cfb01edd2001d26463bb10c215dacdcdf06520b1a8084e06a337f3c30eee1293

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 08:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fbf12a49dc221d8cea82602510c05f0d_JaffaCakes118.html
Size

43KB
MD5

fbf12a49dc221d8cea82602510c05f0d
SHA1

7982015e59d92ea9d98690ae86b6f69c9eb708f1
SHA256

cfb01edd2001d26463bb10c215dacdcdf06520b1a8084e06a337f3c30eee1293
SHA512

cb9a34959d3eae8307905b648cf2feba040d9613645d77368c0e4bca2570a64ff4fa7951df01d588f869ee7ca427382d29438f5f0d22f611fc78af6810f0e5b0
SSDEEP

768:f7P+cIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ76:f7PPIRIOITIwIgIiKZgNDfIwIGI5IVJ0

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
3840	msedge.exe
3840	msedge.exe
4320	identity_helper.exe
4320	identity_helper.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 3460	3840	msedge.exe	82
PID 3840 wrote to memory of 3460	3840	msedge.exe	82
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4988	3840	msedge.exe	83
PID 3840 wrote to memory of 4996	3840	msedge.exe	84
PID 3840 wrote to memory of 4996	3840	msedge.exe	84
PID 3840 wrote to memory of 5096	3840	msedge.exe	85
PID 3840 wrote to memory of 5096	3840	msedge.exe	85
PID 3840 wrote to memory of 5096	3840	msedge.exe	85
PID 3840 wrote to memory of 5096	3840	msedge.exe	85
PID 3840 wrote to memory of 5096	3840	msedge.exe	85
PID 3840 wrote to memory of 5096	3840	msedge.exe	85
PID 3840 wrote to memory of 5096	3840	msedge.exe	85
PID 3840 wrote to memory of 5096	3840	msedge.exe	85
PID 3840 wrote to memory of 5096	3840	msedge.exe	85
PID 3840 wrote to memory of 5096	3840	msedge.exe	85
PID 3840 wrote to memory of 5096	3840	msedge.exe	85
PID 3840 wrote to memory of 5096	3840	msedge.exe	85
PID 3840 wrote to memory of 5096	3840	msedge.exe	85
PID 3840 wrote to memory of 5096	3840	msedge.exe	85
PID 3840 wrote to memory of 5096	3840	msedge.exe	85
PID 3840 wrote to memory of 5096	3840	msedge.exe	85
PID 3840 wrote to memory of 5096	3840	msedge.exe	85
PID 3840 wrote to memory of 5096	3840	msedge.exe	85
PID 3840 wrote to memory of 5096	3840	msedge.exe	85
PID 3840 wrote to memory of 5096	3840	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fbf12a49dc221d8cea82602510c05f0d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc9c6946f8,0x7ffc9c694708,0x7ffc9c694718
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11899077059595523476,226304213785150285,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,11899077059595523476,226304213785150285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,11899077059595523476,226304213785150285,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11899077059595523476,226304213785150285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11899077059595523476,226304213785150285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,11899077059595523476,226304213785150285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,11899077059595523476,226304213785150285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11899077059595523476,226304213785150285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11899077059595523476,226304213785150285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11899077059595523476,226304213785150285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,11899077059595523476,226304213785150285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,11899077059595523476,226304213785150285,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
385B

MD5
b3344e5a1b9af949185507d118df0de7

SHA1
ca375672162be0ae99cf797f9848c15a6a9968c3

SHA256
4f4d82828b42eebfb0d56a200d1c7ab48749f45c7a6069638d7a360c5d0cd9b9

SHA512
e3c3f6b9eb5b806a1dd08482a6dca38ebe1f93a72475c1997e538d2251d9d76ada0556979a2a5be8f87e9fa21c526b017b36f56e29cbaf9990112a697543549b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8c9d438222b45008afed85f2585f3291

SHA1
026e8db2c4f569c1a44e3e1e9dfde1ab73eb027c

SHA256
18f82b8f0d92a75275fe1cd4938a06534524137b563d3430950a83981e3b0771

SHA512
2f4d3ef9ea0561dc86a38e00f49adb72cb56e9a901e8635ad1c48a3bcb8c15686bcf02f866e45aa881b1c3dcbb57a1d2866468fae440d129ac5257ec26d7cbf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8dcce022c90cd0f8f3545810ee8d5eca

SHA1
157130be5a0accb7c608704ae014572056559bf8

SHA256
a64dc576781d529f53e8900343f06e69eb56e96169ae8d270816d11642a73b74

SHA512
30ecdd7bfb39371a17d73bfcb4d75efd3b9a5556e5ecfeb680172c2ca0a20a8b445a00dbdb996ac0e75c21020dde4cfa9a82ce53cb3f5c46ee369dc67e0f7475

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f6c33b82-52fa-472d-8dbf-3039980ebbf8.tmp

Filesize
5KB

MD5
fb1a6adc3b7ed158e9311b51dc1b8b3c

SHA1
aa84ae7f51d930e0e0aab1bf7a50356e8a833310

SHA256
1de2f9cebff7e23e89bf9bfff299b2798be786a0b54668f571124712f723ac87

SHA512
56f9f5a77b930dd205564cb4d14077cced153a6f2a578b0b698b61e111187ab3fe56e0eae325c966ca5dd0bcc1329c80f3f76424f90e2e1c5276720d79fe31db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
80f916dbbb875c09db58e9880a93d514

SHA1
38a82dba724641ee8f4d3a49918227dda7f4acae

SHA256
ca0e81e9313f86c329505d46af0462c04e5b376c1e33905b3d78bbe2d927620a

SHA512
12efac35e4be5c13540eccfc152ce890c8b5a38845189d7d7675763153ecb0c7c36add570b893cf3e729aeb357b634ef1e2731fda3ae56c01639d3d797002b41

Download Submit