d7429f7e2c0f2d616a1f96ba2bd1d7595ac41edf010e848a6294da58f02217c2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 03:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d516527c48b6bfce8014c0cd652a56f4_JaffaCakes118.html
Size

186KB
MD5

d516527c48b6bfce8014c0cd652a56f4
SHA1

452ebee32b28ad912aa79d5925d04acd1dbb54f6
SHA256

d7429f7e2c0f2d616a1f96ba2bd1d7595ac41edf010e848a6294da58f02217c2
SHA512

1e23ac3ad547d19c2dedae1874df508f94f84c4ad461c0cc4b6a262de82d528d54d1fdfe73ef5c68187749b9ab35c1d279821d62f970b882f665849634d243d4
SSDEEP

3072:AxDNvG8rm/GXmNJUNBVT+e+EJTLIWwA4Pv7xF2mxR4aRtRy:+VXmNJPe

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
928	msedge.exe
928	msedge.exe
4812	msedge.exe
4812	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 2888	4812	msedge.exe	83
PID 4812 wrote to memory of 2888	4812	msedge.exe	83
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 1720	4812	msedge.exe	84
PID 4812 wrote to memory of 928	4812	msedge.exe	85
PID 4812 wrote to memory of 928	4812	msedge.exe	85
PID 4812 wrote to memory of 1984	4812	msedge.exe	86
PID 4812 wrote to memory of 1984	4812	msedge.exe	86
PID 4812 wrote to memory of 1984	4812	msedge.exe	86
PID 4812 wrote to memory of 1984	4812	msedge.exe	86
PID 4812 wrote to memory of 1984	4812	msedge.exe	86
PID 4812 wrote to memory of 1984	4812	msedge.exe	86
PID 4812 wrote to memory of 1984	4812	msedge.exe	86
PID 4812 wrote to memory of 1984	4812	msedge.exe	86
PID 4812 wrote to memory of 1984	4812	msedge.exe	86
PID 4812 wrote to memory of 1984	4812	msedge.exe	86
PID 4812 wrote to memory of 1984	4812	msedge.exe	86
PID 4812 wrote to memory of 1984	4812	msedge.exe	86
PID 4812 wrote to memory of 1984	4812	msedge.exe	86
PID 4812 wrote to memory of 1984	4812	msedge.exe	86
PID 4812 wrote to memory of 1984	4812	msedge.exe	86
PID 4812 wrote to memory of 1984	4812	msedge.exe	86
PID 4812 wrote to memory of 1984	4812	msedge.exe	86
PID 4812 wrote to memory of 1984	4812	msedge.exe	86
PID 4812 wrote to memory of 1984	4812	msedge.exe	86
PID 4812 wrote to memory of 1984	4812	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\d516527c48b6bfce8014c0cd652a56f4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffedd6d46f8,0x7ffedd6d4708,0x7ffedd6d4718
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11408028712261323591,7579728909910639470,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,11408028712261323591,7579728909910639470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,11408028712261323591,7579728909910639470,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11408028712261323591,7579728909910639470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11408028712261323591,7579728909910639470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11408028712261323591,7579728909910639470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11408028712261323591,7579728909910639470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11408028712261323591,7579728909910639470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11408028712261323591,7579728909910639470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11408028712261323591,7579728909910639470,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3092 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
23KB

MD5
1ed76811af8c6ed01b3d356f3bad9a3c

SHA1
8eb6ec720c89345a37f37c519a7e60453ff256d9

SHA256
52775526647d60d401b7d0ac7ad728e621edc59c4b9f6bda497ba5fef48239b4

SHA512
24cb443881a4a4fca319827e28b6aaaa5f0402867c49adeeb2c81dfa469dc448c2397e1e488d23ad2af0ffe0cbb63b8d866efdc2a8ed5dca6b4cbc4f9084499a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
20KB

MD5
4b3121a05808b99aa6e0cc12924f77db

SHA1
ee5805bb76c384d1e1667aea2976bd2f4f94c7cc

SHA256
e4fea32bac89d9ad34b13a25b0b4da1321920b2c6be2cabb75ff91bf6109152c

SHA512
9b83d55691b41d2a45a542d163c1b6a47208969720ec1fd15233f29ddcef2243e79895cfcb008767f91b3d1cf3a6288248e8b1ec50027eb96db04cde56cb2605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
0c9efffa2042b874c45882bd36e5d5ff

SHA1
d5f68bafde1f251d22ad1f02768a3b8972d9925e

SHA256
99881c6f4634f515d3c3ee157b41dedef0b4fc4635c711130219502b9832d2f0

SHA512
1a65889f3710c8dcf7290e7003424b70c92cb459aca60e251171ec7ee15ec739d16e7447bdf3fecee266cc67ca833cc659510e47d9baa773b7482b628e8de01b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
cc5d53a4e2560baef1469c58ab5d5abc

SHA1
faeb149833172fa73feeb0e0607a0cc4f8c33d20

SHA256
214094f499ca68b37e60f1098d0805e27f48e65c8bafc66d44cc8c97ee3e2d12

SHA512
8c5ec22b65a0c2809fad507bcd991e320dd15667314e34c161c2b51c1290c4a578f1cff262c87d09a875dbe1d5a5a6bfd5c163014550e9b3e6d51b12b18600c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
39d8eeb1fd19fa6ec4c3bfd41fd4fc5e

SHA1
3534343c31fc19bf5d877e90376fc42b05a13f2d

SHA256
3b2d90b3c9b61a631df3ab014fa5dcb2a56cf8671757af05c89b14f5bc2205dd

SHA512
697207d1ca061a7539a58ef07bc62e3df24602a4c7548196aad2866b296ae71f0d4082f635ac5e652ad9545e65156edd3936df32ecdc1ad2867209c9de64de5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b0cd0567b651a9fbff28bb695ab6a4ed

SHA1
c7cf4275fae4089e361edc5aadfb9bd3814eb97b

SHA256
e2c9b348fa5eb7a2fc787ce9621c7c75cdb7c303ec2abbfd612da4709d4ebb9a

SHA512
0e3e46d9edbac7b853bf217a0100931474dc9a6b81fd852d39183b1ea5b52e7983e58453f731847e5c55e5e7a61ff5278de440ba2aaacb6439dd7b0f93b6b056

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f82eea50fa7b133580e44e52a745b481

SHA1
26ae7d8c997650799f03c143eca870034af5121e

SHA256
d0eb20da517ae7ddafaa0b112ab645f7bbd820eee9d05f7f954551f7a9b0df7a

SHA512
3272bedc3314571ad32109bb95fac95ac6f62bf81cad2328d76c660104fa32661547fbf8e89b70d54c4080b1d3dfeb7297cfcc4177f64005e796888e9e4ddc01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a479aa08d7dc877d06355fe2e8f63029

SHA1
e25c913e4738ff0a68ff65f72af820ca6ef39838

SHA256
34b5b6b2bac5c050bd3f64384ca7fa3bb135bd52db2078138a05351eb507e533

SHA512
570d704fba7e85aba68b47af65642ad3e1371c0485496bf4dda48c2f4e5358a95f9b1963ab94c2906176e13a2b81fc9b8231b1631c8100e6abdead7dfaffa29d

Download Submit