bb7a4fa988a13b1823f8a1ca7c536bd59131d65af8039ca217d6f6931e0c9a02

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5590f87cb5e833b13b16f8ae5a7694a6_JaffaCakes118.html
Size

64KB
MD5

5590f87cb5e833b13b16f8ae5a7694a6
SHA1

22b8308b40894b8728bdc1c4e899c6dab9fdbc69
SHA256

bb7a4fa988a13b1823f8a1ca7c536bd59131d65af8039ca217d6f6931e0c9a02
SHA512

a24a0a622249cf7cb838b35548dff16241f32f1cd7107dc93f2bf3c8f19eb9ad343a4d3af219e5baf6ca915b29e7daa102eb11caef5eaea589df44325b7c7501
SSDEEP

384:SoI8dH3IaKafdy8CocwATf5TDaXBTEAxTBVCTF3A6+aYTNgnYTK6SGYTc8THHqXs:SMIXHVauIYgtXYHpLy039

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
4436	msedge.exe
4436	msedge.exe
1088	identity_helper.exe
1088	identity_helper.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 3976	4436	msedge.exe	84
PID 4436 wrote to memory of 3976	4436	msedge.exe	84
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2596	4436	msedge.exe	85
PID 4436 wrote to memory of 2492	4436	msedge.exe	86
PID 4436 wrote to memory of 2492	4436	msedge.exe	86
PID 4436 wrote to memory of 3796	4436	msedge.exe	87
PID 4436 wrote to memory of 3796	4436	msedge.exe	87
PID 4436 wrote to memory of 3796	4436	msedge.exe	87
PID 4436 wrote to memory of 3796	4436	msedge.exe	87
PID 4436 wrote to memory of 3796	4436	msedge.exe	87
PID 4436 wrote to memory of 3796	4436	msedge.exe	87
PID 4436 wrote to memory of 3796	4436	msedge.exe	87
PID 4436 wrote to memory of 3796	4436	msedge.exe	87
PID 4436 wrote to memory of 3796	4436	msedge.exe	87
PID 4436 wrote to memory of 3796	4436	msedge.exe	87
PID 4436 wrote to memory of 3796	4436	msedge.exe	87
PID 4436 wrote to memory of 3796	4436	msedge.exe	87
PID 4436 wrote to memory of 3796	4436	msedge.exe	87
PID 4436 wrote to memory of 3796	4436	msedge.exe	87
PID 4436 wrote to memory of 3796	4436	msedge.exe	87
PID 4436 wrote to memory of 3796	4436	msedge.exe	87
PID 4436 wrote to memory of 3796	4436	msedge.exe	87
PID 4436 wrote to memory of 3796	4436	msedge.exe	87
PID 4436 wrote to memory of 3796	4436	msedge.exe	87
PID 4436 wrote to memory of 3796	4436	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5590f87cb5e833b13b16f8ae5a7694a6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f17046f8,0x7ff8f1704708,0x7ff8f1704718
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,1214005716890442116,8853393781610148052,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,1214005716890442116,8853393781610148052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,1214005716890442116,8853393781610148052,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1214005716890442116,8853393781610148052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1214005716890442116,8853393781610148052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1214005716890442116,8853393781610148052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1214005716890442116,8853393781610148052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1214005716890442116,8853393781610148052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1214005716890442116,8853393781610148052,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,1214005716890442116,8853393781610148052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,1214005716890442116,8853393781610148052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1214005716890442116,8853393781610148052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1214005716890442116,8853393781610148052,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,1214005716890442116,8853393781610148052,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
b40f35ad5fca1c3ce618856f47cc2bbc

SHA1
0f7131167878c33afe5d903ef535f7a627362f42

SHA256
32ef00175ffe8ffdc2123f30fda0a65c9f802c213efc1bf36e00bcd4ccec6ead

SHA512
5ac8c821571b9ca7e2a007b2bba34f877df7a58e9cae67469abb774ebad96377fabc630b61bd0437d9db0e05e83ccc56931cf8b5e990dfeb9f1b6844e5248e0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
38a9e1044d2e19cd3d8ab04c7f74c7f4

SHA1
a1b268b413e6ebd08b0cb729c3662f1173136b02

SHA256
b9ac92caa7a96c3f27720e8afd8181bb14576fec6e7989b8ba2734729bfd9b51

SHA512
6685a7be01134db2abd6ceae953465700080cd588c530a58e376af258fc87f1ab7dd0933d4fcd44c9f56b6ef7ad75803e94f43d688a7a43de09df2829e3d1ebf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0d58766b4ea5eb149d143a30434c63a2

SHA1
8a6046232d38ae6d943872b4a5c18396a15b8207

SHA256
779575dd217eea67c86386da7e7cb25edaa8d7f8558e788edbe0d854c6fba586

SHA512
cfe2a90466a60c546038b5ca290c5ca33bf03e88df884812a946f48f9b62443d400012aed9c7e32b61c491ec09099b3713a912abc7e5a4eee7f852b639209757

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5942f8240a7c4acefd12282fd42499d2

SHA1
26fcdcbd73454f614c33ba264a40f02381b20785

SHA256
cc48d680872ee05130b630eb8ddce13c0098d64fffdc2c3d19ff8ff962fb5c3b

SHA512
4a00be59c9c9aad3c7af8b22b50e4bc3826f305314d1f17e2e2e7ae84f5ae521b690f6a011c4c5311ed2a25251bf4d7c24a27a620cda372e833e5c68cf097fc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
50be77d22bbec0e411827093db12006b

SHA1
ec45625d539d7746ad26a63216d0c6a136245e78

SHA256
45365c47aafec76ab298ac0e6768d04cc99b855e6d186abae64aa22b2c44b5f1

SHA512
bf2f31bc647b8cfea03c3a4025bc2038cd7d68bd4d7058ffe850ed42193260fd923c9ec145c24733c7e831dc5e26cce45b48e808f36d0822f30ca6d35af24892

Download Submit