044b0461c569d100fd847120bf3b911de4681c33ed93dcfb6bf1ea171a1c5f37

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 23:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

544a426f62171226a5e11fab2e6b2182_JaffaCakes118.html
Size

35KB
MD5

544a426f62171226a5e11fab2e6b2182
SHA1

d99b3f58c305c323a381d81bde020c33d0181fae
SHA256

044b0461c569d100fd847120bf3b911de4681c33ed93dcfb6bf1ea171a1c5f37
SHA512

d4a45dbf8641f7e9256ed29fe4be5d9825c617f45f5730a7c5b56269545cf05c4c2bf09629d2d8454964716bc0601cdd3d1264f155706a76ce0615b6919dbaa9
SSDEEP

768:RxBxh0M3YxE77RPumqhjI0FQrCQCQKGL/W4VpMB0z/XEAJ11JLntWvk:TBxh0M3YxE77RPumqhjIq8jBKK+4VpMm

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2156	msedge.exe
2156	msedge.exe
388	msedge.exe
388	msedge.exe
4044	identity_helper.exe
4044	identity_helper.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 3604	388	msedge.exe	86
PID 388 wrote to memory of 3604	388	msedge.exe	86
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 4392	388	msedge.exe	87
PID 388 wrote to memory of 2156	388	msedge.exe	88
PID 388 wrote to memory of 2156	388	msedge.exe	88
PID 388 wrote to memory of 3692	388	msedge.exe	89
PID 388 wrote to memory of 3692	388	msedge.exe	89
PID 388 wrote to memory of 3692	388	msedge.exe	89
PID 388 wrote to memory of 3692	388	msedge.exe	89
PID 388 wrote to memory of 3692	388	msedge.exe	89
PID 388 wrote to memory of 3692	388	msedge.exe	89
PID 388 wrote to memory of 3692	388	msedge.exe	89
PID 388 wrote to memory of 3692	388	msedge.exe	89
PID 388 wrote to memory of 3692	388	msedge.exe	89
PID 388 wrote to memory of 3692	388	msedge.exe	89
PID 388 wrote to memory of 3692	388	msedge.exe	89
PID 388 wrote to memory of 3692	388	msedge.exe	89
PID 388 wrote to memory of 3692	388	msedge.exe	89
PID 388 wrote to memory of 3692	388	msedge.exe	89
PID 388 wrote to memory of 3692	388	msedge.exe	89
PID 388 wrote to memory of 3692	388	msedge.exe	89
PID 388 wrote to memory of 3692	388	msedge.exe	89
PID 388 wrote to memory of 3692	388	msedge.exe	89
PID 388 wrote to memory of 3692	388	msedge.exe	89
PID 388 wrote to memory of 3692	388	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\544a426f62171226a5e11fab2e6b2182_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe06a046f8,0x7ffe06a04708,0x7ffe06a04718
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,7350686578956039194,1236694799125374704,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,7350686578956039194,1236694799125374704,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,7350686578956039194,1236694799125374704,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7350686578956039194,1236694799125374704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7350686578956039194,1236694799125374704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,7350686578956039194,1236694799125374704,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,7350686578956039194,1236694799125374704,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7350686578956039194,1236694799125374704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7350686578956039194,1236694799125374704,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7350686578956039194,1236694799125374704,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,7350686578956039194,1236694799125374704,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,7350686578956039194,1236694799125374704,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
476B

MD5
91214e642720e11fe649ad8e69c8a50a

SHA1
b59e08cd4ad99290cd52c5d09561b41e91173728

SHA256
ad894e7dbffe94bbddc8d710dc90b7a22376d3837f9ed0e78218b20757d289ad

SHA512
223dc6b848d890715c9f1c742b9a786b9e55b21fb25deb4979fd53dee1750de4f0389eb0621d900c114761fe87a7bedbea58856481b929aa08315d23a8a6f777

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6e7d2cbdcd90c108aef61dd4e704be44

SHA1
e0eded6a05e49d21e47a426e165e184fb27745c6

SHA256
c0a1e5bb5f6af11e1845fac429b4e80c8b686f726f08bc8ed0e5b9873fcac2ae

SHA512
84def728f72ba8dae8046f6440ca2ebbb1e171f1a35f6b9ed07322f83e7275285f0f982298630903801e1474f0eadd7806af44d45f0463b7536d97a0e997e7ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f17c06d25fc0648dea3f8c27440e57aa

SHA1
bcc5cb52c007330e60923d9fa60e7be4ee591d8f

SHA256
353642f3fb9cc38ebc533a285452e290fe2b9601f9ff1b6b8d3feebcf0b586b9

SHA512
79e6f72eb9015d56a271326507dc49fff059bedcf2d208fe60ce1ec94b3aa937949c829f5e78def295793ec8dcde8831aece828b60b346feeb1ba77a0b61c4d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e58bfa40df618a7aa7c2995b8e75773a

SHA1
d8825cb74729b2bfc7bc759af465a49f09f4b38c

SHA256
ea6eff85de69aaa752a8ca695d2d13308c224cb44eb2135cba86ebd0bb3d6cd8

SHA512
ee0e6bf5ded601803d0983e1b266180617253b72c3316caa27f460a154390d07a7c14d139d294d1eb3833f1c263d55797be652b5640e2b77562b2b1bd6082b49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2bcf854e28bd546d17dfd0ef61956cea

SHA1
05105e7993b5b4f79309b9fddcb15b7502a248cf

SHA256
b004dfbf2f5beb1f394f6a8c0a503596759424316c591dbabf97819ddfb92b62

SHA512
6a2e7400d10008f2653ddb3b8c18c693e315dfbb137d7dacae3c4495550fa7259a35a4bb9f7177493a3a8f0f9eb1d7ff5b1e1381978e10f9a1fa079f581fda39

Download Submit