofvhH3vhHZ:AIQdw4bTxELUUofvhXvh5

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2572	msedge.exe
2572	msedge.exe
944	msedge.exe
944	msedge.exe
4696	identity_helper.exe
4696	identity_helper.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 1428	944	msedge.exe	83
PID 944 wrote to memory of 1428	944	msedge.exe	83
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 372	944	msedge.exe	84
PID 944 wrote to memory of 2572	944	msedge.exe	85
PID 944 wrote to memory of 2572	944	msedge.exe	85
PID 944 wrote to memory of 3700	944	msedge.exe	86
PID 944 wrote to memory of 3700	944	msedge.exe	86
PID 944 wrote to memory of 3700	944	msedge.exe	86
PID 944 wrote to memory of 3700	944	msedge.exe	86
PID 944 wrote to memory of 3700	944	msedge.exe	86
PID 944 wrote to memory of 3700	944	msedge.exe	86
PID 944 wrote to memory of 3700	944	msedge.exe	86
PID 944 wrote to memory of 3700	944	msedge.exe	86
PID 944 wrote to memory of 3700	944	msedge.exe	86
PID 944 wrote to memory of 3700	944	msedge.exe	86
PID 944 wrote to memory of 3700	944	msedge.exe	86
PID 944 wrote to memory of 3700	944	msedge.exe	86
PID 944 wrote to memory of 3700	944	msedge.exe	86
PID 944 wrote to memory of 3700	944	msedge.exe	86
PID 944 wrote to memory of 3700	944	msedge.exe	86
PID 944 wrote to memory of 3700	944	msedge.exe	86
PID 944 wrote to memory of 3700	944	msedge.exe	86
PID 944 wrote to memory of 3700	944	msedge.exe	86
PID 944 wrote to memory of 3700	944	msedge.exe	86
PID 944 wrote to memory of 3700	944	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\275de94081babaed410d2be2c1e214a6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa586746f8,0x7ffa58674708,0x7ffa58674718
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,12588085683644979717,8518910281686841148,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,12588085683644979717,8518910281686841148,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,12588085683644979717,8518910281686841148,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12588085683644979717,8518910281686841148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12588085683644979717,8518910281686841148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12588085683644979717,8518910281686841148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,12588085683644979717,8518910281686841148,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,12588085683644979717,8518910281686841148,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12588085683644979717,8518910281686841148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12588085683644979717,8518910281686841148,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12588085683644979717,8518910281686841148,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,12588085683644979717,8518910281686841148,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,12588085683644979717,8518910281686841148,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6527707eeb32e0659d550d8a7138a2d3

SHA1
d942ca24fd213120a81acb8e11aa1bfb9ca416cb

SHA256
364f9b4f08b0f981c408e7209b0351b4ec559be4621e7a764a56abf0fdc2c442

SHA512
4aa1e8dae397f6fedd413177e414692b72ad9fecbacb6d07c8206f49d10e94efe6e84eae075925739bce32d617162a7987b005674487bdd918825f0c4906e105

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2ddaed19dca3ce864e6296b65d9ef58e

SHA1
d4a1e815fa917477cfc27c78c162aac9199fd7de

SHA256
151037bd3565b98fe404d5ec59310029ef7519f2954cb3c92dfb5eb8f4b128b7

SHA512
bd9bb8f6f47989f099dc3588117e64077aad77a5f86d9f71ee3e50d64b18e36f7b86bcbd2c5e604a56f21b75823b904158d5dec906aecb4c70290a5c3d787470

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cde2c6e87fa7aaae8604a22368250a05

SHA1
a2a691f5cd174cae036907a8e81075d94b96a436

SHA256
2d72699be5fc473049c976f5e11ca649342262747e5e83530fbd4668599100ea

SHA512
9804545269ca8430d1b8155bcd4f1a65aad391eb8af2d805ae5d9ead2aedbdddb43e6832da42a2ca20d1124dabc933532680d0336e59ce132b58e042c73629d5

Download Submit