60c0a7a94b2cdfff04772dc659d698535b00736a0ed2ba8cdbe2d56b79eb1003

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-10-2024 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5350b1d76479735a6ca154566099936d_JaffaCakes118.html
Size

24KB
MD5

5350b1d76479735a6ca154566099936d
SHA1

6f3c90ba60c0fe9bc457c6cc65300920fffebdbd
SHA256

60c0a7a94b2cdfff04772dc659d698535b00736a0ed2ba8cdbe2d56b79eb1003
SHA512

bd48d1584ac69d93e7cab29e70c6093eaa9d8bf2a0ff6b4b41cb72eab1f1b0a14e87d6a7c02f06c18630bf32ed223bf06a6ecfe778bf735f12a15bf0916f864b
SSDEEP

384:SLJHpxj3CgFZHuZVEJLil47hnVESd57nQ+GZDcKIS2u2701d3iqZS:SLJJ91FZHAQpCt49Syqw

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4624	msedge.exe
4624	msedge.exe
3276	identity_helper.exe
3276	identity_helper.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe
4624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 3560	4624	msedge.exe	84
PID 4624 wrote to memory of 3560	4624	msedge.exe	84
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 3712	4624	msedge.exe	85
PID 4624 wrote to memory of 4088	4624	msedge.exe	86
PID 4624 wrote to memory of 4088	4624	msedge.exe	86
PID 4624 wrote to memory of 1340	4624	msedge.exe	87
PID 4624 wrote to memory of 1340	4624	msedge.exe	87
PID 4624 wrote to memory of 1340	4624	msedge.exe	87
PID 4624 wrote to memory of 1340	4624	msedge.exe	87
PID 4624 wrote to memory of 1340	4624	msedge.exe	87
PID 4624 wrote to memory of 1340	4624	msedge.exe	87
PID 4624 wrote to memory of 1340	4624	msedge.exe	87
PID 4624 wrote to memory of 1340	4624	msedge.exe	87
PID 4624 wrote to memory of 1340	4624	msedge.exe	87
PID 4624 wrote to memory of 1340	4624	msedge.exe	87
PID 4624 wrote to memory of 1340	4624	msedge.exe	87
PID 4624 wrote to memory of 1340	4624	msedge.exe	87
PID 4624 wrote to memory of 1340	4624	msedge.exe	87
PID 4624 wrote to memory of 1340	4624	msedge.exe	87
PID 4624 wrote to memory of 1340	4624	msedge.exe	87
PID 4624 wrote to memory of 1340	4624	msedge.exe	87
PID 4624 wrote to memory of 1340	4624	msedge.exe	87
PID 4624 wrote to memory of 1340	4624	msedge.exe	87
PID 4624 wrote to memory of 1340	4624	msedge.exe	87
PID 4624 wrote to memory of 1340	4624	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5350b1d76479735a6ca154566099936d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf21a46f8,0x7ffaf21a4708,0x7ffaf21a4718
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,11153568429224822693,16908660873565132625,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,11153568429224822693,16908660873565132625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,11153568429224822693,16908660873565132625,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11153568429224822693,16908660873565132625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11153568429224822693,16908660873565132625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11153568429224822693,16908660873565132625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11153568429224822693,16908660873565132625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,11153568429224822693,16908660873565132625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,11153568429224822693,16908660873565132625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11153568429224822693,16908660873565132625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11153568429224822693,16908660873565132625,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11153568429224822693,16908660873565132625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,11153568429224822693,16908660873565132625,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,11153568429224822693,16908660873565132625,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
33541c6213f75af78af8ca44ce0ffc7e

SHA1
2d7cec6868c851148e8f416b5ba3f8a1ea5b69aa

SHA256
efdacb37c7143b4314544a38a73f36b67243e5d4c40af0790dd9c40d71484f4c

SHA512
ac45854541f19c0b8f2c7a221142fe4a7a2447ff8577cf38b344613203ebdeca9d557962f78b95e835fe5e02a121b93ede1ce3c38171ccb88057bd4f5fd7f87c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
642B

MD5
71f90d128a9dc368e28964b22c1db27c

SHA1
9bbf1d425a9d96717bb3b608d5049b9d0b2ff274

SHA256
30945969749f955339a19d9a501a79bebed84767862d37a73ab70834dffcf2e6

SHA512
4ba2148555be3180f4c4ccc046a2e568dc4248dc1ef259235cb907d3d660b1b0c709aa9c14c6843b32797489893ec5e9616d28a395bc7f1168bf4ef7fe6b3705

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
03bde1e8cfc48e80d4e7cf3a09daf1b3

SHA1
b122f78130bf902f0cce3e2204b1224be0bdc4ed

SHA256
ed6d8ba242b027338c9ae122d8cc5cf0f61789488ed98ed87062856c9d7e18ae

SHA512
43963b4d38a5af23fe30b1c83c1876299eb1da2775af14aabb8711aedbcfef93d47b621d6683f06804a38696568f3c7461cdb6f5bc70f1bc1ddcb39c58bb44b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8423da09aa8f23c79493d55208208938

SHA1
558c43ceaf4082b8fa3422026423318122d7844a

SHA256
d27d71ebfce8eb72654ab7a9bd50835cb348fec695b97717606d818b59e8f175

SHA512
c55edb2111720fd8ae70c437f51041bbebe8e078d2d4790f42ed6447be06572d23114685af6442480f669b4f6c0cf6e698574a8a54629e5244e043ad76e9bebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e2b1cfa3522142dd22473d1220bd13ae

SHA1
5f9cbaecc50733b6ae0dfe086a4d67f6c121c36c

SHA256
1fe495328d19630fbf27ccac1a52be67a98886ffd7c7b0cb280a4c29a81fcd8f

SHA512
7b9270411813775c9b4fb0ab739c7b16b5623d04e7b68a0076bba307e563e1da28ff891629346ba553d52d4129cfbe38cae7d551bfbaa11a49c477a357ca8b04

Download Submit