ca625ca75f67ba4b9cf015559857cdc6a528071581e206a7a2f6b2f797f08caf

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 10:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57047e198bbb4bf61c1f6618e9d95690_JaffaCakes118.html
Size

68KB
MD5

57047e198bbb4bf61c1f6618e9d95690
SHA1

394c1c74024c1bb696ef9a5b5caf4686cacff908
SHA256

ca625ca75f67ba4b9cf015559857cdc6a528071581e206a7a2f6b2f797f08caf
SHA512

e493919257d0b5ff1114d6e533e0b86d9f97eadcc68467170ba30f6163619157975532b624733fb87601896eec8169bacf417d7410860a150f69b77e84e2771f
SSDEEP

1536:zU3lCBNFBJWbpp9aWKj/yRo3mq8zYJTz3Jh4te:g3l2JWbpp9aDjEoLz3Jh4te

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3148	msedge.exe
3148	msedge.exe
448	msedge.exe
448	msedge.exe
1984	identity_helper.exe
1984	identity_helper.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe
448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 5080	448	msedge.exe	84
PID 448 wrote to memory of 5080	448	msedge.exe	84
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3936	448	msedge.exe	85
PID 448 wrote to memory of 3148	448	msedge.exe	86
PID 448 wrote to memory of 3148	448	msedge.exe	86
PID 448 wrote to memory of 1800	448	msedge.exe	87
PID 448 wrote to memory of 1800	448	msedge.exe	87
PID 448 wrote to memory of 1800	448	msedge.exe	87
PID 448 wrote to memory of 1800	448	msedge.exe	87
PID 448 wrote to memory of 1800	448	msedge.exe	87
PID 448 wrote to memory of 1800	448	msedge.exe	87
PID 448 wrote to memory of 1800	448	msedge.exe	87
PID 448 wrote to memory of 1800	448	msedge.exe	87
PID 448 wrote to memory of 1800	448	msedge.exe	87
PID 448 wrote to memory of 1800	448	msedge.exe	87
PID 448 wrote to memory of 1800	448	msedge.exe	87
PID 448 wrote to memory of 1800	448	msedge.exe	87
PID 448 wrote to memory of 1800	448	msedge.exe	87
PID 448 wrote to memory of 1800	448	msedge.exe	87
PID 448 wrote to memory of 1800	448	msedge.exe	87
PID 448 wrote to memory of 1800	448	msedge.exe	87
PID 448 wrote to memory of 1800	448	msedge.exe	87
PID 448 wrote to memory of 1800	448	msedge.exe	87
PID 448 wrote to memory of 1800	448	msedge.exe	87
PID 448 wrote to memory of 1800	448	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\57047e198bbb4bf61c1f6618e9d95690_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe16a46f8,0x7fffe16a4708,0x7fffe16a4718
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,9542408867453986845,10455650602415954923,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,9542408867453986845,10455650602415954923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,9542408867453986845,10455650602415954923,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9542408867453986845,10455650602415954923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9542408867453986845,10455650602415954923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9542408867453986845,10455650602415954923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9542408867453986845,10455650602415954923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9542408867453986845,10455650602415954923,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,9542408867453986845,10455650602415954923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,9542408867453986845,10455650602415954923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9542408867453986845,10455650602415954923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9542408867453986845,10455650602415954923,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,9542408867453986845,10455650602415954923,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
ae7afc23f0a6453c11447a0ca4a55f58

SHA1
d40d65a6d2afb34b01fea73fe86420ad10ec08c2

SHA256
a5e48fcf217f06bcd45ee58a078c9cd2fe863ceec4c604cb0fab2660e2cb2024

SHA512
397f9233b966511bd18ae1359f5b81de852cef7c84cfc2690b50a6ed481aed7076bd54f2885f3a9c2621a0b4b421841ae09be909d77065613f10c6fd07deb9af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
560B

MD5
35f11db7873ebe713f87d10c7263d9c4

SHA1
d1c3b157fdf4ca0fdacb2eb9aaba3aaf5b429e6b

SHA256
8682daa64ea2166c5ee9e91877ace5c717cd438d13d8a1b0e82461ccc1a2d442

SHA512
fca34609a26d34b49b8e18b1bcc3c9a8ffc7bf4cbb9a6930cfe0a5b00bcd796a85fd72aad0aea306a506e34ea9c8e6952c5ad0dbb2ad1408341614154f4dd605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d7a6d94ed3d0c2f15ddc7ed4d18fb9d6

SHA1
e675b5efc310ade877b8a7ea4a28cd689ad7a7bd

SHA256
fb58fd1f786ecac62c73c337294cb4fb42347f33f36b835425d5e495a550af24

SHA512
74b610fc43789beb015437c61c2c56256328b355c7669018ca94e38cd00d6da5dfbc6bd06e8126fc18d1232a3c87353e5cd9dbfa756e383ec088e835008888e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
428dbe77e42869864f262d01a6e38c8f

SHA1
c927e7eb30ab4ace6ccdc55bbf12bc63886bc675

SHA256
4a8968d185af3977b0a10fdab45954c14effdcdb516f001e9396adfe0df58c6d

SHA512
2944049821daaa61027c58dbe9dadfe5e0cfda4afb70a30c36b924509e2c915de3c85629cd5ce92606f0043775c499d935678cb4441c1f0c601597112972fa00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
62e36cfc0efcac85b0ec211012d5b42f

SHA1
9c68eb65fa06ae756eb77a6d1dc17adc4e5cc0de

SHA256
bfaf4a07b50f3c2d630f04a5dd9fc69d8f79e7960a99ca6c082e984efa9bfb38

SHA512
f059e7603c9cb90f49446156f51de72dd5633c64e2060f860cf5ffe86f545dd966b99953c69652a2ac4a940a6870a9363156b5a5a8523ab5dbd28e7513bfab4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
df9d49da019cc2f556ee6b0711e2f2d7

SHA1
faf5fa2e42066c8cd133ddda1a1931839179ddc0

SHA256
c1f728a26ab3fec0b6bea9889da082df93f39184811f87e09f56f281cbb71db0

SHA512
28edb58924b68f06f449fe8bc310c6e73b1c196512ea7210baa43510198376e8c3f0422b23e4132ed8f8e64f405b5f42be869deec8c4dec13d796e9c9da19c18

Download Submit