769662e6bd71be174d59668a0a9f088205235d745838067f56fd8b1e24b0398f

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 03:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a36418d88fdcb1b60c87efdbd74a09a_JaffaCakes118.html
Size

21KB
MD5

2a36418d88fdcb1b60c87efdbd74a09a
SHA1

effba1acdc9d65092e4149e5d276b8a307f24cbe
SHA256

769662e6bd71be174d59668a0a9f088205235d745838067f56fd8b1e24b0398f
SHA512

fcec6b4f6ca2f84b8dca78c309c864f5ba77571537142fb22d6af12515b2da435175a83a7447a5d5aa6dfedd8cf70a37d9d795f779224d3a7cf7010904f0dae4
SSDEEP

384:KIxJ52sABXOzMNb3kYEFkOHzM4K7FYWmVs5ny:K8J52sS98kd4KRAL

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
1020	msedge.exe
1020	msedge.exe
408	identity_helper.exe
408	identity_helper.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 2040	1020	msedge.exe	83
PID 1020 wrote to memory of 2040	1020	msedge.exe	83
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 4176	1020	msedge.exe	85
PID 1020 wrote to memory of 1120	1020	msedge.exe	86
PID 1020 wrote to memory of 1120	1020	msedge.exe	86
PID 1020 wrote to memory of 1216	1020	msedge.exe	87
PID 1020 wrote to memory of 1216	1020	msedge.exe	87
PID 1020 wrote to memory of 1216	1020	msedge.exe	87
PID 1020 wrote to memory of 1216	1020	msedge.exe	87
PID 1020 wrote to memory of 1216	1020	msedge.exe	87
PID 1020 wrote to memory of 1216	1020	msedge.exe	87
PID 1020 wrote to memory of 1216	1020	msedge.exe	87
PID 1020 wrote to memory of 1216	1020	msedge.exe	87
PID 1020 wrote to memory of 1216	1020	msedge.exe	87
PID 1020 wrote to memory of 1216	1020	msedge.exe	87
PID 1020 wrote to memory of 1216	1020	msedge.exe	87
PID 1020 wrote to memory of 1216	1020	msedge.exe	87
PID 1020 wrote to memory of 1216	1020	msedge.exe	87
PID 1020 wrote to memory of 1216	1020	msedge.exe	87
PID 1020 wrote to memory of 1216	1020	msedge.exe	87
PID 1020 wrote to memory of 1216	1020	msedge.exe	87
PID 1020 wrote to memory of 1216	1020	msedge.exe	87
PID 1020 wrote to memory of 1216	1020	msedge.exe	87
PID 1020 wrote to memory of 1216	1020	msedge.exe	87
PID 1020 wrote to memory of 1216	1020	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2a36418d88fdcb1b60c87efdbd74a09a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9275446f8,0x7ff927544708,0x7ff927544718
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3510296379010773656,4242766600588592506,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,3510296379010773656,4242766600588592506,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,3510296379010773656,4242766600588592506,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3510296379010773656,4242766600588592506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3510296379010773656,4242766600588592506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3510296379010773656,4242766600588592506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3510296379010773656,4242766600588592506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3510296379010773656,4242766600588592506,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3510296379010773656,4242766600588592506,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3510296379010773656,4242766600588592506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3868 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3510296379010773656,4242766600588592506,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3510296379010773656,4242766600588592506,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3510296379010773656,4242766600588592506,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3510296379010773656,4242766600588592506,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
f5d726500061d0d3a143e626e7900bbb

SHA1
323545024928c2d73ac67be61e374a68c1a394ee

SHA256
d30e982b9ade7eb57f71d3294b34435d93affefbffc5e30336ca445084fa640b

SHA512
c95d0842bd35aa4b056db90828a19ac37935698474e5096564bb294846fffa27ff9b8b606411c1086fad3f42cf6fb2164dded9a2e2a7cd74c6e398e2222fc311

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7fa851ae411937b61299a142db54eded

SHA1
2be647df23243427304627fadf9dd189f74dfb78

SHA256
19510b820b6cfaae98ba7d7a56f957e9d004be580eae92db13a7c35fce14d1df

SHA512
16d51fd4f585dd0b775eda575395c53e37f222ebf3179ffdb7db783a0e8464bfed6126ca68de170dc0b51a58e9b086bb069af4b8e3c73c890b6b12a17776c23d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5226c3aae38c816a70d6dfa4df45dccb

SHA1
83cfef49f407d9b24b07a4688f366172a00df6f2

SHA256
7f1f6c2104993d8a2a315650e87fbbdfafd697685af56c614998d0512f27c431

SHA512
3d6209f878d1e5429239f95e54d5696e9c595411fb307d1732fbe56d8c370fde2d149fc9911e6a56ac3dcd21249691b4aa2f28d9eaa66ddf56c9feff3f8ea8bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
34765912f4bc8aa3626bfd60d159b447

SHA1
37c524ad99ed13945e1f6370eb86c1befef5ca7b

SHA256
3dbf2ca2b4c26cc1bddfcc02ba2b7da85a1f2d96625652709739a80b662d2d9c

SHA512
959bcbad8a3a8d52cd833cfb8bec992fede37a6de2d478edf7dca3b7d27552af377c7eb4f7c662f185cd7aafb4066ac73d1896d76aea2cab10492d83e2b898c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
732884d2fb1b1dd4cb63c0f41d48f49c

SHA1
73b893c7e9d9902c34fe2239a048bb1e51d38a0a

SHA256
83af6b3b632ecfcfb1e8e195459737e10571d7552789319050d7b29b162f84b6

SHA512
466c572c11566c9b41bdd2b5a8b872e8f580148f5ce3279311a7032534c12afe40db768b6a96b7d0b44ed49ce68c485248405ac838b607acdb3f49af884b6d52

Download Submit