f33e50d416277e57f6e0616105ec83d96b65031c9cbe5e547effcf6d26c9b9f5

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-10-2024 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

529c1884b7b71e6bde560ffc1062f6c3_JaffaCakes118.html
Size

56KB
MD5

529c1884b7b71e6bde560ffc1062f6c3
SHA1

2dc2bc3d93f04fc7260c077e9341776e0ff257e2
SHA256

f33e50d416277e57f6e0616105ec83d96b65031c9cbe5e547effcf6d26c9b9f5
SHA512

a6acb7c32e189460e5e47f9a65b912a32ff2e21b4dced060c21b5a172ee422c1ea6e540031becf68d7043417c9bc9f6d0d9ff2a8ee7b102093157ab5184a10e2
SSDEEP

768:SQobPO3BBryTJdTR7H2XBTXu7m5x5b87CKvE7rnH7N1wi7ae7MOPWnGO:S06LRb2V+ana+LvHx11/zMH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe
1072	msedge.exe
1072	msedge.exe
3644	identity_helper.exe
3644	identity_helper.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 948	1072	msedge.exe	84
PID 1072 wrote to memory of 948	1072	msedge.exe	84
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 4940	1072	msedge.exe	85
PID 1072 wrote to memory of 3280	1072	msedge.exe	86
PID 1072 wrote to memory of 3280	1072	msedge.exe	86
PID 1072 wrote to memory of 4560	1072	msedge.exe	87
PID 1072 wrote to memory of 4560	1072	msedge.exe	87
PID 1072 wrote to memory of 4560	1072	msedge.exe	87
PID 1072 wrote to memory of 4560	1072	msedge.exe	87
PID 1072 wrote to memory of 4560	1072	msedge.exe	87
PID 1072 wrote to memory of 4560	1072	msedge.exe	87
PID 1072 wrote to memory of 4560	1072	msedge.exe	87
PID 1072 wrote to memory of 4560	1072	msedge.exe	87
PID 1072 wrote to memory of 4560	1072	msedge.exe	87
PID 1072 wrote to memory of 4560	1072	msedge.exe	87
PID 1072 wrote to memory of 4560	1072	msedge.exe	87
PID 1072 wrote to memory of 4560	1072	msedge.exe	87
PID 1072 wrote to memory of 4560	1072	msedge.exe	87
PID 1072 wrote to memory of 4560	1072	msedge.exe	87
PID 1072 wrote to memory of 4560	1072	msedge.exe	87
PID 1072 wrote to memory of 4560	1072	msedge.exe	87
PID 1072 wrote to memory of 4560	1072	msedge.exe	87
PID 1072 wrote to memory of 4560	1072	msedge.exe	87
PID 1072 wrote to memory of 4560	1072	msedge.exe	87
PID 1072 wrote to memory of 4560	1072	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\529c1884b7b71e6bde560ffc1062f6c3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ed2946f8,0x7ff9ed294708,0x7ff9ed294718
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,13479352358226344379,17439693837120905147,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,13479352358226344379,17439693837120905147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,13479352358226344379,17439693837120905147,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1472 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13479352358226344379,17439693837120905147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13479352358226344379,17439693837120905147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13479352358226344379,17439693837120905147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13479352358226344379,17439693837120905147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,13479352358226344379,17439693837120905147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,13479352358226344379,17439693837120905147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13479352358226344379,17439693837120905147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13479352358226344379,17439693837120905147,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13479352358226344379,17439693837120905147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,13479352358226344379,17439693837120905147,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,13479352358226344379,17439693837120905147,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
4eed2fe5c110d691c48a3dcdb15808cb

SHA1
26e5a3aaf11711bc385e31b36886dc5074c320f1

SHA256
ea866819393afbbd2cc332d6e87632d80118d44e1498368faebf56194f683be4

SHA512
1720d970826d7bc2099d70840a1bb5ab9fb75545f3d01b2cfd05635cf39fa2e7d255d1278ecbe03854bcd35a45ba5fedc625cb8123450757904d186d9f4aff1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
261B

MD5
091241544895f2b470459382d670dc74

SHA1
153aeb4c2fe23f2e0b631e46933abe3d7e5fbe2c

SHA256
8f33e6929500d4b63836d8dcb44b65884ccd3a0e1e1aa313bb0813f89c0c2d9b

SHA512
a2b85a978fe65ecdb51dcb8b698e781065c1af5a67f0b63eb00c04c1c05dce3e9d93608e03086d87bdf44add5611e1ef98dda422781aeca41c23167a24be3fa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
51bc295d7fb6ef0cc2df579aaec50319

SHA1
dcf6041a309930bba25b4602ecb046ccd24aca4d

SHA256
de0ce40d96c356d8e79fabcea5ddc974285908c43527b2c3e7cefbb269ccac9e

SHA512
4bf617450219bb4168977be6f831316ff5237e2fb4e5691f01763e90f3a92bd48b4c089321a76c78858d2da4d852634b7521166dc1c35cffb6b02239331731d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d02747ba7597b0c578c2f05e076a698b

SHA1
b529220d4d6a9a3614b856a49f4a3e4329693f97

SHA256
b18e87d592f20da552703383df4188ac75203b2c20b0ff1788002544289ba7c5

SHA512
bd4055852d92696dd0e32482bae77670ecc8721c061915750cf5eccb266a66eecaebcd6cbe9b1ed91daf9cd686ffa512d928b961564763abda59c9a4f0f30033

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bb12ad2cdeedb359597ee705c5343869

SHA1
d3a34845c5eaa1d03a762f9178c699463b07c087

SHA256
5a89e4689f515bc7a98aaa1fdbb75e623abe64e2968b25409b35134ec5729b9c

SHA512
61d6589eef1f0aa866bfa34faea741a367e9ca40fdf318aa68395744fb063f5c0d5bd094b765da69412bb0ff921c8bca32cdf2cbb0de0b538c907c0980b7893c

Download Submit