9667d876ee9c38144065ef09c2409f3b3c08347f99b1094cfd9816970bdd5194

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2024 12:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94c0b6583c9acf75debf502a43cf8985_JaffaCakes118.html
Size

47KB
MD5

94c0b6583c9acf75debf502a43cf8985
SHA1

6373b664e728221c479f4d28203516c9963d20e4
SHA256

9667d876ee9c38144065ef09c2409f3b3c08347f99b1094cfd9816970bdd5194
SHA512

a1c464533ba651dc26188adeeba053c911f9042647ba72426278060cc28f9d345e1965c3ba96a7edec24d7637bdcf1ca4cc923ffc51feb3508067237e6b19f67
SSDEEP

768:0UuXFQQjFyFaWqJTl6XXFh8Hke9G1Z5eqbuqdiOmni5QVKUI9SYBiH:GX5c9qJTl6nFh8HkyWXlbuqdiOmni5Q5

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
212	msedge.exe
212	msedge.exe
1272	identity_helper.exe
1272	identity_helper.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 2320	212	msedge.exe	82
PID 212 wrote to memory of 2320	212	msedge.exe	82
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 1504	212	msedge.exe	83
PID 212 wrote to memory of 4828	212	msedge.exe	84
PID 212 wrote to memory of 4828	212	msedge.exe	84
PID 212 wrote to memory of 4764	212	msedge.exe	85
PID 212 wrote to memory of 4764	212	msedge.exe	85
PID 212 wrote to memory of 4764	212	msedge.exe	85
PID 212 wrote to memory of 4764	212	msedge.exe	85
PID 212 wrote to memory of 4764	212	msedge.exe	85
PID 212 wrote to memory of 4764	212	msedge.exe	85
PID 212 wrote to memory of 4764	212	msedge.exe	85
PID 212 wrote to memory of 4764	212	msedge.exe	85
PID 212 wrote to memory of 4764	212	msedge.exe	85
PID 212 wrote to memory of 4764	212	msedge.exe	85
PID 212 wrote to memory of 4764	212	msedge.exe	85
PID 212 wrote to memory of 4764	212	msedge.exe	85
PID 212 wrote to memory of 4764	212	msedge.exe	85
PID 212 wrote to memory of 4764	212	msedge.exe	85
PID 212 wrote to memory of 4764	212	msedge.exe	85
PID 212 wrote to memory of 4764	212	msedge.exe	85
PID 212 wrote to memory of 4764	212	msedge.exe	85
PID 212 wrote to memory of 4764	212	msedge.exe	85
PID 212 wrote to memory of 4764	212	msedge.exe	85
PID 212 wrote to memory of 4764	212	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\94c0b6583c9acf75debf502a43cf8985_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb397546f8,0x7ffb39754708,0x7ffb39754718
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1388,11317885966729296273,1364355177639394700,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1388,11317885966729296273,1364355177639394700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1388,11317885966729296273,1364355177639394700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1388,11317885966729296273,1364355177639394700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1388,11317885966729296273,1364355177639394700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1388,11317885966729296273,1364355177639394700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1388,11317885966729296273,1364355177639394700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1388,11317885966729296273,1364355177639394700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1388,11317885966729296273,1364355177639394700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1388,11317885966729296273,1364355177639394700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1388,11317885966729296273,1364355177639394700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1388,11317885966729296273,1364355177639394700,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1388,11317885966729296273,1364355177639394700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1388,11317885966729296273,1364355177639394700,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1388,11317885966729296273,1364355177639394700,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
26b07d03bf50f3816cdb86281d0a7402

SHA1
a82aeb30fb28bc6905128ff8b2ba13ca031e6202

SHA256
b1be2fad39ac4e0325513abbe9b171640051ebaf912ecfb6c05dcfa510732cac

SHA512
4770feaa11483aed6ddbd430e1b3cbea583d0b83ee6c76f37bf808549f966317561d2295590df4852aab0602ba46f0fd47192b95b04b58d45aa70258bb05e45f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f8547b60f06e2ad4501339ac1cb458c3

SHA1
0143957922bd03e6c901311e20f7274485e53930

SHA256
8cdee2a9de996157d953bb6d4539bba49729ec7f539f28eba91e465167766320

SHA512
06df3bba618c7d0b60fd2c0d23115dd08e9428481c90468827eaf7982dbdb9c34e35eeea8cdd12c23cc95005ec36faea374038a6e1d326521b5681522dfa4751

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7398a2c29352ce5561ff3c2280f00c1e

SHA1
da91ce73f119bbd239dd78dc79fc074824fcb2fc

SHA256
21c7cdfc820f83de768c31131b2c45de9da3ee0a44851fe74784e088950d10e9

SHA512
7373fb4ff0f1f1c126e901df033e38014c8e85c21b375d2684d5d3238c3d61164f8d53c0502a36d454d5805847edbd994fe162bd9408a72a8723ea87736ef96d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8504986db94d72d54374e4a79daed207

SHA1
7d2d1356499cd6b28f3d2b2afbe56e082fc768e1

SHA256
4741c5973a22fcf1d151c1451914d247fc88eff789fe386ee5475059506b7db1

SHA512
80916491c0dabc0c926f1c78b79855a894143a994a2a280b43c5b4fdb336677ba88b154195cd9ca880198f56629d1034780c503d92d5bfa40cec1447f0e89c47

Download Submit