957a0d792bb60b07a952285625890293ba90b941a124711a47725e28b03f4565

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 16:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52b20cd58cdd5f4c74ca3fa55d65caa7_JaffaCakes118.html
Size

20KB
MD5

52b20cd58cdd5f4c74ca3fa55d65caa7
SHA1

655cb10cceda9e6e50470f15eae95a114dcc451e
SHA256

957a0d792bb60b07a952285625890293ba90b941a124711a47725e28b03f4565
SHA512

71334deb7ed8675a26f6e2a79408c7f9275d0e91a6384dfc627b5b87bf584282010de337d728e5ceeb154643c97e24868d84f7d1371849c19e2c7ab4ca5336bc
SSDEEP

384:OV18zhte0UaJGBmPENV3gJLle2xyPxwRwD9fIdAs:O8zbe0bymrxyPxwRwD9fs

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe
752	msedge.exe
752	msedge.exe
3552	identity_helper.exe
3552	identity_helper.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 3540	752	msedge.exe	84
PID 752 wrote to memory of 3540	752	msedge.exe	84
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 4032	752	msedge.exe	85
PID 752 wrote to memory of 3028	752	msedge.exe	86
PID 752 wrote to memory of 3028	752	msedge.exe	86
PID 752 wrote to memory of 4648	752	msedge.exe	87
PID 752 wrote to memory of 4648	752	msedge.exe	87
PID 752 wrote to memory of 4648	752	msedge.exe	87
PID 752 wrote to memory of 4648	752	msedge.exe	87
PID 752 wrote to memory of 4648	752	msedge.exe	87
PID 752 wrote to memory of 4648	752	msedge.exe	87
PID 752 wrote to memory of 4648	752	msedge.exe	87
PID 752 wrote to memory of 4648	752	msedge.exe	87
PID 752 wrote to memory of 4648	752	msedge.exe	87
PID 752 wrote to memory of 4648	752	msedge.exe	87
PID 752 wrote to memory of 4648	752	msedge.exe	87
PID 752 wrote to memory of 4648	752	msedge.exe	87
PID 752 wrote to memory of 4648	752	msedge.exe	87
PID 752 wrote to memory of 4648	752	msedge.exe	87
PID 752 wrote to memory of 4648	752	msedge.exe	87
PID 752 wrote to memory of 4648	752	msedge.exe	87
PID 752 wrote to memory of 4648	752	msedge.exe	87
PID 752 wrote to memory of 4648	752	msedge.exe	87
PID 752 wrote to memory of 4648	752	msedge.exe	87
PID 752 wrote to memory of 4648	752	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\52b20cd58cdd5f4c74ca3fa55d65caa7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc02b446f8,0x7ffc02b44708,0x7ffc02b44718
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,408751418719174255,16935105528797981260,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,408751418719174255,16935105528797981260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,408751418719174255,16935105528797981260,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2196 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,408751418719174255,16935105528797981260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,408751418719174255,16935105528797981260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,408751418719174255,16935105528797981260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,408751418719174255,16935105528797981260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,408751418719174255,16935105528797981260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,408751418719174255,16935105528797981260,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,408751418719174255,16935105528797981260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,408751418719174255,16935105528797981260,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,408751418719174255,16935105528797981260,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3008 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
481B

MD5
9128c30ec8e9775e9672907d5a0ced9d

SHA1
b026a6b55564a05324da17f176ab10ede54c625a

SHA256
a37e6085fb810170aff47e21568a32721371d9eba70467bc54ce3592ccbad527

SHA512
ed8c5d4862a9f624148fa6ad31a2d77ae12e9bb8b9d258890a1ab1b2fb8d9ded1dfeb73e2a22b5b1c0629481afd65900a90075613d5e760bf385b108fbd8a2d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1252efd2726fccfb8e854433b566e275

SHA1
97bd4921c37ae1ab1670e39f81d3c02722ee08ac

SHA256
e726e8f74a46770b25326312a030c20c52c5a659c52572c3ab5e15dc1cd4763d

SHA512
119a322f8be882ce7634279076190427faaf15eaa4716d4e06963703f95f8e92f5b8bcfc6b20de3a2b8b01e1a0cc27bc68185561b49b3e3069826a2020a52ce4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b725a5d4c903a2cde1c6e0f5ce43aafb

SHA1
9f851674c1979c5a89643e0c2e36a30e691c1847

SHA256
af171dc61121f3b88c8397415b5986f5710892e86f4acf03a0689ed275cc3830

SHA512
16b57ddf806b1803918324ef3d73d5654c83b1bd8f43fedc5a29a24cb3dc6c0e4cf91978e12c00fe23b5a19b2d8e442eaef98a11cf2e0db9c6a56bebf9292f24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f2e240695d2626e4584262e1f7853852

SHA1
20250566a4c76e14ee5c25d4feaac87ebcda86ed

SHA256
2077a6aca72ff7d6ba14fec4152720574d0afea6ae637387377ba76e2c3ea47f

SHA512
6ea9a47c77769c3cb107f75d1244859ed625e6f6c8b536e2e5f8f735b5d7ba7b181b1403dd0a2d60dda4d0104bd6b71d7c572cf8748e6b33c9c559c3fcb700e6

Download Submit