7998c1d412702b916e7eacf222f33e9bbf085707f78ab02c039e9e1d610c6a51

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 11:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

39c3857febf70a9a6531536e47d3c5a7_JaffaCakes118.html
Size

15KB
MD5

39c3857febf70a9a6531536e47d3c5a7
SHA1

7366e23a606b083b64668ade3119817ea1c9944f
SHA256

7998c1d412702b916e7eacf222f33e9bbf085707f78ab02c039e9e1d610c6a51
SHA512

f51fb0870eedb6e23fdd78aa6b94a13e02c0da978f134df111b18acdd418a46b3e4bc5e6cecd4b53151f32d5ee5e7a137c6ead172a1842276bdc2e9bac6b82b9
SSDEEP

384:AmRGZO53Fe7ipG3wMzlQMTvdcAj1t98rjL:AkGEve7isAPMT+Aj1t98rjL

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2544	msedge.exe
2544	msedge.exe
2104	msedge.exe
2104	msedge.exe
2248	identity_helper.exe
2248	identity_helper.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe
2104	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 4880	2104	msedge.exe	83
PID 2104 wrote to memory of 4880	2104	msedge.exe	83
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 1208	2104	msedge.exe	84
PID 2104 wrote to memory of 2544	2104	msedge.exe	85
PID 2104 wrote to memory of 2544	2104	msedge.exe	85
PID 2104 wrote to memory of 1968	2104	msedge.exe	86
PID 2104 wrote to memory of 1968	2104	msedge.exe	86
PID 2104 wrote to memory of 1968	2104	msedge.exe	86
PID 2104 wrote to memory of 1968	2104	msedge.exe	86
PID 2104 wrote to memory of 1968	2104	msedge.exe	86
PID 2104 wrote to memory of 1968	2104	msedge.exe	86
PID 2104 wrote to memory of 1968	2104	msedge.exe	86
PID 2104 wrote to memory of 1968	2104	msedge.exe	86
PID 2104 wrote to memory of 1968	2104	msedge.exe	86
PID 2104 wrote to memory of 1968	2104	msedge.exe	86
PID 2104 wrote to memory of 1968	2104	msedge.exe	86
PID 2104 wrote to memory of 1968	2104	msedge.exe	86
PID 2104 wrote to memory of 1968	2104	msedge.exe	86
PID 2104 wrote to memory of 1968	2104	msedge.exe	86
PID 2104 wrote to memory of 1968	2104	msedge.exe	86
PID 2104 wrote to memory of 1968	2104	msedge.exe	86
PID 2104 wrote to memory of 1968	2104	msedge.exe	86
PID 2104 wrote to memory of 1968	2104	msedge.exe	86
PID 2104 wrote to memory of 1968	2104	msedge.exe	86
PID 2104 wrote to memory of 1968	2104	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\39c3857febf70a9a6531536e47d3c5a7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd71646f8,0x7ffcd7164708,0x7ffcd7164718
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,5228601972854736727,7122108300765048941,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,5228601972854736727,7122108300765048941,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,5228601972854736727,7122108300765048941,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5228601972854736727,7122108300765048941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5228601972854736727,7122108300765048941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5228601972854736727,7122108300765048941,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,5228601972854736727,7122108300765048941,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5228601972854736727,7122108300765048941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5228601972854736727,7122108300765048941,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5228601972854736727,7122108300765048941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,5228601972854736727,7122108300765048941,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,5228601972854736727,7122108300765048941,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1260 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
64bfe277314da751357507c6ebba8709

SHA1
61957bbbfa351b6cde9317a2a75045dcc225064a

SHA256
577735f1282ef6715aebff1b0b3a06a2002e6f4b8a988de72ca8a43742658094

SHA512
2181a0ef3e8384b0e64575fb14a31a789834986a95d0e4084ea44b42586c3d65a270493d29d347e2e179d97ae5ba339e98ff8400eaa11769e9b3c435beefb3d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
282fde4b8a8da60d911298a6c137f10e

SHA1
b54954e652b0a87ab9004621fc07209ddf5add8c

SHA256
2c5d1b99f8f559589cf33b0d91b1f0b5c1b85c9a24bc21f48697900da6fa94e3

SHA512
95681df69151ac469385ce034c8661c4d9f73f8b0c8f0ec96c725ee4b2f173c9d172f5a55df11a84a3bf6533af28f23acd3fad8a7d7c9cf6b2cd7a169b3c893f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fb3c4768b58c457d6ef3a04030fe41d7

SHA1
a613ff2667327d8d89c03b69e2da2157460291d6

SHA256
ee5c89f7c9a369e6054f0338cbf70dc5b0c661e19bef03ff203d5d0a7090a70c

SHA512
a693317f63e99daaa9a2644d9629335bcc44faaa76bd066267cdfdf65d6d1bd7c319cc051c9d47e5d0a99f03d414bff695bf3e05caf522417f7c670807717a2c

Download Submit