97cdb91248deb82d96b4f3571e8f13f4e456f2a9b364da5e969be07f7094874d

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2024 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd520826aac3402a02a96f3c53ce4caf_JaffaCakes118.html
Size

63KB
MD5

fd520826aac3402a02a96f3c53ce4caf
SHA1

e0b81a9dae7cb4cbe62e810b7da744752fc37319
SHA256

97cdb91248deb82d96b4f3571e8f13f4e456f2a9b364da5e969be07f7094874d
SHA512

2522f5aa9798f3a0c4123296003f5853e229f155573e43d665c898cc219f9b692fedaa2d6bdc0ec472e468c7008bae6335c735b142054f20229970cb109467b1
SSDEEP

768:Ji/gcMiz3sI2PDDZf0glJn6BWoTykyCZkoTnMdtbBnfBgN8/oi2c8QFVGys//IjC:JdUTTFec0tbrgaMc7NndC

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
4412	msedge.exe
4412	msedge.exe
3328	identity_helper.exe
3328	identity_helper.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 4308	4412	msedge.exe	82
PID 4412 wrote to memory of 4308	4412	msedge.exe	82
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 3692	4412	msedge.exe	83
PID 4412 wrote to memory of 2624	4412	msedge.exe	84
PID 4412 wrote to memory of 2624	4412	msedge.exe	84
PID 4412 wrote to memory of 4068	4412	msedge.exe	85
PID 4412 wrote to memory of 4068	4412	msedge.exe	85
PID 4412 wrote to memory of 4068	4412	msedge.exe	85
PID 4412 wrote to memory of 4068	4412	msedge.exe	85
PID 4412 wrote to memory of 4068	4412	msedge.exe	85
PID 4412 wrote to memory of 4068	4412	msedge.exe	85
PID 4412 wrote to memory of 4068	4412	msedge.exe	85
PID 4412 wrote to memory of 4068	4412	msedge.exe	85
PID 4412 wrote to memory of 4068	4412	msedge.exe	85
PID 4412 wrote to memory of 4068	4412	msedge.exe	85
PID 4412 wrote to memory of 4068	4412	msedge.exe	85
PID 4412 wrote to memory of 4068	4412	msedge.exe	85
PID 4412 wrote to memory of 4068	4412	msedge.exe	85
PID 4412 wrote to memory of 4068	4412	msedge.exe	85
PID 4412 wrote to memory of 4068	4412	msedge.exe	85
PID 4412 wrote to memory of 4068	4412	msedge.exe	85
PID 4412 wrote to memory of 4068	4412	msedge.exe	85
PID 4412 wrote to memory of 4068	4412	msedge.exe	85
PID 4412 wrote to memory of 4068	4412	msedge.exe	85
PID 4412 wrote to memory of 4068	4412	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fd520826aac3402a02a96f3c53ce4caf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff305346f8,0x7fff30534708,0x7fff30534718
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,4305695721064776338,6779853641548310878,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,4305695721064776338,6779853641548310878,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,4305695721064776338,6779853641548310878,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4305695721064776338,6779853641548310878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4305695721064776338,6779853641548310878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,4305695721064776338,6779853641548310878,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,4305695721064776338,6779853641548310878,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4305695721064776338,6779853641548310878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4305695721064776338,6779853641548310878,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4305695721064776338,6779853641548310878,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4305695721064776338,6779853641548310878,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,4305695721064776338,6779853641548310878,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5248 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9cf65b57631aa9a5a5e5eba4c702f8ea

SHA1
486eaa885482ddc7a18320b992f08d73ed145726

SHA256
e2459988f87901e2b8297597d542dd7d060b178fed7fa1a3a3bd1ec436a10ad7

SHA512
c08edc6ad4c552c463cc859dfbcbba10bcd3261bd3b9a43d33d1d2ad36044798c7b3aa0341be8212c44e9394f2a08c72d7d61ff1c58f30c8c03b9c127be4914d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bd3a01789219f97639c5053a18027b4c

SHA1
0e7ef2fe13c5c477af53e6da8682cd9b28cd9d7f

SHA256
7ec6b55e2b5b8f95022fe09f4e2e2b13b455491a297db9bf9dd4a32179a1b6c0

SHA512
ae0dbb99139b5bcb1efb99a2b152fd1b2ff327adacc4081ae39b7f9ac090d7ca85db6995ecca582979eefeb1460f196ef0c546f5d625e8173b0e6290299c91b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
77cd98b26e77912492825bc2a094f2d6

SHA1
e29676ed92710fc5e04faf5729a90c9f7dbf2986

SHA256
1c48935ec6a38a055bf2e7ae9094aff7b1cfcd7300d95c776e3807d5963df7e2

SHA512
2b2b6fb7fdad18f18dc33ef174d8ed4711c5a833ed7d2a606b62abda141ce7315c5f158b101b76e25e4a1fc22c3cde7aa2a1f642bcf365a0de393e9d03c2a0d5

Download Submit