7842fcf81b39910b0e3b2ce3c7cbf918f4946be9c7de9dec172f9cd9845b5389

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2024, 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45a1c1b9b08fabe06426ed584b55bf1f_JaffaCakes118.html
Size

18KB
MD5

45a1c1b9b08fabe06426ed584b55bf1f
SHA1

bf2e4831e37c96406cb1fa2f53d7efe63e62abac
SHA256

7842fcf81b39910b0e3b2ce3c7cbf918f4946be9c7de9dec172f9cd9845b5389
SHA512

7f1596035e88a99b0bffe415ce053aced94dbb28c014355811ad55028a44cb311325b117294e027575b1b588ce0a515d4e653e0cb891842883ecebd4b49d8f04
SSDEEP

192:4jlhXcsuvZtv2aHQnP7zeLdT37cFU11V75XMNs6XHSxxxB7fVIp6iHZCL////r71:4Ol9hbnkby3MZi4sVO5YNzTK90JMSV

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3700	msedge.exe
3700	msedge.exe
4844	msedge.exe
4844	msedge.exe
1244	identity_helper.exe
1244	identity_helper.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 3132	4844	msedge.exe	84
PID 4844 wrote to memory of 3132	4844	msedge.exe	84
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 2892	4844	msedge.exe	85
PID 4844 wrote to memory of 3700	4844	msedge.exe	86
PID 4844 wrote to memory of 3700	4844	msedge.exe	86
PID 4844 wrote to memory of 3656	4844	msedge.exe	87
PID 4844 wrote to memory of 3656	4844	msedge.exe	87
PID 4844 wrote to memory of 3656	4844	msedge.exe	87
PID 4844 wrote to memory of 3656	4844	msedge.exe	87
PID 4844 wrote to memory of 3656	4844	msedge.exe	87
PID 4844 wrote to memory of 3656	4844	msedge.exe	87
PID 4844 wrote to memory of 3656	4844	msedge.exe	87
PID 4844 wrote to memory of 3656	4844	msedge.exe	87
PID 4844 wrote to memory of 3656	4844	msedge.exe	87
PID 4844 wrote to memory of 3656	4844	msedge.exe	87
PID 4844 wrote to memory of 3656	4844	msedge.exe	87
PID 4844 wrote to memory of 3656	4844	msedge.exe	87
PID 4844 wrote to memory of 3656	4844	msedge.exe	87
PID 4844 wrote to memory of 3656	4844	msedge.exe	87
PID 4844 wrote to memory of 3656	4844	msedge.exe	87
PID 4844 wrote to memory of 3656	4844	msedge.exe	87
PID 4844 wrote to memory of 3656	4844	msedge.exe	87
PID 4844 wrote to memory of 3656	4844	msedge.exe	87
PID 4844 wrote to memory of 3656	4844	msedge.exe	87
PID 4844 wrote to memory of 3656	4844	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\45a1c1b9b08fabe06426ed584b55bf1f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa586746f8,0x7ffa58674708,0x7ffa58674718
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,11116767779982754455,7886115963641257511,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,11116767779982754455,7886115963641257511,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,11116767779982754455,7886115963641257511,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2416 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11116767779982754455,7886115963641257511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11116767779982754455,7886115963641257511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,11116767779982754455,7886115963641257511,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,11116767779982754455,7886115963641257511,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11116767779982754455,7886115963641257511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11116767779982754455,7886115963641257511,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11116767779982754455,7886115963641257511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11116767779982754455,7886115963641257511,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,11116767779982754455,7886115963641257511,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4892 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1fe30b16d9a319824f7be874438a8eeb

SHA1
dabb62b4d3a6c7da6ec645d82020197da5c7c582

SHA256
23eee7e5f83b4488a0d4122ec1cc37c62f71f7cc470f67d446b2ea3d753f9b3d

SHA512
1ec8a24f182962b33b8c88b3af1098a91c7b0bdad3d00e11412b42a845c352326f5da5870bb5bf42bb0c86f84293efbb45d3ccf8d8a042e5fb0c304c92c126c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a8c422bb3b179ac3c3a69f90a2eef4d7

SHA1
a66739948c5214b76f6d306b184380e879759ad6

SHA256
6ba2dee08abedb98a4324712c1f85fed1e656245d50a26016af47b49f22b424e

SHA512
a319463e4a2ad26d42503ebae27ee781ad7d006ab72ce4f92784a6ebb50c88727e17ab5e838279af6bf5b2861bfcf6792ea115adab5b9bbae382bdcfed562d70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e90e4c165f911286b869439b71b1df22

SHA1
7a86fe9de09bbc25ab2cc8002ae210c991384bdc

SHA256
9179e9a862f7d4fdca1027267554af2548942571708432efe2c2394770fb6271

SHA512
cbed6c51d3d20c51510c1d4788df9063fe03c537f683963edd30a3d16107d64d0ab1ea3b263ffa10e0553fc2cbf17e0da4ea20c7831f8d2bc78c8605a343b5da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2db1d8f86206ab0f78f60f24d7488e97

SHA1
1b75b55394981e7938ff921eb921a48660ab543c

SHA256
ad84736fec330dafe8b9419964919d4ef5df0ad1caa3d4d730d4864444107643

SHA512
c59456dfed4322787c08b734833a5a19818b7a1359ec67ed3dced5eda5cfa39245db7bb474f7df3461b5d947112c3eef05d6a854548a59674128f91578ecedab

Download Submit