789df43e481526394c318d6a2ca052e4e39f49553650d406273d95eaadab266e

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a19203f69e6799e737683e796fe2d0d_JaffaCakes118.html
Size

59KB
MD5

2a19203f69e6799e737683e796fe2d0d
SHA1

b5b6845f26bcadd893791dd713dbd9aacb911e2a
SHA256

789df43e481526394c318d6a2ca052e4e39f49553650d406273d95eaadab266e
SHA512

b0c6770bd9a99858bd406f57f0ce9d21506d1970febc6890acbd09dda98ca32a727aa395de089c64e51deb81564efac1654e7362e72d6032350be6d9a20bbb79
SSDEEP

1536:oNe7c4pej50wSRtYLxZDwHekYeceeeaeTeleae4eleYeaeZe9LM123fyiub2:oh4pej50wSRtYLxZDwN9LM123fob2

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe
1532	msedge.exe
1532	msedge.exe
4952	identity_helper.exe
4952	identity_helper.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe
1532	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 860	1532	msedge.exe	83
PID 1532 wrote to memory of 860	1532	msedge.exe	83
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 4000	1532	msedge.exe	84
PID 1532 wrote to memory of 1476	1532	msedge.exe	85
PID 1532 wrote to memory of 1476	1532	msedge.exe	85
PID 1532 wrote to memory of 2184	1532	msedge.exe	86
PID 1532 wrote to memory of 2184	1532	msedge.exe	86
PID 1532 wrote to memory of 2184	1532	msedge.exe	86
PID 1532 wrote to memory of 2184	1532	msedge.exe	86
PID 1532 wrote to memory of 2184	1532	msedge.exe	86
PID 1532 wrote to memory of 2184	1532	msedge.exe	86
PID 1532 wrote to memory of 2184	1532	msedge.exe	86
PID 1532 wrote to memory of 2184	1532	msedge.exe	86
PID 1532 wrote to memory of 2184	1532	msedge.exe	86
PID 1532 wrote to memory of 2184	1532	msedge.exe	86
PID 1532 wrote to memory of 2184	1532	msedge.exe	86
PID 1532 wrote to memory of 2184	1532	msedge.exe	86
PID 1532 wrote to memory of 2184	1532	msedge.exe	86
PID 1532 wrote to memory of 2184	1532	msedge.exe	86
PID 1532 wrote to memory of 2184	1532	msedge.exe	86
PID 1532 wrote to memory of 2184	1532	msedge.exe	86
PID 1532 wrote to memory of 2184	1532	msedge.exe	86
PID 1532 wrote to memory of 2184	1532	msedge.exe	86
PID 1532 wrote to memory of 2184	1532	msedge.exe	86
PID 1532 wrote to memory of 2184	1532	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2a19203f69e6799e737683e796fe2d0d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff8b7e846f8,0x7ff8b7e84708,0x7ff8b7e84718
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,14518662479580611531,5169294269060091563,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,14518662479580611531,5169294269060091563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,14518662479580611531,5169294269060091563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14518662479580611531,5169294269060091563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14518662479580611531,5169294269060091563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,14518662479580611531,5169294269060091563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,14518662479580611531,5169294269060091563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14518662479580611531,5169294269060091563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14518662479580611531,5169294269060091563,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14518662479580611531,5169294269060091563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14518662479580611531,5169294269060091563,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,14518662479580611531,5169294269060091563,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5436 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9dd08f93cccfdcbfa19785546eb8a36f

SHA1
93685112c292f347b788f81ddd4376fba8576898

SHA256
5aa6456c581ae4b5abadb36282ac155c99dbc8d39e010c9c770ad70340cacc16

SHA512
3e0603d5e83d3dc12d91b1e83fafef6a865ed21b164602435de93e26fa62a9882283400a2a8243d88b41f39ba5832a14a1d13724ea0d0d2e7b18807436705b30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
401cbb6eafe509e9f03e7742f20a9536

SHA1
5a428560eac97cb8276f883ba93ce9b91881b8e9

SHA256
1dae9b2a3d14b37c542cae287a3d9e5fe96941caa52cf69849a94ec5a4654124

SHA512
9567ceebbf9edaddaad231ed23113fb0f49fcd85e8f22084337d86c8f6145d6e2d967a80d825caa41e1019eb88d055eda384935be5ff134e97b782f5dab51a8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2c062a95e6cadae9c58b7d9a97d089c6

SHA1
84e34517b312b96b0ae82d42537ccad46f79564e

SHA256
b66d1b3bf362dc14f4675197ef27780ae19d6bedcdaa6525e6e040ce21b4f89c

SHA512
80740212d6ea6156316cb8cde768d0f61571115255a429a01172dbbe627462735a7cce084457004f4268e282f21e61363e9775a3f87f616fc56661bec15f86fc

Download Submit