90460c55996d806baaac0ee64c02a4fd0d6713ed3b0254bfad2b20026e10a74a

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e736baa9eb3a61adada5acb68d9a08d_JaffaCakes118.html
Size

80KB
MD5

8e736baa9eb3a61adada5acb68d9a08d
SHA1

ba018f3f63eca00528cbc04ac854ecc758c664ac
SHA256

90460c55996d806baaac0ee64c02a4fd0d6713ed3b0254bfad2b20026e10a74a
SHA512

4f165d4eb45e3c3bf684314f364741ec0655dfbc91b4fbe41895bb673ee0244199b4829fdae6cee9e1628bae478374c1323c8fb75c13c93c13b4e10f4450fb13
SSDEEP

1536:zpfxCZb5UdcN3onzkvD/zg1AJScSMtuCPhBy:1fxCDU2o4Drg/ltCPhBy

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
5064	msedge.exe
5064	msedge.exe
4632	identity_helper.exe
4632	identity_helper.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 4472	5064	msedge.exe	84
PID 5064 wrote to memory of 4472	5064	msedge.exe	84
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 4576	5064	msedge.exe	85
PID 5064 wrote to memory of 3200	5064	msedge.exe	86
PID 5064 wrote to memory of 3200	5064	msedge.exe	86
PID 5064 wrote to memory of 3244	5064	msedge.exe	87
PID 5064 wrote to memory of 3244	5064	msedge.exe	87
PID 5064 wrote to memory of 3244	5064	msedge.exe	87
PID 5064 wrote to memory of 3244	5064	msedge.exe	87
PID 5064 wrote to memory of 3244	5064	msedge.exe	87
PID 5064 wrote to memory of 3244	5064	msedge.exe	87
PID 5064 wrote to memory of 3244	5064	msedge.exe	87
PID 5064 wrote to memory of 3244	5064	msedge.exe	87
PID 5064 wrote to memory of 3244	5064	msedge.exe	87
PID 5064 wrote to memory of 3244	5064	msedge.exe	87
PID 5064 wrote to memory of 3244	5064	msedge.exe	87
PID 5064 wrote to memory of 3244	5064	msedge.exe	87
PID 5064 wrote to memory of 3244	5064	msedge.exe	87
PID 5064 wrote to memory of 3244	5064	msedge.exe	87
PID 5064 wrote to memory of 3244	5064	msedge.exe	87
PID 5064 wrote to memory of 3244	5064	msedge.exe	87
PID 5064 wrote to memory of 3244	5064	msedge.exe	87
PID 5064 wrote to memory of 3244	5064	msedge.exe	87
PID 5064 wrote to memory of 3244	5064	msedge.exe	87
PID 5064 wrote to memory of 3244	5064	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\8e736baa9eb3a61adada5acb68d9a08d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffded8446f8,0x7ffded844708,0x7ffded844718
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,5147506676763132932,13925386020617064809,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,5147506676763132932,13925386020617064809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,5147506676763132932,13925386020617064809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,5147506676763132932,13925386020617064809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,5147506676763132932,13925386020617064809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,5147506676763132932,13925386020617064809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,5147506676763132932,13925386020617064809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,5147506676763132932,13925386020617064809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,5147506676763132932,13925386020617064809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,5147506676763132932,13925386020617064809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,5147506676763132932,13925386020617064809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,5147506676763132932,13925386020617064809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,5147506676763132932,13925386020617064809,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
20eb678c68cc9c93ea060e462d73276c

SHA1
5115780dd6261006d99176f5cd471bc4e0f8dd79

SHA256
67eb6d43ee062286ba472ada8104a11395097a5e856a828352fa26d7660274ee

SHA512
a0d8a6d0395f4062c40decbeba675c85983ecaf384bd3a6319245c7cec4b4efd4fa011edafe617e7ea9b178d0d3ada4c0cb29d1492f29c54246a2d3ccd929b82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
86466137b0b3e47651b22399a1daa218

SHA1
6a216e31a6c0ccd1ecaf1bf13087f35c06c1d769

SHA256
34ed4c253a4182bc16221ceb120cf0fe764bfddf0459c1de47df84fb27886f8e

SHA512
3e94f894d520617d7dc04ed7af5fba1867f3892734f64cf7888052873477762abb4e767652c707d8bc93242d266ca5bf5d42bb7eb632d5fb06c9b4735b2cd705

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ccc5522a22b7b8c82a473b1f7b9f0f1d

SHA1
a3c2b199df1c9bb5afc85e6f24573a4fc88776c9

SHA256
f92e93b9293b004275e5bff73de8aa7c156b6c318e0520041d9500128af5969c

SHA512
0f371d9ce5fbbdc291446cc2a923c5749c96c72c7e2627039c5bae2e302569a460c89749caafa73e52045704d6cbc3c002e4a4d1cb4028ef09ac21924e444dcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7cc6995096280602a5f12d5b569f4a11

SHA1
faaea2947c445f882e765037d90ff1a9b47538a4

SHA256
8e7b3ee93abda7490639aa4ec09a15ac4c6050b2ab396e108f8755aa53907a40

SHA512
d50e9fdf732a42c9871ecbf83027430666e83bf79e31bd2e7d271b541a5a03d13afd60fbdf777740da48cf2bf894efb0ea455e682e534921efaf5b980f2c2552

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a01fbe14bf58511972fd9389615d8b46

SHA1
413b17d463f1d4023bacd4191a3133a043d665f2

SHA256
b2f17d3e43c49b75d647cc6b189c2e280b3ad560f793922d993df99e154a051b

SHA512
f8cd84ee37731b23546e984a6a9e2cde208f18383c6a0567c3e1b298a8233f59298a01e428dd1a1159bb33cd4c53251f065d99422f3e0724f8d76b4c4f2e0461

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e465194c71bd86a6535dbf5652cb80a1

SHA1
bec554c7120cfdb733046b928585fc75066dd400

SHA256
f125f0bc2f8eed65b25e91ee258664b0e80624b62b701da444de8397c7d30f20

SHA512
6c855b36fbb656e058a1df84dfcece02546008e82347be8a9469e306dceb212f99ff16ed4e750f54593d0d8ab8717dd0e72d765036cfeb62f5bf27946613dcc0

Download Submit