f2f34647f683f6cd8a510783777ff658d3d1749b75af2879a306bdb6588fff1f

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 00:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb2b765d30d5838298b5689a8a578766_JaffaCakes118.html
Size

5KB
MD5

fb2b765d30d5838298b5689a8a578766
SHA1

b1d49b6d0e7b5b020e17ec051fbe280ad165d4f4
SHA256

f2f34647f683f6cd8a510783777ff658d3d1749b75af2879a306bdb6588fff1f
SHA512

3b698d90e9900a307b4af9ecc304f18d5ab9fd136e3b347a4966a9727a801792fa8a7f9efab8987fb6791f8a3dc0a5c8f4193edc17252f800dfd59a104cb3173
SSDEEP

96:4+BYYr1SxdcobsOyGx/Jqnql6RT04Xb/8tU6K:/Yaob1y2xcqEdPrxL

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
1120	msedge.exe
1120	msedge.exe
3556	identity_helper.exe
3556	identity_helper.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 2476	1120	msedge.exe	82
PID 1120 wrote to memory of 2476	1120	msedge.exe	82
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 4964	1120	msedge.exe	83
PID 1120 wrote to memory of 1416	1120	msedge.exe	84
PID 1120 wrote to memory of 1416	1120	msedge.exe	84
PID 1120 wrote to memory of 1560	1120	msedge.exe	85
PID 1120 wrote to memory of 1560	1120	msedge.exe	85
PID 1120 wrote to memory of 1560	1120	msedge.exe	85
PID 1120 wrote to memory of 1560	1120	msedge.exe	85
PID 1120 wrote to memory of 1560	1120	msedge.exe	85
PID 1120 wrote to memory of 1560	1120	msedge.exe	85
PID 1120 wrote to memory of 1560	1120	msedge.exe	85
PID 1120 wrote to memory of 1560	1120	msedge.exe	85
PID 1120 wrote to memory of 1560	1120	msedge.exe	85
PID 1120 wrote to memory of 1560	1120	msedge.exe	85
PID 1120 wrote to memory of 1560	1120	msedge.exe	85
PID 1120 wrote to memory of 1560	1120	msedge.exe	85
PID 1120 wrote to memory of 1560	1120	msedge.exe	85
PID 1120 wrote to memory of 1560	1120	msedge.exe	85
PID 1120 wrote to memory of 1560	1120	msedge.exe	85
PID 1120 wrote to memory of 1560	1120	msedge.exe	85
PID 1120 wrote to memory of 1560	1120	msedge.exe	85
PID 1120 wrote to memory of 1560	1120	msedge.exe	85
PID 1120 wrote to memory of 1560	1120	msedge.exe	85
PID 1120 wrote to memory of 1560	1120	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fb2b765d30d5838298b5689a8a578766_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c8c046f8,0x7ff9c8c04708,0x7ff9c8c04718
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,2072498660462927014,10017783309550311009,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,2072498660462927014,10017783309550311009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,2072498660462927014,10017783309550311009,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2072498660462927014,10017783309550311009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2072498660462927014,10017783309550311009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2072498660462927014,10017783309550311009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,2072498660462927014,10017783309550311009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,2072498660462927014,10017783309550311009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2072498660462927014,10017783309550311009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2072498660462927014,10017783309550311009,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2072498660462927014,10017783309550311009,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2072498660462927014,10017783309550311009,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,2072498660462927014,10017783309550311009,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
90195c8a88b609acef7c5f867c290f1a

SHA1
a2303a0a658ab78ee430c26bdeefb5afec338cfb

SHA256
a14f2935a87a4089a5d6275c23239e9310a4ae302e8c295e839c767513289a97

SHA512
49624583e2795de433c348af4fa3751e5982c8959f183009b53bfe8fa4da722544d65231cd1386f5263ea4371567c61704f795cac9d19239195b2d9dea0d9502

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
827278d5672e0c2617b443d79067f959

SHA1
d41477f681f4021ed6595475c7ba0ac6ae7a81e0

SHA256
cd41938fc1b428ec75c27780159632ab8ed081a52f83d564b75181799de4e388

SHA512
aea5fa922a2c274efc31a57833e7bc9838df114af37df26f42381d18be413a3f6cac5490fd46542cb26b3d7b4e09162b729fc4a1f96e63aa9c31bf592d2cedc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
09e785846806d36e4550a13ec64a685c

SHA1
18c0bd9ab2b98ff0af5681d8f08f917c5576c2eb

SHA256
2e92aaa1c82a25045595670a5be991852244a0b73e5c0c81a47c6fa4ba63b095

SHA512
bb65487a75ee5b3ada8004ae2eef033d58d357728a856c724d81a60b8ca1b9ac12e5ce42b325531e0a59f36c5d7134f95154f30664a21cd3320e8e379660dc59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
393568d2d25f8ba0ff8b75bb565fc010

SHA1
f79211a49e3d9b2ac279a2192a8ca57c56d6ccc6

SHA256
a4738ad3f6f2e7c001a70647e2e68b3dbb20db4893b0c1ca0a79540e1488ddbb

SHA512
82c51f175ed72861508bf91b9c94cc82cefa9a94e005f4ca5430087d1a018a1b8825d96bd0f9e7b63c40e3368c0b7c199727934272ca2be63a6afdd38872bff3

Download Submit