c73b9c223f6bb3282f4826b5c2f636098b98ce34fb4e248c978be856cc8bed0b

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2024 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b848790d983327eacfafd4448a470c0_JaffaCakes118.html
Size

245KB
MD5

6b848790d983327eacfafd4448a470c0
SHA1

0938d1dbe6b1a351332516a8148b631312f385c4
SHA256

c73b9c223f6bb3282f4826b5c2f636098b98ce34fb4e248c978be856cc8bed0b
SHA512

da1696110bef529b7991092e6be8d805850e4188aa331270d52c5510d848bdac64baa1e355b73925b3f6aa0668203d6637e8b67c367dabccac990d3475d61b4f
SSDEEP

3072:osHoddhIRlw3urMRyA1DaLAZr+5/xTd5Wbb45RAU4cG5GRbmI6eMXJA/PGcxsZYa:znrMDDaL1vz/lP2V+iisF3

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
26	sites.google.com
27	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe
2908	msedge.exe
2908	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe
3600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5000	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5000	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 3672	2908	msedge.exe	84
PID 2908 wrote to memory of 3672	2908	msedge.exe	84
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 1552	2908	msedge.exe	85
PID 2908 wrote to memory of 3320	2908	msedge.exe	86
PID 2908 wrote to memory of 3320	2908	msedge.exe	86
PID 2908 wrote to memory of 2612	2908	msedge.exe	87
PID 2908 wrote to memory of 2612	2908	msedge.exe	87
PID 2908 wrote to memory of 2612	2908	msedge.exe	87
PID 2908 wrote to memory of 2612	2908	msedge.exe	87
PID 2908 wrote to memory of 2612	2908	msedge.exe	87
PID 2908 wrote to memory of 2612	2908	msedge.exe	87
PID 2908 wrote to memory of 2612	2908	msedge.exe	87
PID 2908 wrote to memory of 2612	2908	msedge.exe	87
PID 2908 wrote to memory of 2612	2908	msedge.exe	87
PID 2908 wrote to memory of 2612	2908	msedge.exe	87
PID 2908 wrote to memory of 2612	2908	msedge.exe	87
PID 2908 wrote to memory of 2612	2908	msedge.exe	87
PID 2908 wrote to memory of 2612	2908	msedge.exe	87
PID 2908 wrote to memory of 2612	2908	msedge.exe	87
PID 2908 wrote to memory of 2612	2908	msedge.exe	87
PID 2908 wrote to memory of 2612	2908	msedge.exe	87
PID 2908 wrote to memory of 2612	2908	msedge.exe	87
PID 2908 wrote to memory of 2612	2908	msedge.exe	87
PID 2908 wrote to memory of 2612	2908	msedge.exe	87
PID 2908 wrote to memory of 2612	2908	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6b848790d983327eacfafd4448a470c0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd450c46f8,0x7ffd450c4708,0x7ffd450c4718
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,790897018360920716,9527732984304281033,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,790897018360920716,9527732984304281033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,790897018360920716,9527732984304281033,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,790897018360920716,9527732984304281033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,790897018360920716,9527732984304281033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,790897018360920716,9527732984304281033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1816 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,790897018360920716,9527732984304281033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,790897018360920716,9527732984304281033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,790897018360920716,9527732984304281033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2040,790897018360920716,9527732984304281033,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,790897018360920716,9527732984304281033,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1344 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3524

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x318 0x444
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
78d3e017654fd59ab15ec07a968c64a8

SHA1
e9a825c31e895972c3b0e0f72ae5e280c4899d88

SHA256
667371d65c03a3c2bd8a0580992d25d466b2c65899dd95efface3229dbebb199

SHA512
4b6dc20a810a77c93c894b4f4158a8da35d107deee7d653bf861ab93418215c064b8ca2314d2433af9558dfa58f8c5e9d1765f6b6b29197696c893ec02207e82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
056a13da69ce4a4c4498004fc86c93a7

SHA1
7ac38d9575629d93e15352910f1cdecb09e57d1c

SHA256
7f8ca483fc2076b6405c5802312bc6876699e35b64804623554100e377bb0467

SHA512
04aa6267603ecaf93d4809721188f4be05bf48d213e9e556a5a6ac67d129ab9506c94b36f191ebd17258d17b08ad40db962cb1e7ab05115640185e04965935c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ae80e437df232fec8443a81800397ff4

SHA1
08760e373b7f38275757b35c52ee9a6eeab8eab8

SHA256
b8eb3df9832d9274db1f2bea3d9f832ab23029db81ec31cea57af6a491521ece

SHA512
5dda32c5339d1f1edf1ed23688c58180ab7b1e89f62443d2b5a622c234246bd4437e9bf62669a95550f1ccb776481a2c9b8e90b9beba1118cbbd5bda1a9d5af1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4383e0809d693d027350876fc58d6b5c

SHA1
96ee88ebb3b6676834935d979385cb8ea5a0e1ce

SHA256
fd47f98806df6ed2b61ad7a0e20b3829ca8f4bc04d1afec286ca7b42e0c7fbc0

SHA512
136e50b17dfc0afd25d2bfe04f6ac57902171974edc25a54b2da76625e6b49de5aa105402a9f73eb0e77dce3b990703bb5c9d8b9a142c3249c93bd23f5471fa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
79929d06a2808dfd7819c4307aa037a0

SHA1
90ae26a92a778af3f08ac08cffccdcbbec7b44c5

SHA256
1727a55768ca5160589d70a353f90621bd46f1eff79c36bc746c0564ad36eb34

SHA512
8d4eb182913eaac763c2195e54acfb46f50bb5d16adbfda26c6b9e5ac19a6071aca124f72c85f01dfcc7ce5c15643e18fdcb67ef98a814208f583c832854e8d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
e3a8ad4faed410aac795260b49572a70

SHA1
54883ba8ae8b41356c3beebfb104833491fadde3

SHA256
65bd17530492b24bd50a7c0564910cd08cfe353769c224fab5f55f22b42c90d3

SHA512
f63db6b568c29c2035b3884522a4653f0ea60b3cb03ab998ad0108191b162a985c98d54b742052de1b67cd86eb2fe4cc1a3dd0467eb603f80aa8abd9af995aea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58bc46.TMP

Filesize
204B

MD5
022dd1f40e10a27d3f9e3e9576f4abcc

SHA1
775ee8f242995add10fa2e757506d084645313bd

SHA256
e777d0d3fa8bbedf1b57d4485bc91f489f2765a8e7f8e294fad5a5c713be6a91

SHA512
005f7c78b411a8b264d48ab4f217fe2339521e544a12c6b8929334286f360ab434b5a2a0940e4e68548c89402cd918ea23dccfae9a8411d18baae8b5bb3c43f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1f0822579618159976bd3b3e59213ac5

SHA1
4f883dd166e68e33c9515800936d843d4da25c8f

SHA256
c1b3334e434df1689319fe54c71338136ed8cb16d876930bb4cb30dfa2705ce0

SHA512
9b32a0f3e204ebec278e27b65dfd65f89bd192a43baf8c3b8a047583cd9d78b5fa3dc728b562abe69662e37f0270e2761c9563d72106968d86476818b9371cfd

Download Submit