e7efa2b477804f9673304748073046df75d6bd8f25602dc2dab60f9bd5f6b1a0

Analysis

max time kernel
145s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 12:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa63c9df8855bacbce46d2baa2b7dc4f_JaffaCakes118.html
Size

460KB
MD5

fa63c9df8855bacbce46d2baa2b7dc4f
SHA1

38c87664f3235b081eac3b5922ed4bad8ee0b55b
SHA256

e7efa2b477804f9673304748073046df75d6bd8f25602dc2dab60f9bd5f6b1a0
SHA512

30a1497fb5290a2d16416fad849fe5523b2f5477b32335508c57972d2da2dfc9f2ad05d77c1ac51eaa122053901e4cba0a4287b67eeaa48e758a231e9c9d09a5
SSDEEP

6144:SXsMYod+X3oI+YwsMYod+X3oI+YKsMYod+X3oI+YLsMYod+X3oI+YQ:Y5d+X3Y5d+X3u5d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
2988	msedge.exe
2988	msedge.exe
3364	identity_helper.exe
3364	identity_helper.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe
2988	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 464	2988	msedge.exe	82
PID 2988 wrote to memory of 464	2988	msedge.exe	82
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 5112	2988	msedge.exe	83
PID 2988 wrote to memory of 4700	2988	msedge.exe	84
PID 2988 wrote to memory of 4700	2988	msedge.exe	84
PID 2988 wrote to memory of 968	2988	msedge.exe	85
PID 2988 wrote to memory of 968	2988	msedge.exe	85
PID 2988 wrote to memory of 968	2988	msedge.exe	85
PID 2988 wrote to memory of 968	2988	msedge.exe	85
PID 2988 wrote to memory of 968	2988	msedge.exe	85
PID 2988 wrote to memory of 968	2988	msedge.exe	85
PID 2988 wrote to memory of 968	2988	msedge.exe	85
PID 2988 wrote to memory of 968	2988	msedge.exe	85
PID 2988 wrote to memory of 968	2988	msedge.exe	85
PID 2988 wrote to memory of 968	2988	msedge.exe	85
PID 2988 wrote to memory of 968	2988	msedge.exe	85
PID 2988 wrote to memory of 968	2988	msedge.exe	85
PID 2988 wrote to memory of 968	2988	msedge.exe	85
PID 2988 wrote to memory of 968	2988	msedge.exe	85
PID 2988 wrote to memory of 968	2988	msedge.exe	85
PID 2988 wrote to memory of 968	2988	msedge.exe	85
PID 2988 wrote to memory of 968	2988	msedge.exe	85
PID 2988 wrote to memory of 968	2988	msedge.exe	85
PID 2988 wrote to memory of 968	2988	msedge.exe	85
PID 2988 wrote to memory of 968	2988	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fa63c9df8855bacbce46d2baa2b7dc4f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8d7d46f8,0x7ffd8d7d4708,0x7ffd8d7d4718
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6008261989228263259,17248063776072563211,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,6008261989228263259,17248063776072563211,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,6008261989228263259,17248063776072563211,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:8
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6008261989228263259,17248063776072563211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6008261989228263259,17248063776072563211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6008261989228263259,17248063776072563211,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6008261989228263259,17248063776072563211,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6008261989228263259,17248063776072563211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6008261989228263259,17248063776072563211,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6008261989228263259,17248063776072563211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6008261989228263259,17248063776072563211,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6008261989228263259,17248063776072563211,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3004 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7207869700fc48f2f967fd58a2ca5b93

SHA1
9ea4c6750774fe9e64d715b3ea7a43cf42652f33

SHA256
64f202be424f3d5b0f09ad110fccf76b6e7b262ea6a3805e835480a86ade4a99

SHA512
a9e01e697fdd1ee8bef0bd9f7ef0a758cada7a1d704cfbc4a471cf800dd48e5f1e3b5814bbb921eb8a0dc1cc249ace019324e4ad4ac2170f54b73964302e5cc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
33268bdf91b42977374298ead55331b7

SHA1
ad552578c39df96da5ef0ba99ee21b28795ab226

SHA256
7d7e19f30fe7337fbf7e0f58b7ece0ac2878c22366a177fe8ad7d413c3954034

SHA512
aa63f530e08a57e00544f92df71db1847f4cce5baee2c56aa5b3bfa0118893057791ceb01b07004abcc0d1f2ecb30640cec1f284005d5dd17d03c4efae219ba5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
46d578f05c243dcb56c9d5274c7eb221

SHA1
27043efbd2e89aa92924a5a3cfb15efeed6eaa61

SHA256
773c9c72c2f9a41710d1ea4c156707e9ff4e635a69d65f536d87a1bdc113b1ad

SHA512
d988afdf6be3b0f26b01d795a9ef836883e7a0ee9bb0b7d785372977bec8f22e933970e81b53ddaf10fca8987778c53c11e96c4dcd72e879ac0ee51db8d0f184

Download Submit