af9b7cfc801cf371ddd4ece57d75ab96910bc3a8c04f73bd32b2bf7a34988072

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2024 14:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da15b0e6085856d6a895d266de7c6b97_JaffaCakes118.html
Size

120KB
MD5

da15b0e6085856d6a895d266de7c6b97
SHA1

3f68ccd2796c34c46aed9f60376cb6c47a8ac184
SHA256

af9b7cfc801cf371ddd4ece57d75ab96910bc3a8c04f73bd32b2bf7a34988072
SHA512

82f6408202c4f47d669499eb1c55d547c652b48f06eb6877ad7cdeda71c74751cfe3b0185ff991ffb399169f56dd30bee9e1798f32555492a0a659b218e591bd
SSDEEP

3072:SQYCijFMjyfkMY+BES09JXAnyrZalI+YQ:SQYCijFMGsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2100	msedge.exe
2100	msedge.exe
728	msedge.exe
728	msedge.exe
3540	identity_helper.exe
3540	identity_helper.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 5068	728	msedge.exe	84
PID 728 wrote to memory of 5068	728	msedge.exe	84
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 4476	728	msedge.exe	85
PID 728 wrote to memory of 2100	728	msedge.exe	86
PID 728 wrote to memory of 2100	728	msedge.exe	86
PID 728 wrote to memory of 2140	728	msedge.exe	87
PID 728 wrote to memory of 2140	728	msedge.exe	87
PID 728 wrote to memory of 2140	728	msedge.exe	87
PID 728 wrote to memory of 2140	728	msedge.exe	87
PID 728 wrote to memory of 2140	728	msedge.exe	87
PID 728 wrote to memory of 2140	728	msedge.exe	87
PID 728 wrote to memory of 2140	728	msedge.exe	87
PID 728 wrote to memory of 2140	728	msedge.exe	87
PID 728 wrote to memory of 2140	728	msedge.exe	87
PID 728 wrote to memory of 2140	728	msedge.exe	87
PID 728 wrote to memory of 2140	728	msedge.exe	87
PID 728 wrote to memory of 2140	728	msedge.exe	87
PID 728 wrote to memory of 2140	728	msedge.exe	87
PID 728 wrote to memory of 2140	728	msedge.exe	87
PID 728 wrote to memory of 2140	728	msedge.exe	87
PID 728 wrote to memory of 2140	728	msedge.exe	87
PID 728 wrote to memory of 2140	728	msedge.exe	87
PID 728 wrote to memory of 2140	728	msedge.exe	87
PID 728 wrote to memory of 2140	728	msedge.exe	87
PID 728 wrote to memory of 2140	728	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\da15b0e6085856d6a895d266de7c6b97_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff81e1e46f8,0x7ff81e1e4708,0x7ff81e1e4718
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,16604422146245178991,3683544154951612428,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,16604422146245178991,3683544154951612428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,16604422146245178991,3683544154951612428,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16604422146245178991,3683544154951612428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16604422146245178991,3683544154951612428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,16604422146245178991,3683544154951612428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,16604422146245178991,3683544154951612428,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16604422146245178991,3683544154951612428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16604422146245178991,3683544154951612428,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16604422146245178991,3683544154951612428,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16604422146245178991,3683544154951612428,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,16604422146245178991,3683544154951612428,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3064 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f93b1245f4ced200a6bff573062830e4

SHA1
bf9bbabb3d8ff1d7dbb7198da64ebb2522d01172

SHA256
23a0084914230858a1c7c298403f079bd1be9a91f4c598b11018b1ff2034e25c

SHA512
d5febaef3b6ba5226f083d80efb2b86145f0f12dab628548e24b9a68a8430ff24085ab9bc7ba6873cbde711eb3f524c8701868b1159ce8952632d64b43dcc950

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3896ff87982615341b2779b5b025f0dc

SHA1
936b76741fdeaba157410111edba09e40c1500b9

SHA256
d30731ab187be464687eec4e8217cd5f947877249e2a63f528583b456f49d227

SHA512
8ce190fc189a1e482df1d3989b5734ce8d104b18b28a2f208ffee8d993db7802df536fe8f08448c6f2087cffc8b4d7b4b3977ce5f8d44dd67917c10bf84d6c6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
143bf12d7ffb69216066c3ab42ecf8d6

SHA1
232c357f0992f1ffad50301d446d9f04897acf7d

SHA256
6a4e1bdbc90c599f406453ef19f4a35e0211e0026c97f2c0fe70d3da7afea315

SHA512
ba683bdcfc55de21b5a7c25a1938b5ab1898a5cf61ba5f057de929ddc61716b44372cb2bac1a9175b706e9865f2ee736759889c7d0460092e3fce8d298c0a21d

Download Submit