e301601d7f8f4f443ffa187bb22c031202a0c9a6cda1e6d8374cd007a6392cf4

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2024 03:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ab47c80e5bcc78c6be34da7c56af5c2_JaffaCakes118.html
Size

220KB
MD5

5ab47c80e5bcc78c6be34da7c56af5c2
SHA1

c4aee29c8bb69ae59a51aaa4d50b831aa4603fe1
SHA256

e301601d7f8f4f443ffa187bb22c031202a0c9a6cda1e6d8374cd007a6392cf4
SHA512

1aa4d3263240188533544d1804b639ee45ac8342a0ccb070685e041e22ab44814ed181d4a7f6093a9baa409eb4401e7749202df2ec1f1cdbf732595d411362cf
SSDEEP

1536:EuztRWwxIa11t8k9NK0uwM0q8szs1hMuGqE2fNl6O1T0ime5ZQ5yaeELuKdBG:Euzrx911t8aN5/MuGqE2fNl6MrkPuKbG

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3556	msedge.exe
3556	msedge.exe
4880	msedge.exe
4880	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 3504	4880	msedge.exe	84
PID 4880 wrote to memory of 3504	4880	msedge.exe	84
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 4976	4880	msedge.exe	85
PID 4880 wrote to memory of 3556	4880	msedge.exe	86
PID 4880 wrote to memory of 3556	4880	msedge.exe	86
PID 4880 wrote to memory of 3272	4880	msedge.exe	87
PID 4880 wrote to memory of 3272	4880	msedge.exe	87
PID 4880 wrote to memory of 3272	4880	msedge.exe	87
PID 4880 wrote to memory of 3272	4880	msedge.exe	87
PID 4880 wrote to memory of 3272	4880	msedge.exe	87
PID 4880 wrote to memory of 3272	4880	msedge.exe	87
PID 4880 wrote to memory of 3272	4880	msedge.exe	87
PID 4880 wrote to memory of 3272	4880	msedge.exe	87
PID 4880 wrote to memory of 3272	4880	msedge.exe	87
PID 4880 wrote to memory of 3272	4880	msedge.exe	87
PID 4880 wrote to memory of 3272	4880	msedge.exe	87
PID 4880 wrote to memory of 3272	4880	msedge.exe	87
PID 4880 wrote to memory of 3272	4880	msedge.exe	87
PID 4880 wrote to memory of 3272	4880	msedge.exe	87
PID 4880 wrote to memory of 3272	4880	msedge.exe	87
PID 4880 wrote to memory of 3272	4880	msedge.exe	87
PID 4880 wrote to memory of 3272	4880	msedge.exe	87
PID 4880 wrote to memory of 3272	4880	msedge.exe	87
PID 4880 wrote to memory of 3272	4880	msedge.exe	87
PID 4880 wrote to memory of 3272	4880	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5ab47c80e5bcc78c6be34da7c56af5c2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5e5b46f8,0x7ffd5e5b4708,0x7ffd5e5b4718
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,4849296970954130442,15209654601934154868,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,4849296970954130442,15209654601934154868,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,4849296970954130442,15209654601934154868,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4849296970954130442,15209654601934154868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4849296970954130442,15209654601934154868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4849296970954130442,15209654601934154868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4849296970954130442,15209654601934154868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4849296970954130442,15209654601934154868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,4849296970954130442,15209654601934154868,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
d60606fc57d758d4d59b1403f9190087

SHA1
385a85a1f42c682047d2b7c844fae266d77aecac

SHA256
f36c65ad1aa986d395d8be11496f819956a524e79117e0f4ef8c5258d4799e74

SHA512
8624d8e5e7f8c863efc03036700cf4c72d4830c7a0d9d46af17fddf440f07f1e486ac5498750e602a2adae275903d2ce27092df0c557b88633746fe4e4fbacce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
5196b0132189aff65c98aa17898a0661

SHA1
985d66ba18d045d32caff110c6ac22ed139fd91f

SHA256
46e10cd715debaccf7f50dd68cf670a9461b5c076261b4c512766ec2507ee010

SHA512
b9276b854e1bbed5cc1f1894965517159b2dd9cc7a1b8597421649b47427260afd4bc220317dc3da4835fd3f71cb4ff0dfef9cc231106cbffad4a119a2619692

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
379fef14a484f3b5307cc9d46b0c91a8

SHA1
8273505120bd19ffc4f76a98ad486a7c5b8ea963

SHA256
fd370b5d7273348864d366942fef014cc434a4550b05f258bbc6ea4471a25131

SHA512
ab11d679d91746555bcbad8065e3c894bda611780dc90fa170ce3e4f48997b3652f88a0926e59df9cd2b21e4bfcf14d4c0061471bf081b274bc14326a94d2e11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0ba7e5ff2f70479b1a25ff4debfa2b25

SHA1
6db106a125c37a926c281e62638ccf8cadd6aaa8

SHA256
9909f9b023ce078def5796bf8fdfbd5f87ef6722de6586e2a25d35ad53c703dd

SHA512
1ee02bfa2b2391271b640eb7d82b0f0d4dcd603da3fe90430bdc6b88cdd31ce34a8a1ac58005253b5bbd3731bde38b39a3523949a02c3655ec5594adddb30de6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d6630a53ac1ce81c5dfb026253f49784

SHA1
74cc9ab49689f7ef30f96def15cf76bf941400ef

SHA256
a86fee1400055eb30a8f8ce31e20443309cb2b79f20b5a64588cef3e8db2b37c

SHA512
88607dbaa83918c68321ba636fa136df4843fcc994fedee5efc5aced488a4fcf976d751565e194d802266db8548cc2ded5d10737e84dfd7c216d45c63057b998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
36e5f92a917c248c6546315b83cab899

SHA1
91ecddd94392969fafbaee9eafc3f58409fa7206

SHA256
13a8d6282333cada6a471f605a600e31c0ad3718176bd411ee53bf25cb960714

SHA512
28dfc4d59840fd263cd3e99134e588b8d8f2e67711fbe2b96c04664c9119af1ba846d67b0002ebd73ec670c7c4e0ff6292c1787bc5bdfd9d3790bab41253d6e6

Download Submit