7ad0df1eccf64f5e9df7188d21872ea9ceb9ec1860437889e1035f0f69a0fda0

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 01:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54ae7037db605192917bb9e236a8f043_JaffaCakes118.html
Size

2KB
MD5

54ae7037db605192917bb9e236a8f043
SHA1

77ee0d820ca5421c45e53374209069ab2d55309b
SHA256

7ad0df1eccf64f5e9df7188d21872ea9ceb9ec1860437889e1035f0f69a0fda0
SHA512

a782c723388a8390e16674b193c7ea374c38f36c430b6ddecf8c97471bb96d96caee08bd915ad481f7e20ad70a42553337d9c658bbd0d7caccff0025a1fe539d

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1460	msedge.exe
1460	msedge.exe
4528	msedge.exe
4528	msedge.exe
400	identity_helper.exe
400	identity_helper.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 3448	4528	msedge.exe	84
PID 4528 wrote to memory of 3448	4528	msedge.exe	84
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 2896	4528	msedge.exe	85
PID 4528 wrote to memory of 1460	4528	msedge.exe	86
PID 4528 wrote to memory of 1460	4528	msedge.exe	86
PID 4528 wrote to memory of 1272	4528	msedge.exe	87
PID 4528 wrote to memory of 1272	4528	msedge.exe	87
PID 4528 wrote to memory of 1272	4528	msedge.exe	87
PID 4528 wrote to memory of 1272	4528	msedge.exe	87
PID 4528 wrote to memory of 1272	4528	msedge.exe	87
PID 4528 wrote to memory of 1272	4528	msedge.exe	87
PID 4528 wrote to memory of 1272	4528	msedge.exe	87
PID 4528 wrote to memory of 1272	4528	msedge.exe	87
PID 4528 wrote to memory of 1272	4528	msedge.exe	87
PID 4528 wrote to memory of 1272	4528	msedge.exe	87
PID 4528 wrote to memory of 1272	4528	msedge.exe	87
PID 4528 wrote to memory of 1272	4528	msedge.exe	87
PID 4528 wrote to memory of 1272	4528	msedge.exe	87
PID 4528 wrote to memory of 1272	4528	msedge.exe	87
PID 4528 wrote to memory of 1272	4528	msedge.exe	87
PID 4528 wrote to memory of 1272	4528	msedge.exe	87
PID 4528 wrote to memory of 1272	4528	msedge.exe	87
PID 4528 wrote to memory of 1272	4528	msedge.exe	87
PID 4528 wrote to memory of 1272	4528	msedge.exe	87
PID 4528 wrote to memory of 1272	4528	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\54ae7037db605192917bb9e236a8f043_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe9e246f8,0x7fffe9e24708,0x7fffe9e24718
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,2037180324743206687,4107875441286170129,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,2037180324743206687,4107875441286170129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,2037180324743206687,4107875441286170129,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2037180324743206687,4107875441286170129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2037180324743206687,4107875441286170129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,2037180324743206687,4107875441286170129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,2037180324743206687,4107875441286170129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2037180324743206687,4107875441286170129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2037180324743206687,4107875441286170129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2037180324743206687,4107875441286170129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,2037180324743206687,4107875441286170129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,2037180324743206687,4107875441286170129,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3912 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
309B

MD5
c80969294da7ebbb05916831a9ca239f

SHA1
54ebabee65b3be7e05e3a4878edfd743e129f0e6

SHA256
59da1925df7da7a899b7dcbc354c5519067925d93772765ccaebd057775deb4b

SHA512
f87cbe9f0b4c8f60a83a1d9ed1dcd0932513612291405f593cc848d29144a6b57f61c13642384c407daf7a99b43c1d0d6a947aeba527688d9a31473ae86262ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4528bdb28299854d574c859ebe23b4d8

SHA1
94672e2aec8afe7f4d2c0fba369433bc4e01e2e9

SHA256
46a362c223787690927c4187778583c35126092a237917c365e8a6f6532f5323

SHA512
505166cfbdce76ea5bde4881ace203e1176400178fb82296511a4da9d301f727d8d2e00591888ea83b1bb13f3e2951a2eee47a739cbd0fcbf06032e64272fb71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
03f5c574e9615f96e13837ad8e0d9b70

SHA1
6d402b4b20c111ece46e3aec4bd7e1552d1ce0ab

SHA256
15f37e94383e936ba4d7a7376ae6516ff839436a6ab7a535578b8792d83a902e

SHA512
ffebc5491cd53cd786a97a42947e840f3b4ff4a06f2c85cbbb640812a2f69bf79f3cde683cc697cc7068745629a039a7ad66fa833451a2eefc416ec619d6e28e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6c3c2484b63fa0ea1cff197638a620ca

SHA1
cea07d3927753eafa43e03f5ef78a85fca30a6d3

SHA256
90e49a34a9b2a48a94a3042590ca17e170167bec9c124d0336ba813173a7c3a7

SHA512
0aec440c9dc0b0176a7d2f174e8e01eff348f0d5c912f397301bbba85961329ec01e0df178d0c9c6b5c1c18f63eaef5d8a9ffa4d66af768d8e791810d487c8b3

Download Submit