e61f09f812c9f3cb8fc7cc31419ab87eabd10a5244fd0da88373bfa7c188872d

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2024, 15:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

308a293aa6631d18d60e5deaa9d98b93_JaffaCakes118.html
Size

23KB
MD5

308a293aa6631d18d60e5deaa9d98b93
SHA1

dc91e1f2ca8af8b6048ac48622ac34316fa53707
SHA256

e61f09f812c9f3cb8fc7cc31419ab87eabd10a5244fd0da88373bfa7c188872d
SHA512

91c13614ee04e61bc7219b8e0c340538630dc8d8f5c16db6cd59c325ac1d7fb85d5d87c584648007b76b81b4cca6c5f205c2770a7d014419c9c0c1b0758e5eca
SSDEEP

384:i8u0feDrqzybEuqz1HCQc2tSKtTySL9IaA:pNybEB1HC12kn

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3636	msedge.exe
3636	msedge.exe
3060	msedge.exe
3060	msedge.exe
3032	identity_helper.exe
3032	identity_helper.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe
3996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe
3060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 868	3060	msedge.exe	83
PID 3060 wrote to memory of 868	3060	msedge.exe	83
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 1068	3060	msedge.exe	84
PID 3060 wrote to memory of 3636	3060	msedge.exe	85
PID 3060 wrote to memory of 3636	3060	msedge.exe	85
PID 3060 wrote to memory of 2716	3060	msedge.exe	86
PID 3060 wrote to memory of 2716	3060	msedge.exe	86
PID 3060 wrote to memory of 2716	3060	msedge.exe	86
PID 3060 wrote to memory of 2716	3060	msedge.exe	86
PID 3060 wrote to memory of 2716	3060	msedge.exe	86
PID 3060 wrote to memory of 2716	3060	msedge.exe	86
PID 3060 wrote to memory of 2716	3060	msedge.exe	86
PID 3060 wrote to memory of 2716	3060	msedge.exe	86
PID 3060 wrote to memory of 2716	3060	msedge.exe	86
PID 3060 wrote to memory of 2716	3060	msedge.exe	86
PID 3060 wrote to memory of 2716	3060	msedge.exe	86
PID 3060 wrote to memory of 2716	3060	msedge.exe	86
PID 3060 wrote to memory of 2716	3060	msedge.exe	86
PID 3060 wrote to memory of 2716	3060	msedge.exe	86
PID 3060 wrote to memory of 2716	3060	msedge.exe	86
PID 3060 wrote to memory of 2716	3060	msedge.exe	86
PID 3060 wrote to memory of 2716	3060	msedge.exe	86
PID 3060 wrote to memory of 2716	3060	msedge.exe	86
PID 3060 wrote to memory of 2716	3060	msedge.exe	86
PID 3060 wrote to memory of 2716	3060	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\308a293aa6631d18d60e5deaa9d98b93_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe815546f8,0x7ffe81554708,0x7ffe81554718
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,3663920236886892963,15821316622501550884,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,3663920236886892963,15821316622501550884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,3663920236886892963,15821316622501550884,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3663920236886892963,15821316622501550884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3663920236886892963,15821316622501550884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3663920236886892963,15821316622501550884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3663920236886892963,15821316622501550884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,3663920236886892963,15821316622501550884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4100 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,3663920236886892963,15821316622501550884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3663920236886892963,15821316622501550884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3663920236886892963,15821316622501550884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3663920236886892963,15821316622501550884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3663920236886892963,15821316622501550884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,3663920236886892963,15821316622501550884,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1388 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
a66e8ed645d6da0d5672280804d42a2b

SHA1
384403d7c988885102021e492d7d0e5332739db2

SHA256
062d7286889d55d1747682be386e0fba6f9ab3d4230145772c8f0a8b2c859fc2

SHA512
e50b15c063b70426e41c521e60fcc94f7a46ba85b93b2cd217caafd018214ab05e5876ad52129d477cd3926739ff88ea9e37c1058bff11c2408bd965c75ca736

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
724B

MD5
6b1f2dc0ddb3d252d02d4904d3d453fc

SHA1
ff55231b04e190e74eb237ea2625d31a5b9bbcd6

SHA256
af1519b55a1dc124605672273c333cff5927a0d972b99e97f4e19b38e9a22602

SHA512
b3fab2b62531961ec1e4fe278ca4387135eb8338057daa60c88843e94a6d4334ad7858069dfd94dee5b3bd440245b7d3b174fa97ea4bd4c99e1b1e03efd79496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3c97e13953a529de839313b3a327a4ce

SHA1
6e42ad03b92ae20f57cdd404d47e5e061a66c440

SHA256
c76c094d546d0027f597cadea82f8fd6abeb001693db78ba1cb630013e52abbe

SHA512
17418b9e63552c691f8fe972d44aab174a6ad05ce0ad320f571e26aafd65efad3ddd0075073a52249ffaaf2e7f51cae701116e115b6ec63bfb55520448b6b44d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b5f127279fae22afaa5e8f0b14d95a81

SHA1
45d76c16aa9853b111e7117d4c6d2dfe32c5c077

SHA256
d7a95cebb47e4b60745a37e5e87eee7a6697dfa69d59937321ff23b487b23a5d

SHA512
c0b61a097b47f320157c6820b82a369dd795cf8b355397d86b733974e5c5abec8bcac4be101d1a601e80290b6c5774b4bead432bc8690b1f953f1a99e4505c7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4a611af17e5f664661dcb88a064b7055

SHA1
315a8a96d313923626c48d2d90f65e57a4ccd418

SHA256
2696b6d218edf5c644c312f77961dd5742b26bc76e252facf4b8743b26d551c3

SHA512
cd6ddb6b4921dbcf03388df518b1d00309f104c21e4ee2e1c2fbd2bc2065e96b003ea7580ca7c65ea31394e637a8de12cd713984dc80d2bf1947a5f9a3a4cca2

Download Submit