0931550af2e9d25efba9e063e4289fea892248a7f147106828078ecd178dbf1e

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 17:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcc939ade6a031c635ab56c9bf9b8b12_JaffaCakes118.html
Size

229KB
MD5

fcc939ade6a031c635ab56c9bf9b8b12
SHA1

a2219109696b333bfaecb0247ad14eba3f8f61b9
SHA256

0931550af2e9d25efba9e063e4289fea892248a7f147106828078ecd178dbf1e
SHA512

b1e80d62d414e4735a4b7dfa121241a3831a5735ddb2780c240c1971ec9144f1ff0bbdaab07580e3342af665aedc7dd2fd222a23174abe4cbd8422b26daf4b1f
SSDEEP

3072:ZFKSwI7qS7ILtYLBaiSeOoe36ZjHMDvnx3GPDa+5CEWQRLx+7p:3qmXbOZ36ZSvnx3GPDa+GQY

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4676	msedge.exe
4676	msedge.exe
5112	identity_helper.exe
5112	identity_helper.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 4540	4676	msedge.exe	82
PID 4676 wrote to memory of 4540	4676	msedge.exe	82
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 676	4676	msedge.exe	83
PID 4676 wrote to memory of 4912	4676	msedge.exe	84
PID 4676 wrote to memory of 4912	4676	msedge.exe	84
PID 4676 wrote to memory of 944	4676	msedge.exe	85
PID 4676 wrote to memory of 944	4676	msedge.exe	85
PID 4676 wrote to memory of 944	4676	msedge.exe	85
PID 4676 wrote to memory of 944	4676	msedge.exe	85
PID 4676 wrote to memory of 944	4676	msedge.exe	85
PID 4676 wrote to memory of 944	4676	msedge.exe	85
PID 4676 wrote to memory of 944	4676	msedge.exe	85
PID 4676 wrote to memory of 944	4676	msedge.exe	85
PID 4676 wrote to memory of 944	4676	msedge.exe	85
PID 4676 wrote to memory of 944	4676	msedge.exe	85
PID 4676 wrote to memory of 944	4676	msedge.exe	85
PID 4676 wrote to memory of 944	4676	msedge.exe	85
PID 4676 wrote to memory of 944	4676	msedge.exe	85
PID 4676 wrote to memory of 944	4676	msedge.exe	85
PID 4676 wrote to memory of 944	4676	msedge.exe	85
PID 4676 wrote to memory of 944	4676	msedge.exe	85
PID 4676 wrote to memory of 944	4676	msedge.exe	85
PID 4676 wrote to memory of 944	4676	msedge.exe	85
PID 4676 wrote to memory of 944	4676	msedge.exe	85
PID 4676 wrote to memory of 944	4676	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fcc939ade6a031c635ab56c9bf9b8b12_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8650446f8,0x7ff865044708,0x7ff865044718
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,14618885420732721127,2628715033386552058,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,14618885420732721127,2628715033386552058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,14618885420732721127,2628715033386552058,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14618885420732721127,2628715033386552058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14618885420732721127,2628715033386552058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14618885420732721127,2628715033386552058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14618885420732721127,2628715033386552058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,14618885420732721127,2628715033386552058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,14618885420732721127,2628715033386552058,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14618885420732721127,2628715033386552058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14618885420732721127,2628715033386552058,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14618885420732721127,2628715033386552058,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14618885420732721127,2628715033386552058,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,14618885420732721127,2628715033386552058,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5884 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
689B

MD5
859f42f8ab149baedfa2392a33898c8e

SHA1
186103160ed397ffe23b057756ea1dddc415f0b8

SHA256
f1b804716733718385a8e47eb2a5bc3b1ae0dea764702e91ff73a6cb5401661f

SHA512
1ca3f7a2d784f2b5c57b91bd22ce97f977deacebcbeea2669c23d44e48460f37b988a3c8cf15b69b503524457afea6b9256e836220740077f0a49d05198dec71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9ea947321d33cc4d8d4ae6a32e960014

SHA1
31ed9f44b56685ce0df5c87ab23ecd74997b9443

SHA256
f16a7a6ff92fb7d86b59dab430e99acf1e4a5c8771a641d413ee6b5767e97727

SHA512
ecea7ad0670c664254fc5e26e486c29c17ace30b1247d261209924792f7795299fe8a310ee7b60f3860c0f66f34694dc4683875af547b0f5c353af156174b29f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4212acc98e7f253214fe4b4ef35d53ff

SHA1
fcd7de8b9609b08eb71f3aaef00d309b15db70a6

SHA256
e5c89c5e0c106c100b81c14e8447b6a1afb4130e1642c35637755f36f21e1c4a

SHA512
405636d1bd3afe9e7818cd41afc120926cdf1281a7f1a8589015ae43a4a93fee8d80b4c8cf511e5d300efc3f0b0d4e910ed227c27af482b18f852ab3e4872886

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9f10df6c3432a791146691dabf9ac928

SHA1
f0c982d2981548c00b8450c00304f56b849d1e21

SHA256
aef394e7c5524af4b9a93a74e024c3976efc40af53d2ec22258d343a9b6c0157

SHA512
a3b269f268805605de8c52400893254ab0655433be50873b35cced5449b2cd17bdd341388ccb83fae7962ea3a12e64d15b744254375f708447976a5dd1914e9d

Download Submit