7d341d9e43994c15e8b60c96da89390bea190d3748ac1e082793b8b0d6d8bc1b

Analysis

max time kernel
145s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40cc3ca2fef82a8a66bf8cd390e317a5_JaffaCakes118.html
Size

5KB
MD5

40cc3ca2fef82a8a66bf8cd390e317a5
SHA1

1b3071704f0cf46aa78fd6acf242cc9eb9a195c0
SHA256

7d341d9e43994c15e8b60c96da89390bea190d3748ac1e082793b8b0d6d8bc1b
SHA512

3b3838fbf56b1d462569370d08f52eb0ce8583f9486f82748df30c49dd6a5a7aff488b204d9ba916377c5d52bd680ae90dfc580fdc5e084f0dc09f920ff5e147
SSDEEP

96:8y+cAl5azln+DtZogzD5hBniKFe8LDmQIjK:8OAl0z8DjDtqKYQDme

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2016	msedge.exe
2016	msedge.exe
3184	msedge.exe
3184	msedge.exe
1564	identity_helper.exe
1564	identity_helper.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe
3184	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 1184	3184	msedge.exe	83
PID 3184 wrote to memory of 1184	3184	msedge.exe	83
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 4808	3184	msedge.exe	84
PID 3184 wrote to memory of 2016	3184	msedge.exe	85
PID 3184 wrote to memory of 2016	3184	msedge.exe	85
PID 3184 wrote to memory of 2808	3184	msedge.exe	86
PID 3184 wrote to memory of 2808	3184	msedge.exe	86
PID 3184 wrote to memory of 2808	3184	msedge.exe	86
PID 3184 wrote to memory of 2808	3184	msedge.exe	86
PID 3184 wrote to memory of 2808	3184	msedge.exe	86
PID 3184 wrote to memory of 2808	3184	msedge.exe	86
PID 3184 wrote to memory of 2808	3184	msedge.exe	86
PID 3184 wrote to memory of 2808	3184	msedge.exe	86
PID 3184 wrote to memory of 2808	3184	msedge.exe	86
PID 3184 wrote to memory of 2808	3184	msedge.exe	86
PID 3184 wrote to memory of 2808	3184	msedge.exe	86
PID 3184 wrote to memory of 2808	3184	msedge.exe	86
PID 3184 wrote to memory of 2808	3184	msedge.exe	86
PID 3184 wrote to memory of 2808	3184	msedge.exe	86
PID 3184 wrote to memory of 2808	3184	msedge.exe	86
PID 3184 wrote to memory of 2808	3184	msedge.exe	86
PID 3184 wrote to memory of 2808	3184	msedge.exe	86
PID 3184 wrote to memory of 2808	3184	msedge.exe	86
PID 3184 wrote to memory of 2808	3184	msedge.exe	86
PID 3184 wrote to memory of 2808	3184	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\40cc3ca2fef82a8a66bf8cd390e317a5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99bb046f8,0x7ff99bb04708,0x7ff99bb04718
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,10381093602594204680,7716525866930448594,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,10381093602594204680,7716525866930448594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,10381093602594204680,7716525866930448594,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10381093602594204680,7716525866930448594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10381093602594204680,7716525866930448594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,10381093602594204680,7716525866930448594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,10381093602594204680,7716525866930448594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10381093602594204680,7716525866930448594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10381093602594204680,7716525866930448594,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10381093602594204680,7716525866930448594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,10381093602594204680,7716525866930448594,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,10381093602594204680,7716525866930448594,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1376 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fb50c07a5c265c6c9eb17ec046450d2f

SHA1
b2f1688365a7ae3910ec0a91e078f85c83d00361

SHA256
a219c9680188e42332c7fc59cc106bbef6268037a830be930bddf927d0c4ee21

SHA512
e49349f03b6416afdccf8ce6070577c2fa6b98c2e0aacb653253634033885daa62c2a5d6084441bef73a126deafdf1c964279dad913a60ab336845673798abc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3d3a037a75c7a9035e17d363b94bbaa7

SHA1
457c1aed098360d7b68fc190d676cdc3b38c52fc

SHA256
bbd6a036cf6c9459c3180d3beca93d555f62dd16d3014c6a8f5a0ac72daf46d6

SHA512
84eab208113fffb9066c201dd6c533f41c38c6882967e3a1eff78f843595da3ee86f030151125cc9a54d4eaa80f855de30279e669a94512fc68891daeaef4325

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0c7fbb2f52d0d8e0011cf48d22671387

SHA1
740b46be39e3326027d90167ba75435f601cf208

SHA256
469ac004515c85198e6c715c1fa8eed2da300791877d282abd0752a2f10148ba

SHA512
aab19db720928e2debc983b852bbc1e435e322405cc7dca0fc31e263d88f028a0931dff9ca8cbab479a29b9754a15376251665ad919558596e9074283154adad

Download Submit