1bada4abe468cacb7106a3c57dc2e7436abbbf9c62f4387909e5f8d00fb6c45b

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 08:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6253e1c76dcfaaaf5a4db139cf48356_JaffaCakes118.html
Size

5KB
MD5

d6253e1c76dcfaaaf5a4db139cf48356
SHA1

497efab934d20f91d890a867d25d5d022e2cebe8
SHA256

1bada4abe468cacb7106a3c57dc2e7436abbbf9c62f4387909e5f8d00fb6c45b
SHA512

06fa5ca9a954c68a392dc05f1138fcfff13a7e813a8e9280c5fc426fbac27b87b1ab8385c3030c5773f3dac5ef3aeacb7279b10b24a33c44b83116eafe7746dc
SSDEEP

96:8y+cAl5azln+DtZog0HFxMUnZziKFe8LDmQIjK:8OAl0z8DjEHgUngKYQDm2

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
4208	msedge.exe
4208	msedge.exe
4732	identity_helper.exe
4732	identity_helper.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe
4068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 3140	4208	msedge.exe	82
PID 4208 wrote to memory of 3140	4208	msedge.exe	82
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4592	4208	msedge.exe	83
PID 4208 wrote to memory of 4960	4208	msedge.exe	84
PID 4208 wrote to memory of 4960	4208	msedge.exe	84
PID 4208 wrote to memory of 3184	4208	msedge.exe	85
PID 4208 wrote to memory of 3184	4208	msedge.exe	85
PID 4208 wrote to memory of 3184	4208	msedge.exe	85
PID 4208 wrote to memory of 3184	4208	msedge.exe	85
PID 4208 wrote to memory of 3184	4208	msedge.exe	85
PID 4208 wrote to memory of 3184	4208	msedge.exe	85
PID 4208 wrote to memory of 3184	4208	msedge.exe	85
PID 4208 wrote to memory of 3184	4208	msedge.exe	85
PID 4208 wrote to memory of 3184	4208	msedge.exe	85
PID 4208 wrote to memory of 3184	4208	msedge.exe	85
PID 4208 wrote to memory of 3184	4208	msedge.exe	85
PID 4208 wrote to memory of 3184	4208	msedge.exe	85
PID 4208 wrote to memory of 3184	4208	msedge.exe	85
PID 4208 wrote to memory of 3184	4208	msedge.exe	85
PID 4208 wrote to memory of 3184	4208	msedge.exe	85
PID 4208 wrote to memory of 3184	4208	msedge.exe	85
PID 4208 wrote to memory of 3184	4208	msedge.exe	85
PID 4208 wrote to memory of 3184	4208	msedge.exe	85
PID 4208 wrote to memory of 3184	4208	msedge.exe	85
PID 4208 wrote to memory of 3184	4208	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\d6253e1c76dcfaaaf5a4db139cf48356_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb382446f8,0x7ffb38244708,0x7ffb38244718
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,1212926161333891679,2494450692557797985,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,1212926161333891679,2494450692557797985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,1212926161333891679,2494450692557797985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1212926161333891679,2494450692557797985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1212926161333891679,2494450692557797985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,1212926161333891679,2494450692557797985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,1212926161333891679,2494450692557797985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1212926161333891679,2494450692557797985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1212926161333891679,2494450692557797985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1212926161333891679,2494450692557797985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,1212926161333891679,2494450692557797985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,1212926161333891679,2494450692557797985,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a4caa8b02127edad2b6d827e01d9981c

SHA1
cbcf558832fa78bb9b664c5a1cbc30580f53ea15

SHA256
0192fc12e53018c41981170b06859cac87110eb935e4dffcfadd7636656c1c0c

SHA512
4c55ad7429ef62a0b4ad5e398ef46bd3ced18222565a7c19046be565c5661ea6437daf7750c1084b0f147ff894390fb2c81aeac720a2e1bdccc5678baf02bd9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1920434da88d0760c6e7b4eb9271d481

SHA1
fac8cc7cbdb688e124d7f49a13fffa4f3fcf822b

SHA256
e143b2bf736e68f520cdfe911fec88d3923768edff19a60b88a73fb4020e5145

SHA512
42b1443578bf5d889f64ac569569c5516cfe4e5ae859f30cd572b77ef75c3e5ce4200f0c2105b13cb9b1e5858e4f03a8d83f448aa4e14d00e5ad1ed6b450bae8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
96aaaa37672f4fdce7db9aa0eed23b35

SHA1
dd82ea6665853673b620078cc01be80d803ca086

SHA256
b30bfd0d728f65f2c4fec08e66ff7c6b549b0ffcb5acc4d9962c3aaa8c8caad4

SHA512
6a1f9cad5738eed33c825df034b931ff5bfc61a58fde935a4bfb8a02e4a64caa830413a1bfe76d903fd2942d2b90f23b42a135e32c7a6ecd72149c0c07b7f010

Download Submit