db8efeecd8f21c0d00ee036dcf8ee5016f1c613f7c188fc89cc2677572c36694

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2024 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4429057c85e2cb31e8eee2026365363d_JaffaCakes118.html
Size

24KB
MD5

4429057c85e2cb31e8eee2026365363d
SHA1

c5482c43abb5a61d8ec89aeefd52ac0f35df384c
SHA256

db8efeecd8f21c0d00ee036dcf8ee5016f1c613f7c188fc89cc2677572c36694
SHA512

adb55c74929e3e4b016b8c5601230185ac49063e807ea04f3381e9765dde7df446a7433ae5ebfd152a4ce9f9340cee55d88e82fd2ded6e49624c5914091a617b
SSDEEP

384:KDswzlHhUhNZroZHNuJpeD2F05jcBS1pllkZEIYNNyyUUFbB4O9OrpXHFsEupDX:KDswzlsr0MFRucaLGdVsEUX

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3660	msedge.exe
3660	msedge.exe
264	msedge.exe
264	msedge.exe
4832	identity_helper.exe
4832	identity_helper.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe
5584	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe
264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 264 wrote to memory of 1256	264	msedge.exe	86
PID 264 wrote to memory of 1256	264	msedge.exe	86
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 1376	264	msedge.exe	88
PID 264 wrote to memory of 3660	264	msedge.exe	89
PID 264 wrote to memory of 3660	264	msedge.exe	89
PID 264 wrote to memory of 2064	264	msedge.exe	90
PID 264 wrote to memory of 2064	264	msedge.exe	90
PID 264 wrote to memory of 2064	264	msedge.exe	90
PID 264 wrote to memory of 2064	264	msedge.exe	90
PID 264 wrote to memory of 2064	264	msedge.exe	90
PID 264 wrote to memory of 2064	264	msedge.exe	90
PID 264 wrote to memory of 2064	264	msedge.exe	90
PID 264 wrote to memory of 2064	264	msedge.exe	90
PID 264 wrote to memory of 2064	264	msedge.exe	90
PID 264 wrote to memory of 2064	264	msedge.exe	90
PID 264 wrote to memory of 2064	264	msedge.exe	90
PID 264 wrote to memory of 2064	264	msedge.exe	90
PID 264 wrote to memory of 2064	264	msedge.exe	90
PID 264 wrote to memory of 2064	264	msedge.exe	90
PID 264 wrote to memory of 2064	264	msedge.exe	90
PID 264 wrote to memory of 2064	264	msedge.exe	90
PID 264 wrote to memory of 2064	264	msedge.exe	90
PID 264 wrote to memory of 2064	264	msedge.exe	90
PID 264 wrote to memory of 2064	264	msedge.exe	90
PID 264 wrote to memory of 2064	264	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4429057c85e2cb31e8eee2026365363d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc8dde46f8,0x7ffc8dde4708,0x7ffc8dde4718
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,8797418189921099267,10301305059742156141,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,8797418189921099267,10301305059742156141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,8797418189921099267,10301305059742156141,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8797418189921099267,10301305059742156141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8797418189921099267,10301305059742156141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8797418189921099267,10301305059742156141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8797418189921099267,10301305059742156141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4388 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8797418189921099267,10301305059742156141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,8797418189921099267,10301305059742156141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,8797418189921099267,10301305059742156141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8797418189921099267,10301305059742156141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8797418189921099267,10301305059742156141,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8797418189921099267,10301305059742156141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8797418189921099267,10301305059742156141,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,8797418189921099267,10301305059742156141,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5572 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
184B

MD5
75580ace24347eb3b8968ace1d7eb252

SHA1
1389a7b155e636a9d5732188dcc6ed282b2afd3b

SHA256
6993aad309fa06cf9c5acad1aa85f457979a5750cf15a0869bbac50cb62bb28e

SHA512
f078ab3e0a0910c54cb6fc6ade0702cf83e8ae79d55d32e5c05e14145cdc1cd5360002238c4a84a2e14c566ad532230fed9616c122ef1328c20f0b371e9ca87e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
735613b29aad0a8949f3cc04db13a2ba

SHA1
9e9d0226461e09054cd749d377a40c22a456fb2f

SHA256
f80631464d523820d0ffd015d64abc353f2f3a04b96b11220b86bbc265f9d4f8

SHA512
1a788c1d806642da3d1c6a8d0422ea137eaaa22cc2d1843880e6b0580cf84a3c61158851bb99a2f9ee13ade20cd46ce6bbadc524c6cea45a4c07ba089aa618e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b56f07a62098c573b2d0c6159e3db286

SHA1
f926cd4f11e13dd5e910c2408542b551fa6365be

SHA256
7ac1940216ebad911847cbaa61396a8b1b1ce58c168b894c5b8989f7b21b0166

SHA512
9457b003831c7497481332ec5fda4385ef26d9e6016a32a401c4f3e10efe02a6e31bfd2050e9486bffa210a2b0426934126d7cf26eefe372baf02f6ab699e4b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1732c8d1a45df54ef9f9a044c81c5cc6

SHA1
ca02a79df368ad882c32aac70d616788407e3530

SHA256
8be05df0e769dcfa5d64d86003099c65f7ec7f7b8fa985ffd7770c36a857eba3

SHA512
b0d7423a076860e19cd39bb124cf7ff3d73b66281b1acceef7738c7ac4f735cabaf81213af9e533d2acec868ed9aefa833524d70556f10d0d55c65aa96722811

Download Submit