f1f5c9f1ce219befaa0dd4268b8a721e7da5452a1215bfb603c34cc30f154c04

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f4ec4ff52a16c9c8bc57185113457e62_JaffaCakes118.html
Size 35KB
Sample240925-cd26ks1dne
SHA256 f1f5c9f1ce219befaa0dd4268b8a721e7da5452a1215bfb603c34cc30f154c04
MD5 f4ec4ff52a16c9c8bc57185113457e62
SHA1 be00c4e5077be8f62594298104fd3d6df56a6c44
SHA512 df6b3f0052736626dc4f2eea3fa54afb1407cfbffe0d090436a4163766ad092e3fabafdb3b009dcb9437de1826314e9ae9a2a1b4cc69002b5923fd1c59e46de7
SSDEEP 768:zwx/MDTHRJ88hAR6ZPXNE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TIZOf6sggf6lLRy:Q/7bJxNVNu0Sx/P8lK
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe
1552	msedge.exe
1552	msedge.exe
2580	identity_helper.exe
2580	identity_helper.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe
112	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 708	1552	msedge.exe	82
PID 1552 wrote to memory of 708	1552	msedge.exe	82
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3940	1552	msedge.exe	83
PID 1552 wrote to memory of 3924	1552	msedge.exe	84
PID 1552 wrote to memory of 3924	1552	msedge.exe	84
PID 1552 wrote to memory of 3588	1552	msedge.exe	85
PID 1552 wrote to memory of 3588	1552	msedge.exe	85
PID 1552 wrote to memory of 3588	1552	msedge.exe	85
PID 1552 wrote to memory of 3588	1552	msedge.exe	85
PID 1552 wrote to memory of 3588	1552	msedge.exe	85
PID 1552 wrote to memory of 3588	1552	msedge.exe	85
PID 1552 wrote to memory of 3588	1552	msedge.exe	85
PID 1552 wrote to memory of 3588	1552	msedge.exe	85
PID 1552 wrote to memory of 3588	1552	msedge.exe	85
PID 1552 wrote to memory of 3588	1552	msedge.exe	85
PID 1552 wrote to memory of 3588	1552	msedge.exe	85
PID 1552 wrote to memory of 3588	1552	msedge.exe	85
PID 1552 wrote to memory of 3588	1552	msedge.exe	85
PID 1552 wrote to memory of 3588	1552	msedge.exe	85
PID 1552 wrote to memory of 3588	1552	msedge.exe	85
PID 1552 wrote to memory of 3588	1552	msedge.exe	85
PID 1552 wrote to memory of 3588	1552	msedge.exe	85
PID 1552 wrote to memory of 3588	1552	msedge.exe	85
PID 1552 wrote to memory of 3588	1552	msedge.exe	85
PID 1552 wrote to memory of 3588	1552	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f4ec4ff52a16c9c8bc57185113457e62_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffee3946f8,0x7fffee394708,0x7fffee394718
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,14809048304254106780,12299127860128003930,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,14809048304254106780,12299127860128003930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,14809048304254106780,12299127860128003930,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14809048304254106780,12299127860128003930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14809048304254106780,12299127860128003930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,14809048304254106780,12299127860128003930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,14809048304254106780,12299127860128003930,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14809048304254106780,12299127860128003930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14809048304254106780,12299127860128003930,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14809048304254106780,12299127860128003930,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14809048304254106780,12299127860128003930,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,14809048304254106780,12299127860128003930,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
MD5 f9664c896e19205022c094d725f820b6
SHA1 f8f1baf648df755ba64b412d512446baf88c0184
SHA512 3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
MD5 847d47008dbea51cb1732d54861ba9c9
SHA1 f2099242027dccb88d6f05760b57f7c89d926c0d
SHA512 bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 613B
SHA256 b3a647dc650b730822e58fa2df41860b60c17155988a7fb3b2bf498c6233671b
MD5 3b1cf91e53ad7ec728fe4bddb83ae2ad
SHA1 6e937c7b392f6ab1e433a295783cf606d65b0fa7
SHA512 be54093262e6c0eb5409a032c5508b3ec5e2587472eb80363059894e41be36ace76ed2b70a3c86b08cd0fb3324a78626d596917edd66c1d178d66a3a338c59bf
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 746b262e35432ee32529801850564f45657e5997c41b1796ab39e9ee1d9b1603
MD5 86d631ddc3df38d784d25a471f257076
SHA1 f4d54267bb96b33b26f8c98889abd57f1d53e4b0
SHA512 ddad83cf4620e27e221938009cb69854cd85482cd8985a995cd9b073ebceed5941c811cc6d7315d6b31184081fd2a873481a6add5c201d2c9b3eecfe63ebf1cb
SSDEEP 96:nqk/Mox1IfOrwpvWMoiVmdeEi8224s5cUWQyV+VD7AiEwb:nqk/LaKGWMt822crg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 114c353bab95f93923d6f0bb65216baa6d55b0f4748f1e85a7a565665cef8e18
MD5 bafd026cc344bd11a958340266e54eb3
SHA1 4ff7a6f840c2b0fba90e704c1afd77ce03191187
SHA512 361b1e72478dfac88f454a78020ca7d385e5036d6c0630841f3cc3f5f845b43e6e6163a75b548f48ece4d39b918b59ef9bedba7d3f9bc97e7a5b4b304865667d
SSDEEP 96:nqk/hx1IXOrwpvWMoiVmdeH4s5cUWQyV+VDCziEwb:nqk/jaCGWMXcro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 4eea2164c5019e65bb963dcec7f7dcf6baf193edecd5f304cb76ddaf47d5797b
MD5 53f9fb02d9eceb62535ac06ec9244228
SHA1 7f9a39aa0f6b777a898496c07fb86f9d37b67fe0
SHA512 731151dc1fff4bd757e100aa0bdc51a89d41c8d96f9406d58601584831cc343d9c780b7d0f7128f346de6ce00bec895fb91a11c3a3c8d9538a20e4a436b51f03
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupOQe2RUXi6nIcM/bo5ZxT:A9iIxuERzA83h09RZxYx8YqZxT
MD5 SHA1 SHA512 SSDEEP

Submit Download