f7bcd1bda134236d00abb1d5fd0dbf1d6c483d8cda3f49a733557c4a15fcfd25

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 19:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

536c45a148bed2795b099738e358e02b_JaffaCakes118.html
Size

7KB
MD5

536c45a148bed2795b099738e358e02b
SHA1

1281deae1c49cbd6036fdc60d841016040f47c52
SHA256

f7bcd1bda134236d00abb1d5fd0dbf1d6c483d8cda3f49a733557c4a15fcfd25
SHA512

89288a45431631d803659d44974028534ea47328eb323719888c9c8be4e80d51c994a56f0d5be66445ca9625a2becf6773f8b8b3a67b2645476f9c944a4b6fe4
SSDEEP

96:e/0qFcGrOUpwv90G20Y090ZAW0X0B0L02ko287:e/jzYFmF4cAWuqIbT

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
2180	msedge.exe
2180	msedge.exe
768	identity_helper.exe
768	identity_helper.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 4524	2180	msedge.exe	84
PID 2180 wrote to memory of 4524	2180	msedge.exe	84
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 4464	2180	msedge.exe	85
PID 2180 wrote to memory of 1004	2180	msedge.exe	86
PID 2180 wrote to memory of 1004	2180	msedge.exe	86
PID 2180 wrote to memory of 4396	2180	msedge.exe	87
PID 2180 wrote to memory of 4396	2180	msedge.exe	87
PID 2180 wrote to memory of 4396	2180	msedge.exe	87
PID 2180 wrote to memory of 4396	2180	msedge.exe	87
PID 2180 wrote to memory of 4396	2180	msedge.exe	87
PID 2180 wrote to memory of 4396	2180	msedge.exe	87
PID 2180 wrote to memory of 4396	2180	msedge.exe	87
PID 2180 wrote to memory of 4396	2180	msedge.exe	87
PID 2180 wrote to memory of 4396	2180	msedge.exe	87
PID 2180 wrote to memory of 4396	2180	msedge.exe	87
PID 2180 wrote to memory of 4396	2180	msedge.exe	87
PID 2180 wrote to memory of 4396	2180	msedge.exe	87
PID 2180 wrote to memory of 4396	2180	msedge.exe	87
PID 2180 wrote to memory of 4396	2180	msedge.exe	87
PID 2180 wrote to memory of 4396	2180	msedge.exe	87
PID 2180 wrote to memory of 4396	2180	msedge.exe	87
PID 2180 wrote to memory of 4396	2180	msedge.exe	87
PID 2180 wrote to memory of 4396	2180	msedge.exe	87
PID 2180 wrote to memory of 4396	2180	msedge.exe	87
PID 2180 wrote to memory of 4396	2180	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\536c45a148bed2795b099738e358e02b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb596c46f8,0x7ffb596c4708,0x7ffb596c4718
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,5954665708577293356,15176790503590353798,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,5954665708577293356,15176790503590353798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,5954665708577293356,15176790503590353798,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5954665708577293356,15176790503590353798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5954665708577293356,15176790503590353798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,5954665708577293356,15176790503590353798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,5954665708577293356,15176790503590353798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5954665708577293356,15176790503590353798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5954665708577293356,15176790503590353798,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5954665708577293356,15176790503590353798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,5954665708577293356,15176790503590353798,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,5954665708577293356,15176790503590353798,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5404 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d24780dca3e3ba9d19db61e34dd2a895

SHA1
48b9f8784c2a8c18221744aa45af1f0c92aa6259

SHA256
5c4fdfd97574539ae0eca19a4955fb8ff02bc71b91a8ea734051579da16df6cd

SHA512
d0909060f384819eaaf1b2c4c04ccfbc7e6ed7db4883697d9a9adbd5b210303d58d71093642b270e5006441e555650ecb0f1ea0bc6404003e9546d07a2ea29c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d85475e7-efb3-4371-b7c9-8cb7443499f1.tmp

Filesize
6KB

MD5
1c52414ee9a9e42015d9207915b8fd0b

SHA1
711fd80708a7cf1fb444aada196ee360b475f2e5

SHA256
f1ed5b40b65a3c8597ce8ec53eb164a5b9aca38ad9160b7dcfe5b46b5d268745

SHA512
71d336db774184ae56f306581388d8ac1f7954a641a74559aca75e04d8a02879618c4c327a6747bcbaba5d4e8b96bed288e4ad87b9366bf1665dd7120b426b47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e415dc2358750def6d8d7b29d7d45335

SHA1
cdc213bb2a6b4068fc3abcbf0ee8bf556bcf59b0

SHA256
d4f6d738d593101264a0fd55521c81ddc64898972efad836774e9c65cc1e1098

SHA512
6b708087a972c512d61315827897de9aeacf9b3a3876fbf00939950393ab1e911d07e59c67f9fc3bf871445c38fa8dd3828ea4c2be0246abfb8cadb6583d01ba

Download Submit