471aaf0241fd5d54290c454350d53772fe29b6230ea830ee30a2ec7f72fbdd44

Analysis

max time kernel
145s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fce50bdb72549f25adcae31c2bc435aa_JaffaCakes118.html
Size

22KB
MD5

fce50bdb72549f25adcae31c2bc435aa
SHA1

1c55148d5d73effae609c622168e2e760bdcf351
SHA256

471aaf0241fd5d54290c454350d53772fe29b6230ea830ee30a2ec7f72fbdd44
SHA512

45e0b6f1700c01a398f0dc9d66d97bb7ab9f7c655f884b2dba2fcd5f9a14979b8f8b0fb8e9024839632583366957931ca510117f8ead3f1631a1aea1973e535c
SSDEEP

384:XPna67UkKbqT9bshiRm0mUpRzuOxocw/k3s/yhbfpvF+DraVOFRGVaaJPmOmR///:fLgHGT9bshic0NRJw/k3s6hbfpvJHPmn

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
996	msedge.exe
996	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe
1596	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 3296	996	msedge.exe	82
PID 996 wrote to memory of 3296	996	msedge.exe	82
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 4088	996	msedge.exe	83
PID 996 wrote to memory of 2792	996	msedge.exe	84
PID 996 wrote to memory of 2792	996	msedge.exe	84
PID 996 wrote to memory of 4604	996	msedge.exe	85
PID 996 wrote to memory of 4604	996	msedge.exe	85
PID 996 wrote to memory of 4604	996	msedge.exe	85
PID 996 wrote to memory of 4604	996	msedge.exe	85
PID 996 wrote to memory of 4604	996	msedge.exe	85
PID 996 wrote to memory of 4604	996	msedge.exe	85
PID 996 wrote to memory of 4604	996	msedge.exe	85
PID 996 wrote to memory of 4604	996	msedge.exe	85
PID 996 wrote to memory of 4604	996	msedge.exe	85
PID 996 wrote to memory of 4604	996	msedge.exe	85
PID 996 wrote to memory of 4604	996	msedge.exe	85
PID 996 wrote to memory of 4604	996	msedge.exe	85
PID 996 wrote to memory of 4604	996	msedge.exe	85
PID 996 wrote to memory of 4604	996	msedge.exe	85
PID 996 wrote to memory of 4604	996	msedge.exe	85
PID 996 wrote to memory of 4604	996	msedge.exe	85
PID 996 wrote to memory of 4604	996	msedge.exe	85
PID 996 wrote to memory of 4604	996	msedge.exe	85
PID 996 wrote to memory of 4604	996	msedge.exe	85
PID 996 wrote to memory of 4604	996	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fce50bdb72549f25adcae31c2bc435aa_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe72da46f8,0x7ffe72da4708,0x7ffe72da4718
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,6260383706003595518,11463595377076624355,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,6260383706003595518,11463595377076624355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,6260383706003595518,11463595377076624355,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6260383706003595518,11463595377076624355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6260383706003595518,11463595377076624355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,6260383706003595518,11463595377076624355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,6260383706003595518,11463595377076624355,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6260383706003595518,11463595377076624355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6260383706003595518,11463595377076624355,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6260383706003595518,11463595377076624355,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,6260383706003595518,11463595377076624355,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,6260383706003595518,11463595377076624355,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5516 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
df0b7576b3af2154db9590c17b2709e0

SHA1
d49cc4e4b1a77b9c4ad70962005852abbb998870

SHA256
62463abecd00cf2407572f32e660a83c23db39477ad08072f5e3a1140257d5b6

SHA512
69668da5ba1aac0ff69ab9f6fd496c755083467582644c55768c0834040b0284c0441717ae0e9475484fb052da7715a097975450ff9ce4f974c885c81ad38dee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8b1841a5b5c5390dfd036ccc7a7d9af6

SHA1
b82d610a0f73a5890d434d60dd389c83e198d067

SHA256
49aab01a14d81da972a50a4370292898016505e733c8c83d47f8aef66e01d2f0

SHA512
b2ff76c215780aaddb5f7b01df346cc9c9681537bedf98f9bfebfaaf9e260eda1efd3fad9366e21294eda408fa1770985f34cbca9476084ffea5eb2ff9759cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2a6df6dd5be420aad31898682d53d63c

SHA1
dcd751445056b240e8afe61870e030e67cb82de0

SHA256
2a3a49bbd3e7db80dad7e1d4c66f7845971539e20be4dc9113640d531d49b03b

SHA512
551cbf0ec9e41e72d7c95b78952b298bf0025187985701b6c3a57c4868e4fbc286da0ca995fac76f8d02945ee8f94eb501536417bce1a8b9314f372c8a977ebe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c567bcebe6095357d2f38448940e9539

SHA1
6db4582804a654bc490be81e099d30644eb24fac

SHA256
a50fa476e1060dfd6a043655cd8318d8c784b4e6821666ce0ed3ae0390644faa

SHA512
099bba386b88dea7a3a56d85c060521b40845ce4aa3f270972bf6adfc929eaff89056edbdffea01395752c5abe743f70a1803f71378f085c7c13678bdb57261e

Download Submit