ee0ff6238150167d0c14f4fdfb0ef368acbc17b9f407f98508a086c12b36ed9d

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2024 04:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

658669c61ef66aaf5854acd8ebc831d2_JaffaCakes118.html
Size

104KB
MD5

658669c61ef66aaf5854acd8ebc831d2
SHA1

e3cfa7d21a5c473b90bff7335ea1d648898a0496
SHA256

ee0ff6238150167d0c14f4fdfb0ef368acbc17b9f407f98508a086c12b36ed9d
SHA512

410d9909f39355143c0157b0dab4cc6a23595882947d612a925122844eca862ca5208a18594ced0a0905004e97ea3a5e0573238075c645a806ad9c6596a65c42
SSDEEP

3072:cAt3+YU+HJJnQzeYzxi9f3r+PUcscDWg+OiRPnjVdm:cAtIEieYzxWfb+PHim

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3912	msedge.exe
3912	msedge.exe
4000	msedge.exe
4000	msedge.exe
4512	identity_helper.exe
4512	identity_helper.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 1468	4000	msedge.exe	84
PID 4000 wrote to memory of 1468	4000	msedge.exe	84
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3876	4000	msedge.exe	85
PID 4000 wrote to memory of 3912	4000	msedge.exe	86
PID 4000 wrote to memory of 3912	4000	msedge.exe	86
PID 4000 wrote to memory of 3568	4000	msedge.exe	87
PID 4000 wrote to memory of 3568	4000	msedge.exe	87
PID 4000 wrote to memory of 3568	4000	msedge.exe	87
PID 4000 wrote to memory of 3568	4000	msedge.exe	87
PID 4000 wrote to memory of 3568	4000	msedge.exe	87
PID 4000 wrote to memory of 3568	4000	msedge.exe	87
PID 4000 wrote to memory of 3568	4000	msedge.exe	87
PID 4000 wrote to memory of 3568	4000	msedge.exe	87
PID 4000 wrote to memory of 3568	4000	msedge.exe	87
PID 4000 wrote to memory of 3568	4000	msedge.exe	87
PID 4000 wrote to memory of 3568	4000	msedge.exe	87
PID 4000 wrote to memory of 3568	4000	msedge.exe	87
PID 4000 wrote to memory of 3568	4000	msedge.exe	87
PID 4000 wrote to memory of 3568	4000	msedge.exe	87
PID 4000 wrote to memory of 3568	4000	msedge.exe	87
PID 4000 wrote to memory of 3568	4000	msedge.exe	87
PID 4000 wrote to memory of 3568	4000	msedge.exe	87
PID 4000 wrote to memory of 3568	4000	msedge.exe	87
PID 4000 wrote to memory of 3568	4000	msedge.exe	87
PID 4000 wrote to memory of 3568	4000	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\658669c61ef66aaf5854acd8ebc831d2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd38d46f8,0x7ffbd38d4708,0x7ffbd38d4718
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,9060962040280633655,3172201919395706229,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,9060962040280633655,3172201919395706229,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,9060962040280633655,3172201919395706229,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9060962040280633655,3172201919395706229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9060962040280633655,3172201919395706229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9060962040280633655,3172201919395706229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,9060962040280633655,3172201919395706229,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,9060962040280633655,3172201919395706229,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9060962040280633655,3172201919395706229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9060962040280633655,3172201919395706229,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9060962040280633655,3172201919395706229,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,9060962040280633655,3172201919395706229,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2752 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
498B

MD5
6e0a742d72a7e811ef3915c051984577

SHA1
73c6c2c22a8ec402750077639c031f978d2cca3e

SHA256
a5664aadb62e99172784e1bea4e8cdffd0e690b6c2a8e07cd749f03566bcb075

SHA512
cd242b8803db4207ac1972c9ba76c4f99fdbaf01430e75f6ef5a04644b50421bb699112b355cf1371eccc4f31a05f0de296dad075cd305c01841510e8a4a78c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fbc347ca76a03479a539be57cbf0069e

SHA1
3752434d2fdbb3cd58793e2d7f08fce963a2c50a

SHA256
3ee5d5535b59982d8b6823b0bc3680b4f9243e6e80a446e8fc32862ecf5ef7db

SHA512
d158388711ea091bedd20260908ba412762c1ffdf24b3e232c5b5f88d4366b2e495c2ea4284d14bea97dcdc2b484e57537b06721ee55e4add73cef96761fd9a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c5316022-a52a-4d0c-825e-3446fc923283.tmp

Filesize
6KB

MD5
c8daf0cadc2eb86e552262f5fd652aa4

SHA1
280fd08d5fc66e472ea25fa5328bcdaffde6b208

SHA256
2cf02d96182f409f8ae47107b859c6b2a37cc267997e45c81708b424327d147c

SHA512
3a24b4114b262c17e71e9b2b68c9c1e04732ba89e1dca380b2c5216f04f16a3936a9f3e16ae82d45e19bba0a36d460460e10d361d42faa11282d241add601d99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0cf1db84eda24f124536c28a80c2b72a

SHA1
528aad0de88b7dd1308caef339781ff555167631

SHA256
ffac15f45afb7b8875fcd842a0ff2f58cd11a2ad4468082432198840cb0ead0c

SHA512
f7caf76207b99ac15db16778913e59bfd25acd12cc8b1760e39be49307b9d4dc0b477a7093bf3d54e594243fa56a770849f2d096a56b695e5f0ee8de3001ea81

Download Submit