a84cae4bee06307050b0bf1e485940aae9b4e877317eb671762d05ce63ae8048

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

55604c7019aa5432f6ec22b5054eb191_JaffaCakes118.html
Size

26KB
MD5

55604c7019aa5432f6ec22b5054eb191
SHA1

0f0cc8796ac909086378b2d6326d04ac99a21f23
SHA256

a84cae4bee06307050b0bf1e485940aae9b4e877317eb671762d05ce63ae8048
SHA512

86708365c8b0be31bcc4be5e15155c35e2b934d70fddc21c2ae569462842d4372ce52ca87284c61d39ae1fde6a318e67429b36715536f2d67ee971dc070b1042
SSDEEP

768:/+1wpKVAqnd+qi9q7B2GcNzD1rlM2SpsJV:/+1GKVhnd+LABFcNzD1rln

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1196	msedge.exe
1196	msedge.exe
1060	msedge.exe
1060	msedge.exe
4164	identity_helper.exe
4164	identity_helper.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 936	1060	msedge.exe	86
PID 1060 wrote to memory of 936	1060	msedge.exe	86
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 4700	1060	msedge.exe	87
PID 1060 wrote to memory of 1196	1060	msedge.exe	88
PID 1060 wrote to memory of 1196	1060	msedge.exe	88
PID 1060 wrote to memory of 4052	1060	msedge.exe	89
PID 1060 wrote to memory of 4052	1060	msedge.exe	89
PID 1060 wrote to memory of 4052	1060	msedge.exe	89
PID 1060 wrote to memory of 4052	1060	msedge.exe	89
PID 1060 wrote to memory of 4052	1060	msedge.exe	89
PID 1060 wrote to memory of 4052	1060	msedge.exe	89
PID 1060 wrote to memory of 4052	1060	msedge.exe	89
PID 1060 wrote to memory of 4052	1060	msedge.exe	89
PID 1060 wrote to memory of 4052	1060	msedge.exe	89
PID 1060 wrote to memory of 4052	1060	msedge.exe	89
PID 1060 wrote to memory of 4052	1060	msedge.exe	89
PID 1060 wrote to memory of 4052	1060	msedge.exe	89
PID 1060 wrote to memory of 4052	1060	msedge.exe	89
PID 1060 wrote to memory of 4052	1060	msedge.exe	89
PID 1060 wrote to memory of 4052	1060	msedge.exe	89
PID 1060 wrote to memory of 4052	1060	msedge.exe	89
PID 1060 wrote to memory of 4052	1060	msedge.exe	89
PID 1060 wrote to memory of 4052	1060	msedge.exe	89
PID 1060 wrote to memory of 4052	1060	msedge.exe	89
PID 1060 wrote to memory of 4052	1060	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\55604c7019aa5432f6ec22b5054eb191_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa45cb46f8,0x7ffa45cb4708,0x7ffa45cb4718
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,8030033439100774518,14756496197726904343,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,8030033439100774518,14756496197726904343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,8030033439100774518,14756496197726904343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8030033439100774518,14756496197726904343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8030033439100774518,14756496197726904343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,8030033439100774518,14756496197726904343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,8030033439100774518,14756496197726904343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8030033439100774518,14756496197726904343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8030033439100774518,14756496197726904343,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8030033439100774518,14756496197726904343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8030033439100774518,14756496197726904343,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,8030033439100774518,14756496197726904343,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3596 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
395B

MD5
99287a6e258eabcfc71bb02d7d8d108e

SHA1
74627167363175e9e0075c49253d7b1f0973b99f

SHA256
60e8ac1a752baa6709515efb4dd1831559552dc17c0f80484add35fc4f53823e

SHA512
59b403743eb175382ca19294fe827d13b55d4e3e8579ab1dc3bf26690b5df681e01663a7e981d5c809fe346e4edf56d95aa0f3a9c8855a1e0c388e5df87dd51a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cdb5080a54d1a8e47f93cb4c2ec88662

SHA1
67a260deb8026d5bb43a0dd561827961a78f98bb

SHA256
ca8f8b1533f1af9494fc77fdb70bce9fbe76c8e73c1a63bb097a79d085719f4d

SHA512
22f0582e7ed6c790812b52386d9e8bfe0a44d97969a0ddddb483751ad72e562e20e5d2e8bd1c2d46f6784f5985b11e0e196a8f498443c4df5d4484a8856722d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a3cb8bc38486cdf46c69f5602f44f376

SHA1
87d44bfd644376701ae4d1f27b234c272af877a5

SHA256
918085ec464085c8c4562df1ea454223cb49e6ffc130af4759dbfaf618c8b9ba

SHA512
0f63ccb7f1f5c2cdebc012de78ca872fed0a5e9e775afb1294e50775a2d117f8f2414603c0cc1b6ee1cb5a8aa9da2a9a06e07ce4f96489019118de45e568f197

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3e27717b37993783cc0d3799b6429fad

SHA1
96386198751138b581a046c85993eeca82d85fcd

SHA256
05fbce6d97bb5282ce41c59c8ebbb3d11510a9899ca24229d3f3761342d999c0

SHA512
644be5086bee831cbf753b2b592051119668a3f2bfa971ed452aeb5c9a4b0f8ee6c2b7ffc7e403d1c0fa5f5c3bbabde5c11d066b5b6d5968a3fbcf605a69933c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c323c0e8633f8c89fa274e879e568dbc

SHA1
33bc5ce620bc4d2aa4d0b71df11f74dd824ba49d

SHA256
74b8241b98c11a42657ed348146790f05f27794d426d7caf51cc03509082da46

SHA512
9e9b0b3c9227677c27bf1677f0e64aa4b4134ca832a47190d4e51b8c550cf0a378a31947a0c590f10073159a69520e854fad5068c1e49fc93938a0c5ce39f680

Download Submit