1c202ba5101677211bfe66306c83349d941791c731e45207bc6f8675ad8db6d8

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2024 11:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d967045e71ad9f76322bf545cb52059a_JaffaCakes118.html
Size

155KB
MD5

d967045e71ad9f76322bf545cb52059a
SHA1

eb2ce29e9887d4f01549510d9c080eabea12c84d
SHA256

1c202ba5101677211bfe66306c83349d941791c731e45207bc6f8675ad8db6d8
SHA512

6c87cc04efef307315b29103777b6ba0cea2c4efd4e5db7353db526b072149119d36dcfa2e0f70114c7509ab60a394581ac04fced8a7074811ee5dcc049b92c6
SSDEEP

1536:irRTw9aCJEpVPBSyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJA:iFJ7JSyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
772	msedge.exe
772	msedge.exe
4044	msedge.exe
4044	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
4724	identity_helper.exe
4724	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe
4044	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 3956	4044	msedge.exe	83
PID 4044 wrote to memory of 3956	4044	msedge.exe	83
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 4672	4044	msedge.exe	84
PID 4044 wrote to memory of 772	4044	msedge.exe	85
PID 4044 wrote to memory of 772	4044	msedge.exe	85
PID 4044 wrote to memory of 1968	4044	msedge.exe	86
PID 4044 wrote to memory of 1968	4044	msedge.exe	86
PID 4044 wrote to memory of 1968	4044	msedge.exe	86
PID 4044 wrote to memory of 1968	4044	msedge.exe	86
PID 4044 wrote to memory of 1968	4044	msedge.exe	86
PID 4044 wrote to memory of 1968	4044	msedge.exe	86
PID 4044 wrote to memory of 1968	4044	msedge.exe	86
PID 4044 wrote to memory of 1968	4044	msedge.exe	86
PID 4044 wrote to memory of 1968	4044	msedge.exe	86
PID 4044 wrote to memory of 1968	4044	msedge.exe	86
PID 4044 wrote to memory of 1968	4044	msedge.exe	86
PID 4044 wrote to memory of 1968	4044	msedge.exe	86
PID 4044 wrote to memory of 1968	4044	msedge.exe	86
PID 4044 wrote to memory of 1968	4044	msedge.exe	86
PID 4044 wrote to memory of 1968	4044	msedge.exe	86
PID 4044 wrote to memory of 1968	4044	msedge.exe	86
PID 4044 wrote to memory of 1968	4044	msedge.exe	86
PID 4044 wrote to memory of 1968	4044	msedge.exe	86
PID 4044 wrote to memory of 1968	4044	msedge.exe	86
PID 4044 wrote to memory of 1968	4044	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\d967045e71ad9f76322bf545cb52059a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd71646f8,0x7ffcd7164708,0x7ffcd7164718
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,7061363549488135841,14297607252647738606,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,7061363549488135841,14297607252647738606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,7061363549488135841,14297607252647738606,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7061363549488135841,14297607252647738606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7061363549488135841,14297607252647738606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,7061363549488135841,14297607252647738606,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4936 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,7061363549488135841,14297607252647738606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,7061363549488135841,14297607252647738606,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7061363549488135841,14297607252647738606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7061363549488135841,14297607252647738606,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7061363549488135841,14297607252647738606,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7061363549488135841,14297607252647738606,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:4696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f16a1ad45fd74c16120ea12fed967fa0

SHA1
bee24814e653a4c07057ef76021838ba6b2c34a0

SHA256
868cf164f1742e382d9fe28fcb63ca2329347d7dab1d5e13d2e4b1fa3656bc76

SHA512
379680a992c31c26f38897989e86a899f4b2983905632b9a6e84c0a10e15714f995e1b2a763bd67b97e4645ca28e5092e4d7545163e026f0230fe87d3a7a020b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e3b27d64bbda8db18d9a4e270082656e

SHA1
0f13df3d485352806531d62d8c6d5da639d9dc8c

SHA256
66d6c06166847c34d589f419b49996c1304458b80e8f3e73f34b8f779eeb7ce3

SHA512
f9f12d88482ca7c9d414b29897bd738d1d0706ca2e76a7bc0324e2c6e1892e5dc96c49532712e6b73dbb97f0a8f02e08bc68755dffcbbf9bb206956a7fd58587

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
70c143555e278879e07f83a21749c537

SHA1
678a6f0cb87088499915c29e17dd99feaba3ceac

SHA256
97e884662cc3a41aa50dea46175e57cb38c62a9d739afdfbbaa5bbf04709f62d

SHA512
ba0fc63e3d6313176756c3684a9762acada716cc98442537d3ae5a2a15b320accaf79e0412fd6b9a8016cfe4e558ef73b771e7a8656b791808e0cca8ea0fb784

Download Submit