f98bf8b12a0d0a4917ab32bc6cc68e3db67cf3856544ec77d08c33ac098dddb1

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 05:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df9c73e6d7baf8781b7bd67d05a6c2b6_JaffaCakes118.html
Size

182KB
MD5

df9c73e6d7baf8781b7bd67d05a6c2b6
SHA1

222684909163eecd555a27db94f582c3b342a4aa
SHA256

f98bf8b12a0d0a4917ab32bc6cc68e3db67cf3856544ec77d08c33ac098dddb1
SHA512

8df1a500a8b008893ba24a14312ba17f967abd200f27b9256a66ae158bda15d256bf27d293b3f366cf63dfcbfc8ab70ae6101d9aa11c8f054826f15dc36c30e4
SSDEEP

3072:79fyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFiM:79qsMYod+X3oI+Yn86/U9jFiM

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
1936	msedge.exe
1936	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe
2860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 4700	1936	msedge.exe	83
PID 1936 wrote to memory of 4700	1936	msedge.exe	83
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4832	1936	msedge.exe	84
PID 1936 wrote to memory of 4432	1936	msedge.exe	85
PID 1936 wrote to memory of 4432	1936	msedge.exe	85
PID 1936 wrote to memory of 4548	1936	msedge.exe	86
PID 1936 wrote to memory of 4548	1936	msedge.exe	86
PID 1936 wrote to memory of 4548	1936	msedge.exe	86
PID 1936 wrote to memory of 4548	1936	msedge.exe	86
PID 1936 wrote to memory of 4548	1936	msedge.exe	86
PID 1936 wrote to memory of 4548	1936	msedge.exe	86
PID 1936 wrote to memory of 4548	1936	msedge.exe	86
PID 1936 wrote to memory of 4548	1936	msedge.exe	86
PID 1936 wrote to memory of 4548	1936	msedge.exe	86
PID 1936 wrote to memory of 4548	1936	msedge.exe	86
PID 1936 wrote to memory of 4548	1936	msedge.exe	86
PID 1936 wrote to memory of 4548	1936	msedge.exe	86
PID 1936 wrote to memory of 4548	1936	msedge.exe	86
PID 1936 wrote to memory of 4548	1936	msedge.exe	86
PID 1936 wrote to memory of 4548	1936	msedge.exe	86
PID 1936 wrote to memory of 4548	1936	msedge.exe	86
PID 1936 wrote to memory of 4548	1936	msedge.exe	86
PID 1936 wrote to memory of 4548	1936	msedge.exe	86
PID 1936 wrote to memory of 4548	1936	msedge.exe	86
PID 1936 wrote to memory of 4548	1936	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\df9c73e6d7baf8781b7bd67d05a6c2b6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff969e246f8,0x7ff969e24708,0x7ff969e24718
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,12929786586746774590,133527182776704668,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,12929786586746774590,133527182776704668,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,12929786586746774590,133527182776704668,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12929786586746774590,133527182776704668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12929786586746774590,133527182776704668,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,12929786586746774590,133527182776704668,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4948 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
99a03de91e2ca1249b9e5d7c0bc2c870

SHA1
314367e739b60811684c60f388d2564f28cd7ba0

SHA256
a7e3ce7447d8d42312c216ab012e923c03e52b31d566dbff5cef13eb1a88b4db

SHA512
f4d322a79e25e3e85b7e4c62036010eb2910ee37260dcd4d288f01a601d8515b3cbcc01e35eaa644d2d907a6753446a3076253e1d6fc0a3a57fcb2cf806e3936

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
25c0d8756693d05abba0adee96755ed2

SHA1
d7d186b357ab8534fa8854ebbdb0bbb9f45c3ac3

SHA256
c7281381615642025504e1c34bd246821f8ac41a6c56f8367b596f3c3a2d8f58

SHA512
8a837ae0f8a162f320072797ba7029b219d4339e166a69445ffd16dd21a7846d4a343dbeaa8694c55672879c523e466b8b0b2f9599b868034ca9c32c5b46b1cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0faeea196e2a7967db088c8241c5110e

SHA1
df4fb2c7abb072cb40bb51d478f427d1a819baab

SHA256
4a9717bff998c1abeafa011473df2f3615ce0d107feec39ef5a80d798a57285e

SHA512
2654edf7fe35621f0641672e12e688ac9f4c4687315ab02980d1d7fa4a114118b6d334b1700445627ad338414f0aeaa140ecb16a3e816a51560462572b7d41f1

Download Submit