93204e1aaf82753d366bf9574ad7f9cb80cb08ae728ce4fbbfe7a1e3412c0c44

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2024 02:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6da38bd6a94c668d39fc00e64cc469e_JaffaCakes118.html
Size

157KB
MD5

f6da38bd6a94c668d39fc00e64cc469e
SHA1

69a620dbe378b629bd81191ce3bd046118a0abd1
SHA256

93204e1aaf82753d366bf9574ad7f9cb80cb08ae728ce4fbbfe7a1e3412c0c44
SHA512

bf76f4c2b9895c9b5d8546b46323d6844448176687d4e3f2bf02eb9d70510e51c66d39ccfe266c6c5743ad4e8a2724bf66b1d00d685ca9a76f15b4ae2d60031f
SSDEEP

3072:iv2ZWSM7dyfkMY+BES09JXAnyrZalI+YQ:iuZ07osMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
116	msedge.exe
116	msedge.exe
2324	msedge.exe
2324	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
864	identity_helper.exe
864	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 1968	2324	msedge.exe	83
PID 2324 wrote to memory of 1968	2324	msedge.exe	83
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 4356	2324	msedge.exe	84
PID 2324 wrote to memory of 116	2324	msedge.exe	85
PID 2324 wrote to memory of 116	2324	msedge.exe	85
PID 2324 wrote to memory of 1496	2324	msedge.exe	86
PID 2324 wrote to memory of 1496	2324	msedge.exe	86
PID 2324 wrote to memory of 1496	2324	msedge.exe	86
PID 2324 wrote to memory of 1496	2324	msedge.exe	86
PID 2324 wrote to memory of 1496	2324	msedge.exe	86
PID 2324 wrote to memory of 1496	2324	msedge.exe	86
PID 2324 wrote to memory of 1496	2324	msedge.exe	86
PID 2324 wrote to memory of 1496	2324	msedge.exe	86
PID 2324 wrote to memory of 1496	2324	msedge.exe	86
PID 2324 wrote to memory of 1496	2324	msedge.exe	86
PID 2324 wrote to memory of 1496	2324	msedge.exe	86
PID 2324 wrote to memory of 1496	2324	msedge.exe	86
PID 2324 wrote to memory of 1496	2324	msedge.exe	86
PID 2324 wrote to memory of 1496	2324	msedge.exe	86
PID 2324 wrote to memory of 1496	2324	msedge.exe	86
PID 2324 wrote to memory of 1496	2324	msedge.exe	86
PID 2324 wrote to memory of 1496	2324	msedge.exe	86
PID 2324 wrote to memory of 1496	2324	msedge.exe	86
PID 2324 wrote to memory of 1496	2324	msedge.exe	86
PID 2324 wrote to memory of 1496	2324	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\f6da38bd6a94c668d39fc00e64cc469e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb566e46f8,0x7ffb566e4708,0x7ffb566e4718
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,1509360180427989927,10078181348536144512,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,1509360180427989927,10078181348536144512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,1509360180427989927,10078181348536144512,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1509360180427989927,10078181348536144512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1509360180427989927,10078181348536144512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,1509360180427989927,10078181348536144512,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4236 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,1509360180427989927,10078181348536144512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3140 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,1509360180427989927,10078181348536144512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1509360180427989927,10078181348536144512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1509360180427989927,10078181348536144512,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1509360180427989927,10078181348536144512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,1509360180427989927,10078181348536144512,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
605259837f67361ee9f5d2cefb05f7f4

SHA1
eb9ab9076b5ff3d2cc5b3b45dac73805dfde0a9e

SHA256
4c327e2fc0dd093f23bbb1c50b8406e8acad3d63fe7e238e865f570f28741fe6

SHA512
9161f40adb1b0ca8371302fd2b0a5cf953e6580c5d94bcad3be5c639596cb28ed34a5e0f1afadad4af56fef592e18ae4fdd8b2c2f1e8199c66bd06a23b50bcbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
83484a30badd9ce3474faa391fa906d6

SHA1
ebd729f694e4b8f2fd6f5448a4c4a643a73eea4f

SHA256
68dc01a93aa92e2d391ea8fdb0580dcf78f059465f139e17bb39e6ff0e053a72

SHA512
cf823fd85f9c42ad3c84b4d82cb7846b979f61b5059b62ca404ce6f0ab1aa5914779f1843aa7af26c0ea3c0884476a8113d13a5acdd0a286ec8e08d34b4b1181

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c90e0ef217577e4416d21449d8737ebc

SHA1
2a4226d56d69e9121d8d4d58234885803440bdcc

SHA256
1fa3213f1394d77c7f5f2abe21c5ef43125ba95223950e4aa91ece14a903ae45

SHA512
08f37c126fee63cfb50c4dab0828635d66256d42777c7f6c3a17b5ee1021320c8bf885ba28f385cb95feb1c974d1473f5eb806d625b5232da6b93456bb653a41

Download Submit