2c29afe9e5b9ddb05c0a61a441a2a6aa90c7352e79760df3773759bf65fba406

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 05:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d565c18e087d9681af6ab12d7f2d0836_JaffaCakes118.html
Size

158KB
MD5

d565c18e087d9681af6ab12d7f2d0836
SHA1

e28829bf1ac238a4375c07b7ed9735acd5268b6f
SHA256

2c29afe9e5b9ddb05c0a61a441a2a6aa90c7352e79760df3773759bf65fba406
SHA512

7c77f82c7d4272c6459187c005be9ada9d8d401e027968b63fb4ae9b46f0e653a53b942f3e5aa1ac3924fc6783614b80ce223c97f827d5ba4d60002f7d6f02e2
SSDEEP

1536:iURTYEM+U1wDTyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:iGqwDTyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe
3680	msedge.exe
3680	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4572	identity_helper.exe
4572	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 452	3680	msedge.exe	83
PID 3680 wrote to memory of 452	3680	msedge.exe	83
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 712	3680	msedge.exe	84
PID 3680 wrote to memory of 1908	3680	msedge.exe	85
PID 3680 wrote to memory of 1908	3680	msedge.exe	85
PID 3680 wrote to memory of 2424	3680	msedge.exe	86
PID 3680 wrote to memory of 2424	3680	msedge.exe	86
PID 3680 wrote to memory of 2424	3680	msedge.exe	86
PID 3680 wrote to memory of 2424	3680	msedge.exe	86
PID 3680 wrote to memory of 2424	3680	msedge.exe	86
PID 3680 wrote to memory of 2424	3680	msedge.exe	86
PID 3680 wrote to memory of 2424	3680	msedge.exe	86
PID 3680 wrote to memory of 2424	3680	msedge.exe	86
PID 3680 wrote to memory of 2424	3680	msedge.exe	86
PID 3680 wrote to memory of 2424	3680	msedge.exe	86
PID 3680 wrote to memory of 2424	3680	msedge.exe	86
PID 3680 wrote to memory of 2424	3680	msedge.exe	86
PID 3680 wrote to memory of 2424	3680	msedge.exe	86
PID 3680 wrote to memory of 2424	3680	msedge.exe	86
PID 3680 wrote to memory of 2424	3680	msedge.exe	86
PID 3680 wrote to memory of 2424	3680	msedge.exe	86
PID 3680 wrote to memory of 2424	3680	msedge.exe	86
PID 3680 wrote to memory of 2424	3680	msedge.exe	86
PID 3680 wrote to memory of 2424	3680	msedge.exe	86
PID 3680 wrote to memory of 2424	3680	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\d565c18e087d9681af6ab12d7f2d0836_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff998cb46f8,0x7ff998cb4708,0x7ff998cb4718
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,2214309719133044999,7708534063231911736,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,2214309719133044999,7708534063231911736,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,2214309719133044999,7708534063231911736,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2214309719133044999,7708534063231911736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2214309719133044999,7708534063231911736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,2214309719133044999,7708534063231911736,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,2214309719133044999,7708534063231911736,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4116 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,2214309719133044999,7708534063231911736,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2214309719133044999,7708534063231911736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2214309719133044999,7708534063231911736,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2214309719133044999,7708534063231911736,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2214309719133044999,7708534063231911736,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2f645c78dc01168d8c0fbcd07a9c8c7a

SHA1
ba597d15805dcc86915859bb510ef6edc65badc6

SHA256
8b6ded8391cbf4922a539d787492e9bf10e9ab2a2419daae76769066613618c9

SHA512
548f9c1ac6f95fa3165c5bd54b0f22afe68ae3c54ef54204222a14cf4d6a424b242eb28af157ce1dcede932024ccbbb0145a14b82c19fcba9120de5b8d08a06d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f3cbbbfbc0d69d0e98bee5811e3601e2

SHA1
3981ac0bcf9314d964e1a402049c42312361c7b5

SHA256
b028f5696121350a69b0293c4727ec1e851b6c6fd2e96d1aac2a248990c92fe8

SHA512
35d855001c04db4117275df68ab9bdfc81c97175446d320f9bd352463ec28db992083cfc332700f1bad5b38ac6d836cc6a6901bd42c8204c1e3d129a93b76fc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f110f8d935258f08cdebc57bd1286b71

SHA1
e99b338bacc3a34ac4eee66c4f15cd461709c4d4

SHA256
c0b0c6a146950f15e40e890974e9c9bce049217c84317944fc099b01366cf902

SHA512
8384c40f52bf89ca9e6cf7dc0f53a0c1d4838575100bad801bb8c59201d58f452026942ed56726cc5dc0a91992326ef96e12e87c9f9378ed20f99bf6272073dd

Download Submit