86b8c17a03ec75cde159c297db7f81697b00fec410237a4328aaffe80800f70c

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f9b60cc65c19de8ecc90c22010c80aff_JaffaCakes118.html
Size 72KB
Sample240927-e5j57avfqp
SHA256 86b8c17a03ec75cde159c297db7f81697b00fec410237a4328aaffe80800f70c
MD5 f9b60cc65c19de8ecc90c22010c80aff
SHA1 2ffae70f4c774d39cb5f91a905d8184381e1e055
SHA512 c2f48786f4470361202b358176f7039897c08af679a31da8ebf9d0c483ba266035810523610dc1f16c315a53819ee683d651aed93e937baad9f6dcf840b51e7a
SSDEEP 1536:HT2lxXK2JgwDobfPO5XwybngwrNKuXXVGwHfpQlfSDs/8DGUqvzA26lwafqZMOgA:HOxXK2JgMkfPO5XwybngwrNKuXXVGwHc
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
1512	msedge.exe
1512	msedge.exe
1632	identity_helper.exe
1632	identity_helper.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1492	1512	msedge.exe	82
PID 1512 wrote to memory of 1492	1512	msedge.exe	82
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 4824	1512	msedge.exe	83
PID 1512 wrote to memory of 3772	1512	msedge.exe	84
PID 1512 wrote to memory of 3772	1512	msedge.exe	84
PID 1512 wrote to memory of 2360	1512	msedge.exe	85
PID 1512 wrote to memory of 2360	1512	msedge.exe	85
PID 1512 wrote to memory of 2360	1512	msedge.exe	85
PID 1512 wrote to memory of 2360	1512	msedge.exe	85
PID 1512 wrote to memory of 2360	1512	msedge.exe	85
PID 1512 wrote to memory of 2360	1512	msedge.exe	85
PID 1512 wrote to memory of 2360	1512	msedge.exe	85
PID 1512 wrote to memory of 2360	1512	msedge.exe	85
PID 1512 wrote to memory of 2360	1512	msedge.exe	85
PID 1512 wrote to memory of 2360	1512	msedge.exe	85
PID 1512 wrote to memory of 2360	1512	msedge.exe	85
PID 1512 wrote to memory of 2360	1512	msedge.exe	85
PID 1512 wrote to memory of 2360	1512	msedge.exe	85
PID 1512 wrote to memory of 2360	1512	msedge.exe	85
PID 1512 wrote to memory of 2360	1512	msedge.exe	85
PID 1512 wrote to memory of 2360	1512	msedge.exe	85
PID 1512 wrote to memory of 2360	1512	msedge.exe	85
PID 1512 wrote to memory of 2360	1512	msedge.exe	85
PID 1512 wrote to memory of 2360	1512	msedge.exe	85
PID 1512 wrote to memory of 2360	1512	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f9b60cc65c19de8ecc90c22010c80aff_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff92ff946f8,0x7ff92ff94708,0x7ff92ff94718
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11341154298110789705,14022721559852732012,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,11341154298110789705,14022721559852732012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,11341154298110789705,14022721559852732012,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11341154298110789705,14022721559852732012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11341154298110789705,14022721559852732012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11341154298110789705,14022721559852732012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11341154298110789705,14022721559852732012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11341154298110789705,14022721559852732012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11341154298110789705,14022721559852732012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11341154298110789705,14022721559852732012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11341154298110789705,14022721559852732012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11341154298110789705,14022721559852732012,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2772 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4
MD5 9e3fc58a8fb86c93d19e1500b873ef6f
SHA1 c6aae5f4e26f5570db5e14bba8d5061867a33b56
SHA512 e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de
MD5 27304926d60324abe74d7a4b571c35ea
SHA1 78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1
SHA512 f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 4e80d2531bfc4b11c945d901b93541ed89d2c1f71cd426309772386f588d1cef
MD5 fa7d67cc2e5fec39314f81b794c8b29c
SHA1 e1bc93a8c36a01b2fdf1574243d9d9145e0b7856
SHA512 67326a0907c389a9bfd8e411a8f7fee29e81fb6687a0533ed83618d4dbb3806c16aa0e99e40d76ea2600b33d6d59c0b6b6e8de7ae8959de774e611312b1ac615
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 c2e4b0926fc5a05bf6683b45e192bad70a48fbd7c617b8bf04d4b59167dabb96
MD5 7efa7d030dd4f0d43c644011aaf3eb28
SHA1 07478d663667b40136ee58508bbdfb29b8fe5ac7
SHA512 48362ef6c66e2bf2ff0a33a73a856d8f27a7d1cfee944bd6cf6b39edc02f2791bd07250aa46216802d56f8081cbaa01fde59af82250f3615db5027295652653f
SSDEEP 96:nsk/2d1h5wpvWMoiVmdeH4piNBVUWQyV+VDCziEwb:nsk/Wf5GWMX4kLVro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 30e3aaa1f275362694ad6c0a6564d50e8f3006f37a7cc1bfe3ab0a643067095e
MD5 7c0e832bd5b0c81cf5638f5253d2cb4a
SHA1 e60a9df53709d097c9489b35311ee50db26a4d70
SHA512 2b1adeb63d318ad3a9eaab243d1522692001032d9f6669e47a44e00fd48730d18e54c0d65a8dc232b470c44259993b55a09c028d525843c42dec28b650b7f479
SSDEEP 96:nsk/Ad1hRwpvWMoiVmdeHYo24piNBVUWQyV+VD7AiEwb:nsk/AfRGWMXYo24kLVrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 9aabdad06823cef82af277e49678cd57788e6af5ed5477c72773dd5af2a99e5b
MD5 f084dd10876aa2cb307091f86b417987
SHA1 265168dfc4014bf99a2b86d8f0f1c847ca5af735
SHA512 26d9042e750f0dba936d5d5d3332f893a7ac1407b8bd0af524cb917e80fde2e167196bddd2827a635eef25830ad7cdf44c7b2b24bfd17d374a844ed407692689
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupiUe2RUxpc8QhIcM/bo5Zxt:A9iIxuERzA83h09RZxYiakLnqZxt
MD5 SHA1 SHA512 SSDEEP

Submit Download