b354d0d48f27eba74a1b2f8f9e86a467300b07d1b31b345d300d526e62769dc6

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 17:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4345863a33b92ce5a387fb82d22cb97b_JaffaCakes118.html
Size

41KB
MD5

4345863a33b92ce5a387fb82d22cb97b
SHA1

d905e254626a0e1250ccd2c05aed2b84e20f8915
SHA256

b354d0d48f27eba74a1b2f8f9e86a467300b07d1b31b345d300d526e62769dc6
SHA512

6fae10d54f7fe7b1bdea26375397c6570489a03b083c0f8a207b588b7a0302758025160bea47b9bb0bf4baf73f3067e7da8e4264f12a22a5e2ee5168e4d7f5fe
SSDEEP

384:BhCy9ttRUQW6h+22cJD9CAjCRgYxEV+XqBqcecyF/h/:BhiPH2BqjTF/d

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1776	msedge.exe
1776	msedge.exe
2680	msedge.exe
2680	msedge.exe
2584	identity_helper.exe
2584	identity_helper.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 4620	2680	msedge.exe	84
PID 2680 wrote to memory of 4620	2680	msedge.exe	84
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 4604	2680	msedge.exe	85
PID 2680 wrote to memory of 1776	2680	msedge.exe	86
PID 2680 wrote to memory of 1776	2680	msedge.exe	86
PID 2680 wrote to memory of 2520	2680	msedge.exe	87
PID 2680 wrote to memory of 2520	2680	msedge.exe	87
PID 2680 wrote to memory of 2520	2680	msedge.exe	87
PID 2680 wrote to memory of 2520	2680	msedge.exe	87
PID 2680 wrote to memory of 2520	2680	msedge.exe	87
PID 2680 wrote to memory of 2520	2680	msedge.exe	87
PID 2680 wrote to memory of 2520	2680	msedge.exe	87
PID 2680 wrote to memory of 2520	2680	msedge.exe	87
PID 2680 wrote to memory of 2520	2680	msedge.exe	87
PID 2680 wrote to memory of 2520	2680	msedge.exe	87
PID 2680 wrote to memory of 2520	2680	msedge.exe	87
PID 2680 wrote to memory of 2520	2680	msedge.exe	87
PID 2680 wrote to memory of 2520	2680	msedge.exe	87
PID 2680 wrote to memory of 2520	2680	msedge.exe	87
PID 2680 wrote to memory of 2520	2680	msedge.exe	87
PID 2680 wrote to memory of 2520	2680	msedge.exe	87
PID 2680 wrote to memory of 2520	2680	msedge.exe	87
PID 2680 wrote to memory of 2520	2680	msedge.exe	87
PID 2680 wrote to memory of 2520	2680	msedge.exe	87
PID 2680 wrote to memory of 2520	2680	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4345863a33b92ce5a387fb82d22cb97b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc13cc46f8,0x7ffc13cc4708,0x7ffc13cc4718
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,11487849856209838664,3263813003847571569,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,11487849856209838664,3263813003847571569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,11487849856209838664,3263813003847571569,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11487849856209838664,3263813003847571569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11487849856209838664,3263813003847571569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,11487849856209838664,3263813003847571569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,11487849856209838664,3263813003847571569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11487849856209838664,3263813003847571569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11487849856209838664,3263813003847571569,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11487849856209838664,3263813003847571569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,11487849856209838664,3263813003847571569,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,11487849856209838664,3263813003847571569,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0d2ddcbdd03ad8f4b6ebe17f55d9dbdb

SHA1
d1266fe16d05baed29e9270821dadca5325481d1

SHA256
ef097de92083862ab2b70200f11564ee1d907d53202ab4ddbfa64a6166964344

SHA512
9b09ecf6a9b61879f1e3dccd94ec94a4c1ec071e2ff0c89812e83b00181f30132ba4206157611bb08f8bffb7d8a726101bfa3beb375adab918d7a36997160397

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
918f7496dd43ae6e3d46dee99e5ec7fa

SHA1
be87d6fbc85ff234e9c6632ec86d2739f3894ba2

SHA256
499752223577f19c873b2555bf62a47843072a470f1c2b1581b7ef8a68b5e9c1

SHA512
5362a7d0f05d15aa036908a6584271ae59ec0395ea629b68841523df7da6e7e091b39ed74b9ce87eaa91e8c5e22fccb8d35e88aa668dc2953ca136c3928618cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e01adc251019cf76b5a9fecead5b9b55

SHA1
299ed17b8d237bf80c1b73787f48a689a5e67c4a

SHA256
f0837edbf3bbb75e96b22bfca38039776e12cf29b14c79cf362cb9893c1f57b8

SHA512
359820ef0b6135cd46dab0494317a569a0030d4458ac3184a3abb74d7482d075b1441b49fc8a53122010d78c5b74c72defb1c4869fa1aaf49f5bbcde81776a8c

Download Submit