e9c7130dda6f71535182c1afa621743c6a2ed4a7e6e4f83a9bca135deca67dc6

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 02:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f9960487f7b3c92d692f3b557794ad9b_JaffaCakes118.html
Size

181KB
MD5

f9960487f7b3c92d692f3b557794ad9b
SHA1

d5b33ece67f1dadd303103e3fe95d04423532dbe
SHA256

e9c7130dda6f71535182c1afa621743c6a2ed4a7e6e4f83a9bca135deca67dc6
SHA512

21eecff6e4e16b8943d72b10473f49f8d913f6b662f9faa28a05f570fa80b7b763b363636ccb5d9747fc3f4cc9e75411479ecc366655a20520e38d4e92d99019
SSDEEP

3072:2Q6VYlYd8G2bpblgoYaDLOuU6XHPEiqSEuOs8s/gG7A6WCfFUIVvo:2Q6VWbpbDv6s0N

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
1624	msedge.exe
1624	msedge.exe
2028	identity_helper.exe
2028	identity_helper.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2172	1624	msedge.exe	81
PID 1624 wrote to memory of 2172	1624	msedge.exe	81
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 4900	1624	msedge.exe	82
PID 1624 wrote to memory of 540	1624	msedge.exe	83
PID 1624 wrote to memory of 540	1624	msedge.exe	83
PID 1624 wrote to memory of 1576	1624	msedge.exe	84
PID 1624 wrote to memory of 1576	1624	msedge.exe	84
PID 1624 wrote to memory of 1576	1624	msedge.exe	84
PID 1624 wrote to memory of 1576	1624	msedge.exe	84
PID 1624 wrote to memory of 1576	1624	msedge.exe	84
PID 1624 wrote to memory of 1576	1624	msedge.exe	84
PID 1624 wrote to memory of 1576	1624	msedge.exe	84
PID 1624 wrote to memory of 1576	1624	msedge.exe	84
PID 1624 wrote to memory of 1576	1624	msedge.exe	84
PID 1624 wrote to memory of 1576	1624	msedge.exe	84
PID 1624 wrote to memory of 1576	1624	msedge.exe	84
PID 1624 wrote to memory of 1576	1624	msedge.exe	84
PID 1624 wrote to memory of 1576	1624	msedge.exe	84
PID 1624 wrote to memory of 1576	1624	msedge.exe	84
PID 1624 wrote to memory of 1576	1624	msedge.exe	84
PID 1624 wrote to memory of 1576	1624	msedge.exe	84
PID 1624 wrote to memory of 1576	1624	msedge.exe	84
PID 1624 wrote to memory of 1576	1624	msedge.exe	84
PID 1624 wrote to memory of 1576	1624	msedge.exe	84
PID 1624 wrote to memory of 1576	1624	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f9960487f7b3c92d692f3b557794ad9b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9da7946f8,0x7ff9da794708,0x7ff9da794718
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7852450165748449542,4313560828452489112,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,7852450165748449542,4313560828452489112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,7852450165748449542,4313560828452489112,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7852450165748449542,4313560828452489112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7852450165748449542,4313560828452489112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7852450165748449542,4313560828452489112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7852450165748449542,4313560828452489112,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7852450165748449542,4313560828452489112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7852450165748449542,4313560828452489112,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7852450165748449542,4313560828452489112,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7852450165748449542,4313560828452489112,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7852450165748449542,4313560828452489112,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5700 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
180B

MD5
e75179806fdb60b3337e8cd5b04cd6cf

SHA1
434a695c7607996cc4d1a0698d9214afe4d9fd38

SHA256
a121c6f8b11a0682ab639049f50ef2a1b00b3a2a565d7686cc64f501056b7b19

SHA512
e1e2f888005696fb33453f369efda963c71c15270338db02d812a1ad503c1dfd2a0f693c3f6a02ca2abb7cad631524b0481141646353c7b39adf44b09bf8464f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fd1107151e88dd5c1dd4d1bedaadf99d

SHA1
df437258f1aa5f502d4fea1485a582f15357cf05

SHA256
abdade86ad4302e2e628a0beb19b05860fd1d903c2202bb84f3d04e7544a9e17

SHA512
90b003e168f3b23f710c7f5fee9947e875be2e225aa096e6a3cede28008edc3881922c7f195ad8419d779169a8976627226d14e176622e729508a65f523cf28f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
106cd2650ea2a1c65c8f2b7c8c400d52

SHA1
c66fc11270f9fada9a7736722ff0a53102189dd9

SHA256
94b4bb92303077f950c36cdbd71ba24ec238eb19e4d9a86943a8817a9a9df1cd

SHA512
a8cbfe54b2052abc43238a2b18f1356b52ea8371b43b3dd1bda60fd59cbe81bd8abd2c005b4ef6584a07e7a2633fd43557218510aacaada90b8810964b9fb01c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2b3d3eb41f95aca030477e4f24860c77

SHA1
4a9f9fb94a2a2944d808d710f65a664822890080

SHA256
a4ae2d026232948a6b5dbd8328e6013288d6ca4d6e318b706fb7bdfada85227b

SHA512
542a8cbc714056e9aaad539253e75636baaf360d6fe0f289bf782af16c06aebb287ff66d98f77d449decf64dc9eae96b78cc98fab9997032ec5bb628f2d3e945

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
3d8cc969a400edeaf12b04275027bfb4

SHA1
55c5e2284804aa376e4416a239299c96c3762138

SHA256
4030e72a275bf75e7b479569c5caab4051295d906e432e274ab3d1190822cef3

SHA512
fdb375ec39fab5bd582f5c6b17ad9e5fabe16f331765207d19425c91c2cbbeec396f0ffbf1e94322ba0e12e75bc58e117fbac92e60652adbdddb1a80fe7d9ae6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58e46f.TMP

Filesize
372B

MD5
8427462c2ae6e47d5dba4f56c314b981

SHA1
92886f379ccc828c440504eed279e3abb18cf4f6

SHA256
7d3c3b52c5a8241955d63a651713ae6cdb2f61ada2900c79f50e78ad97339277

SHA512
861e055c92e685c2f0c7d1922180b2933860a468a1747c367ae43d61ee9503d24a279552e9815d30b7e0cf76d94ecfb0c132789cc175b1c554f5c9b665724260

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1646ba8bf31e4418b2f6a8828b3aa6ff

SHA1
9c5dcee72ce95d9e9506f2dcf454d03530a20e09

SHA256
705c3048e9c4dd85012dc32cd2258787deeb190f1dba34241544c84818874aa3

SHA512
87a18d6aad21b4830e4869730d53ccc82c2bc303ffa64ecb65027ddcd33cc412a7fc032be240fa8b6ab5fbbde44cf5039524c02563f08a3d937ce72f7ab95631

Download Submit