7402048d654732d0fc1be1d7048bed3ee84ed9d14845548c5a602d78205c43c3

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 01:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54a941e8111f4dc9b54521f590afb13a_JaffaCakes118.html
Size

46KB
MD5

54a941e8111f4dc9b54521f590afb13a
SHA1

10f776b51f5059e601a5fbcec913d276955fb379
SHA256

7402048d654732d0fc1be1d7048bed3ee84ed9d14845548c5a602d78205c43c3
SHA512

ab797ef65690962eae6c193204b71ef37a9d08d850ec2ea274d5fed6a33ee59037dbe027ffbfe2c30fe36b910cb2870a6e56a6544eef6503977726c4cb399c36
SSDEEP

768:t3wtTWTOECxMOq8XCrrplv0XN2kXdlMiOKS8AOuf9LB9BSIXLNXrVfKWm:dwtTWTOElFpKXvOKS59YIXLNXrVfKp

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
448	msedge.exe
448	msedge.exe
1172	identity_helper.exe
1172	identity_helper.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe
1416	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 900	448	msedge.exe	86
PID 448 wrote to memory of 900	448	msedge.exe	86
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 4392	448	msedge.exe	87
PID 448 wrote to memory of 5104	448	msedge.exe	88
PID 448 wrote to memory of 5104	448	msedge.exe	88
PID 448 wrote to memory of 716	448	msedge.exe	89
PID 448 wrote to memory of 716	448	msedge.exe	89
PID 448 wrote to memory of 716	448	msedge.exe	89
PID 448 wrote to memory of 716	448	msedge.exe	89
PID 448 wrote to memory of 716	448	msedge.exe	89
PID 448 wrote to memory of 716	448	msedge.exe	89
PID 448 wrote to memory of 716	448	msedge.exe	89
PID 448 wrote to memory of 716	448	msedge.exe	89
PID 448 wrote to memory of 716	448	msedge.exe	89
PID 448 wrote to memory of 716	448	msedge.exe	89
PID 448 wrote to memory of 716	448	msedge.exe	89
PID 448 wrote to memory of 716	448	msedge.exe	89
PID 448 wrote to memory of 716	448	msedge.exe	89
PID 448 wrote to memory of 716	448	msedge.exe	89
PID 448 wrote to memory of 716	448	msedge.exe	89
PID 448 wrote to memory of 716	448	msedge.exe	89
PID 448 wrote to memory of 716	448	msedge.exe	89
PID 448 wrote to memory of 716	448	msedge.exe	89
PID 448 wrote to memory of 716	448	msedge.exe	89
PID 448 wrote to memory of 716	448	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\54a941e8111f4dc9b54521f590afb13a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe06a046f8,0x7ffe06a04708,0x7ffe06a04718
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,6956229733418186482,3979432963417283343,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,6956229733418186482,3979432963417283343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,6956229733418186482,3979432963417283343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6956229733418186482,3979432963417283343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6956229733418186482,3979432963417283343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6956229733418186482,3979432963417283343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6956229733418186482,3979432963417283343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6956229733418186482,3979432963417283343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,6956229733418186482,3979432963417283343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,6956229733418186482,3979432963417283343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6956229733418186482,3979432963417283343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6956229733418186482,3979432963417283343,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6956229733418186482,3979432963417283343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6956229733418186482,3979432963417283343,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,6956229733418186482,3979432963417283343,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2968 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
8cece10e089946ea2272db5d34f63d09

SHA1
d77f601f689ba27a77a12d32886748c024c109b9

SHA256
369ca27adc0cf92fd27b206cc7f1d21b4144eac3928ca5bd16e979420e98d270

SHA512
773b5b600fce8a6ea070bc2562e04e681255591cf6dc75bd2a10e0d78a34751bdeaacb4b7369f394e3ae60a43dcf467499f3b4992d41f615dc1ef93f278d4160

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
789B

MD5
e72939a4899ac34d63ff315a5264db0d

SHA1
5659081c22f68661637fc5aff0afe126c27939a1

SHA256
511593a5b8722666417c2259893260ac0b62c682a10082f3cf8658980d871c21

SHA512
81f3f4d73169e5fa29ba57fddcc3af5ef961942dc3c9674f3bd5f07c12c4a53982f28821f30a9181ddbefd9f685960ff15c592d23c3083ec1c0cce10bb041092

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
263e13c085255c53c5cda62dd99f0fb1

SHA1
b7d92b8c6b27a1a62680364502b7d8caa99d1541

SHA256
0cd1bc9af150aa4e85470902a99d01eb27af8f42c5a469803328d084038da109

SHA512
ed631b3b22d91fcea01cba9c0e59b0605cdac1537bbea73131096b16fa27c41c976e89d8fc43f38d6a6d497a62d4d40fb5fb40fc4beff8b3bf9871a1e748e243

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4d0fdd221643db0ff83a18bfc4338e59

SHA1
ef1244808099189ab62845390a113d0dd16eda99

SHA256
04dbc4055ae7f97d5d41c705b9c3f496e9b856eba86cec7a4883d97bf07b89c7

SHA512
1a0836258f37bf1f7d6d7c42e08f1c11520667d583b9c5f6eabe56bf29bbc3857d02edba5f4d2402c27ce2de07920e3392ee05c80e5a1d6e1fdc761dceec22a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1b5438701f2119d91ab2686da6a56588

SHA1
d0888b576b05c2e078ad056742319d7866ef8973

SHA256
aad932815e4144961ce70723a74e6f400f2882588d5129615746634f8a92ea7d

SHA512
aeb0c6895e3342dc60c0569cd08e286a991a6f05fa02f88e48a1c745032f94a31a930cd8ace3a2f8e73c1dd2af74bf9fd65a91115c62d51534c23171bd09a4c9

Download Submit