e71fbdac6c24988a175f4ae2219f66c4863775d04d0ee40d5e7cc0c1ce08ada5

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

443d14a308200dd3c73ebdc335b87657_JaffaCakes118.html
Size

97KB
MD5

443d14a308200dd3c73ebdc335b87657
SHA1

5f9633b20ae6982e9693020216fabc7bb44ce293
SHA256

e71fbdac6c24988a175f4ae2219f66c4863775d04d0ee40d5e7cc0c1ce08ada5
SHA512

07ff104dfce12615caf079234f0cf088ad5674c068dcf847c5d441ee2cd2c1efb8acdfcaad0337ccf22daf864f391e247a8d12b42d1070a49ff723d8fe2bbacb
SSDEEP

3072:12PaM0yAil+3ZN1o+5VhcaMx6p+eWQcJhzHm5ZFQ1sQhneRgAqCSY3fhw/oCI:12PaJ/+eXt

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2520	msedge.exe
2520	msedge.exe
4752	msedge.exe
4752	msedge.exe
3092	identity_helper.exe
3092	identity_helper.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe
4028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 832	4752	msedge.exe	84
PID 4752 wrote to memory of 832	4752	msedge.exe	84
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 1400	4752	msedge.exe	85
PID 4752 wrote to memory of 2520	4752	msedge.exe	86
PID 4752 wrote to memory of 2520	4752	msedge.exe	86
PID 4752 wrote to memory of 1184	4752	msedge.exe	87
PID 4752 wrote to memory of 1184	4752	msedge.exe	87
PID 4752 wrote to memory of 1184	4752	msedge.exe	87
PID 4752 wrote to memory of 1184	4752	msedge.exe	87
PID 4752 wrote to memory of 1184	4752	msedge.exe	87
PID 4752 wrote to memory of 1184	4752	msedge.exe	87
PID 4752 wrote to memory of 1184	4752	msedge.exe	87
PID 4752 wrote to memory of 1184	4752	msedge.exe	87
PID 4752 wrote to memory of 1184	4752	msedge.exe	87
PID 4752 wrote to memory of 1184	4752	msedge.exe	87
PID 4752 wrote to memory of 1184	4752	msedge.exe	87
PID 4752 wrote to memory of 1184	4752	msedge.exe	87
PID 4752 wrote to memory of 1184	4752	msedge.exe	87
PID 4752 wrote to memory of 1184	4752	msedge.exe	87
PID 4752 wrote to memory of 1184	4752	msedge.exe	87
PID 4752 wrote to memory of 1184	4752	msedge.exe	87
PID 4752 wrote to memory of 1184	4752	msedge.exe	87
PID 4752 wrote to memory of 1184	4752	msedge.exe	87
PID 4752 wrote to memory of 1184	4752	msedge.exe	87
PID 4752 wrote to memory of 1184	4752	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\443d14a308200dd3c73ebdc335b87657_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ff8236046f8,0x7ff823604708,0x7ff823604718
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,3108357678744517430,12229933382121557359,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,3108357678744517430,12229933382121557359,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,3108357678744517430,12229933382121557359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3108357678744517430,12229933382121557359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3108357678744517430,12229933382121557359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3108357678744517430,12229933382121557359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,3108357678744517430,12229933382121557359,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,3108357678744517430,12229933382121557359,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3108357678744517430,12229933382121557359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3108357678744517430,12229933382121557359,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3108357678744517430,12229933382121557359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3108357678744517430,12229933382121557359,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2316 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,3108357678744517430,12229933382121557359,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1260 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
498e1201de8be917250f3e1210a13d9c

SHA1
f4aad20a5dea06e69584c29c5cd1d2e7ea87d2fb

SHA256
2a0b5fef2d88407ee26d5fdc16d9fe240712db6a5eaab95e07df2a40169c039f

SHA512
7ba0d727a301f02bc6c4d82360eba84e2a6dc91a51210131408bb6e073a74e0dcc698572b2d50d1b868b0453d10c454b08eb1e57bbfdb7860c2636dd4d19057e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0c8e3535d42d7e6dde2d6d7ae692ae63

SHA1
3546585c264721505756b05822fc6a68c89c1a5b

SHA256
a4d9a2989f83ef11c0ef2bd541eb1a5b1f5b3110e7072915aeff594fba52fbf9

SHA512
347f55b67d62736f65c8cc142e748da99dfb58d14793d2e3b4675637a3a18bbc0e84f445c2f85944ced2ce1c1c1659bc163d413dca23f09326bc14688671e19d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6ea80eea31bfe18e2579f57938784dc1

SHA1
8344be8b559e2f22ba82f5a16049fe966d2aeb16

SHA256
1c6e132d6f0289037c92f35852764543b4e45ea2cf89624cc98a7441534983df

SHA512
1e7799daa7926ab78e9c8a98ee0f7563527c310e1dc5480e427bc5e9a91e4eff11fa7270e29d84d4a3390e76e0e211518ce754e7d9b159240dd276d0fd567a4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
54514ad791d731013cadef2c90370497

SHA1
3b609a6d98e10fa50e8f6ad7007a1f0ee423977e

SHA256
0304cb9d3c129644b5c20d94b459bf4ecd53970340b202cea816f517436e5991

SHA512
ffdc1ec275ad89446c5eb01e8a0ee69a53099a9527a19f6e3a5c03aaf8e84c6bd777708004d68ad3c00f7ea8b24d0870281ac89566b7e3f8a674a43faf96cecb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ea952fd7-84c6-47fa-b4f2-2b86f3e5e99f.tmp

Filesize
6KB

MD5
e8911aebca92d7d73fd0a315cb720d9a

SHA1
34003865d500fac7481ced155e3f77c31aea10a7

SHA256
4d6dfea7170adb2bf4e196a5d021e60b49bc8f89cd6a089a0885c975558b3685

SHA512
04f189722b7846f08f214fba138374286c1e2def9a13a738b826f2f1905533c27ecdec48ea0f1bfa56f1e07a3f1135d462df4f40f3e598806e6da9dd803987cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
114289182789f803cb8676bc35d169e5

SHA1
4393b556925536f0a9bb1f375377aae8b369cdef

SHA256
19eba2268f71f1fe8467640dff264052a6d18da7ea76061136276213623dae57

SHA512
7a19067fdf5245b0482fc08369a37963ccc23fb6eee04f5f02ae2fabbb1d6a81927aab94b7cd2f58e59ef874779df814ab5c1e4aed6a83a5cb4ac168b5074613

Download Submit