5aa5951ad1062134fd500afee260a9e781ed160a699f131ebc96b9321839e3b3

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 08:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fbe13ed9b3b0d9bfbe2f54e33d769089_JaffaCakes118.html
Size

69KB
MD5

fbe13ed9b3b0d9bfbe2f54e33d769089
SHA1

8b977bdfadc58107ae32e2b127a9c8296aa02ac5
SHA256

5aa5951ad1062134fd500afee260a9e781ed160a699f131ebc96b9321839e3b3
SHA512

bbb0365d14ebd964f2932eba811ef108ece9e31e14e51aa60e7710996be0211eaa3589f32b2640057333d51429b402f80b0653f7ca6b5bc1813afc7322ef8cec
SSDEEP

768:Ji2gcLWR3sI2PDDnd0g62uDNouYMboTyD1wCZkoTyMdtbBnfBgN8/lboiGhcRoQS:JU7BdUTYNen0tbrga90hcJNnspv

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
948	msedge.exe
948	msedge.exe
1200	identity_helper.exe
1200	identity_helper.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 2392	948	msedge.exe	82
PID 948 wrote to memory of 2392	948	msedge.exe	82
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 3100	948	msedge.exe	83
PID 948 wrote to memory of 4084	948	msedge.exe	84
PID 948 wrote to memory of 4084	948	msedge.exe	84
PID 948 wrote to memory of 4920	948	msedge.exe	85
PID 948 wrote to memory of 4920	948	msedge.exe	85
PID 948 wrote to memory of 4920	948	msedge.exe	85
PID 948 wrote to memory of 4920	948	msedge.exe	85
PID 948 wrote to memory of 4920	948	msedge.exe	85
PID 948 wrote to memory of 4920	948	msedge.exe	85
PID 948 wrote to memory of 4920	948	msedge.exe	85
PID 948 wrote to memory of 4920	948	msedge.exe	85
PID 948 wrote to memory of 4920	948	msedge.exe	85
PID 948 wrote to memory of 4920	948	msedge.exe	85
PID 948 wrote to memory of 4920	948	msedge.exe	85
PID 948 wrote to memory of 4920	948	msedge.exe	85
PID 948 wrote to memory of 4920	948	msedge.exe	85
PID 948 wrote to memory of 4920	948	msedge.exe	85
PID 948 wrote to memory of 4920	948	msedge.exe	85
PID 948 wrote to memory of 4920	948	msedge.exe	85
PID 948 wrote to memory of 4920	948	msedge.exe	85
PID 948 wrote to memory of 4920	948	msedge.exe	85
PID 948 wrote to memory of 4920	948	msedge.exe	85
PID 948 wrote to memory of 4920	948	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fbe13ed9b3b0d9bfbe2f54e33d769089_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90a0446f8,0x7ff90a044708,0x7ff90a044718
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1504,5738460462046744691,8691393746477964076,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1504,5738460462046744691,8691393746477964076,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1504,5738460462046744691,8691393746477964076,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1504,5738460462046744691,8691393746477964076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1504,5738460462046744691,8691393746477964076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1504,5738460462046744691,8691393746477964076,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4144 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1504,5738460462046744691,8691393746477964076,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4144 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1504,5738460462046744691,8691393746477964076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1504,5738460462046744691,8691393746477964076,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1504,5738460462046744691,8691393746477964076,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1504,5738460462046744691,8691393746477964076,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1504,5738460462046744691,8691393746477964076,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3452 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
378B

MD5
22e160f31e95c7c2aaa5e65a5c6dc5ed

SHA1
952b19c129784f5ef71c1b30517d431dbe068254

SHA256
f7be693222ba0ede01c099fead8038bce60461c2257b528503be49f0cd8d3735

SHA512
2ea98a66b7e748977c633f15471f146080e4dd778e388fd2ecde99dbb55006f6e23de9fa2e2aa883eddc4559949d70cdc63707ddf713b419638ce3356600223a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fdda3a200b73575af695ea212b5bab95

SHA1
9a7efb1842d953b70ec68aaacff798797521ada9

SHA256
7a0fb1a59e5cab7157b2b073cb9d7301862201afeb0d7b614764669f1ae8649c

SHA512
4caa4213157179a6c347e49794d486916fadda32f841e223a377520d2b2bedf32859d706af0a09c648f233963f2f39db0352334aa847723d362ba38e85a599d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
516d5f770d858edcc011d85b440a287d

SHA1
139df7c73f5b68022d93091b242b0da620a2fff0

SHA256
bae6bb68f3d625cf87af570f9279e94f4e68c9326b741927e8942b2766d879d7

SHA512
146b814ea224d324d2f8145d809c958deb1a91b40eb7eed8e516f304d5ebe170e077783ddf0fdc0995f0c7dc605a8153c24e53ed2ae54c46df360a78d0703e4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ca439e2c7d8457c904f1dbc7f0dd4f03

SHA1
6e696646940427c3bec2df7bd2667407b9c49d57

SHA256
7f6659498669d3e541a8a803fef08167f55b0a50261f430f99e1a0c274dc6f40

SHA512
4fb9066ad1db5fdd671bc29831f3a8ba42836d47688278c8f8858ccf1f2238cf478d4eec4d20e388cc114c015edba2a82aa8a95cc41e56ad16f5d7240b5bc785

Download Submit