9ffd30deaf22f6b46d43cb25b104049ba7938baa6ed70d9c375f61228ad7369c

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcb2a62dfe8b6efae3df24fd6be00ba3_JaffaCakes118.html
Size

18KB
MD5

fcb2a62dfe8b6efae3df24fd6be00ba3
SHA1

9bd274fffd5dcb4c220ddb13ca928160866f58ce
SHA256

9ffd30deaf22f6b46d43cb25b104049ba7938baa6ed70d9c375f61228ad7369c
SHA512

82dfe09a505a8e27dd8024797a97c5ed9a88eec24b65bf2a0c259d5a8995d76b05729c4bb067d20ba2479f9177b7e73771f80612fa89d063364cdf366343edd8
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAI+4WzUnjBhCE82qDB8:SIMd0I5nvH1svCHxDB8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2936	msedge.exe
2936	msedge.exe
1940	msedge.exe
1940	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 3704	1940	msedge.exe	84
PID 1940 wrote to memory of 3704	1940	msedge.exe	84
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 4936	1940	msedge.exe	85
PID 1940 wrote to memory of 2936	1940	msedge.exe	86
PID 1940 wrote to memory of 2936	1940	msedge.exe	86
PID 1940 wrote to memory of 1480	1940	msedge.exe	87
PID 1940 wrote to memory of 1480	1940	msedge.exe	87
PID 1940 wrote to memory of 1480	1940	msedge.exe	87
PID 1940 wrote to memory of 1480	1940	msedge.exe	87
PID 1940 wrote to memory of 1480	1940	msedge.exe	87
PID 1940 wrote to memory of 1480	1940	msedge.exe	87
PID 1940 wrote to memory of 1480	1940	msedge.exe	87
PID 1940 wrote to memory of 1480	1940	msedge.exe	87
PID 1940 wrote to memory of 1480	1940	msedge.exe	87
PID 1940 wrote to memory of 1480	1940	msedge.exe	87
PID 1940 wrote to memory of 1480	1940	msedge.exe	87
PID 1940 wrote to memory of 1480	1940	msedge.exe	87
PID 1940 wrote to memory of 1480	1940	msedge.exe	87
PID 1940 wrote to memory of 1480	1940	msedge.exe	87
PID 1940 wrote to memory of 1480	1940	msedge.exe	87
PID 1940 wrote to memory of 1480	1940	msedge.exe	87
PID 1940 wrote to memory of 1480	1940	msedge.exe	87
PID 1940 wrote to memory of 1480	1940	msedge.exe	87
PID 1940 wrote to memory of 1480	1940	msedge.exe	87
PID 1940 wrote to memory of 1480	1940	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fcb2a62dfe8b6efae3df24fd6be00ba3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80c1846f8,0x7ff80c184708,0x7ff80c184718
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,17885944752821948492,9157803410594453029,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,17885944752821948492,9157803410594453029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,17885944752821948492,9157803410594453029,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17885944752821948492,9157803410594453029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17885944752821948492,9157803410594453029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,17885944752821948492,9157803410594453029,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e958e0645533fcfd5238d59ab919d400

SHA1
250eae1a459dcff19bc05b0394d7fdd2bbb1510a

SHA256
2eab9f634102bc1cd90918edea40319c6a8b5872c0e8cc5e16b7cd63798cd033

SHA512
4e51ae71a24c306836db739a9ad9d8b107e5c0d4b380260c1e970fc6704d5b9da9ec28cba8d955ddca0c5c3ea5f3345c08268d7200a5ca470b0791491790153d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bf1e86ba7aea6210e079d3d1cd48f81a

SHA1
7afb92d6465ed93de3e5a1cf79683785409c548a

SHA256
f768130563a8a8e7a3b44199f859e88a40affc9880fd17acbfa2c5360e4f4489

SHA512
97b0bc0d799277620143ee82b2078ba1c8fd1b39febf184d837f497682a938ed821dc0d3ba53cd75cc907fd5d2e970d74955a72c92608e5c901a8bcc72b176ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fa7fe3e5821dddf69363ccec386875ca

SHA1
b48abff4900c2580aabeaa8104380289bcdd5cd8

SHA256
c67599254534cf5055b396ce4ca9c0ea36ff347ad3d931ee0818281e3d9dd9a8

SHA512
f9b97a19af5a77cae69a0e91fb6600fd2e85c8992f0ef70e6af92242bab0011ba8e80afe46363870b704449f77b47d08908a25c4e2227ce5ade932647dbb592c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1d1073ef1ef08038079e008c25c71e41

SHA1
003728656171c926632f8da716742ba7614392cd

SHA256
06ff0a288bdca808d001eec06e1f5d0083a0a5d01018582f50a6a166e4002d0f

SHA512
231aa7b782dd6e8a6d8aa0ab741376eed553f54032270a62ef7d9fb522a7d22d2ee792372deababe8f1fd36bee6ac209fe48f59dcb01804e24ffe60e9ac5b1c4

Download Submit