e9954a919c990df2408f026b71516a8edc277167b30b7bffbdfd90700fcd731d

Analysis

max time kernel
139s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-12-2024 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

deb6f9bb8bc77338e64fd047810bc6ef_JaffaCakes118.html
Size

156KB
MD5

deb6f9bb8bc77338e64fd047810bc6ef
SHA1

9c7654a5c91e03afb2a405f5f93297c3623f9f63
SHA256

e9954a919c990df2408f026b71516a8edc277167b30b7bffbdfd90700fcd731d
SHA512

17a5aea96d20f8ad5c644cc11be03f18114486d25d10fac67f40589df1fdb9aca2f19d76f2f163b058f2c87e8fdcc7bdabb3523a0240824c3a25a51765ac4764
SSDEEP

1536:igRTITj/4xj3vr2ZIyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3p:iKZvwIyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
2332	msedge.exe
2332	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
1628	identity_helper.exe
1628	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 3920	2332	msedge.exe	82
PID 2332 wrote to memory of 3920	2332	msedge.exe	82
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3100	2332	msedge.exe	83
PID 2332 wrote to memory of 3424	2332	msedge.exe	84
PID 2332 wrote to memory of 3424	2332	msedge.exe	84
PID 2332 wrote to memory of 1588	2332	msedge.exe	85
PID 2332 wrote to memory of 1588	2332	msedge.exe	85
PID 2332 wrote to memory of 1588	2332	msedge.exe	85
PID 2332 wrote to memory of 1588	2332	msedge.exe	85
PID 2332 wrote to memory of 1588	2332	msedge.exe	85
PID 2332 wrote to memory of 1588	2332	msedge.exe	85
PID 2332 wrote to memory of 1588	2332	msedge.exe	85
PID 2332 wrote to memory of 1588	2332	msedge.exe	85
PID 2332 wrote to memory of 1588	2332	msedge.exe	85
PID 2332 wrote to memory of 1588	2332	msedge.exe	85
PID 2332 wrote to memory of 1588	2332	msedge.exe	85
PID 2332 wrote to memory of 1588	2332	msedge.exe	85
PID 2332 wrote to memory of 1588	2332	msedge.exe	85
PID 2332 wrote to memory of 1588	2332	msedge.exe	85
PID 2332 wrote to memory of 1588	2332	msedge.exe	85
PID 2332 wrote to memory of 1588	2332	msedge.exe	85
PID 2332 wrote to memory of 1588	2332	msedge.exe	85
PID 2332 wrote to memory of 1588	2332	msedge.exe	85
PID 2332 wrote to memory of 1588	2332	msedge.exe	85
PID 2332 wrote to memory of 1588	2332	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\deb6f9bb8bc77338e64fd047810bc6ef_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc45246f8,0x7ffdc4524708,0x7ffdc4524718
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,8976305644871795443,16661585645079356979,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,8976305644871795443,16661585645079356979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,8976305644871795443,16661585645079356979,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8976305644871795443,16661585645079356979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8976305644871795443,16661585645079356979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,8976305644871795443,16661585645079356979,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5100 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,8976305644871795443,16661585645079356979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,8976305644871795443,16661585645079356979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8976305644871795443,16661585645079356979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8976305644871795443,16661585645079356979,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8976305644871795443,16661585645079356979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8976305644871795443,16661585645079356979,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:1776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
91fef4e60290957076561926a066f163

SHA1
a757ecafa96aa43cb073603a7a26450674eb7fd6

SHA256
6663f1205e544856c1fbf8478de7b83331edeb51d6b8b1078e591de7c3725ca7

SHA512
723d70d2c3ede778f387b768c6b7b6ca009397ccf45fe6d69e9dbef53ffa1e47ae51c3e6bc53407f0889765c99f2fbf5ff78f815e6d4b9af5399d0a612845627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c7aa5304b14d0d0ee09942e581c8e652

SHA1
f8264d1e749add15763737e0a74ef06b87c94303

SHA256
9653e7c7c094e3591e0e77e9ba433e3b2f9e5e781824976a87878694551d3556

SHA512
f0098f0fd938b1323c19e9e114f66a6cda34fadbe744d4ad22a72462944dcfee295c56265f087232e139b1d46007589eb8901413f5e98a8b4bde46ec6a361de9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ac14c11447dfac8ba41f70d40127829e

SHA1
875cda9f01200ba86468544c64b65cf7d767e110

SHA256
353c3a9bfd92982f35dcf8defac8a8fbb94a75a9a04fb6fec131b6dbec2b6bb0

SHA512
b0605011b17cf0349b36a0a3b63a38bba74ea20eb7f90c7c3d54168b7a45392f3922bb7d39e6c74ca591f67cddfe588c7b83ca2d27ef4553d254fbf11d123acb

Download Submit