e9f33e1174314820d8bc632df0f5bcf8b4c3e9c5faa14f2dc3c9c89946f21f3b

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fd6f3f9de0f0ccdcffa3d9bb7a4ce008_JaffaCakes118.html
Size

6KB
MD5

fd6f3f9de0f0ccdcffa3d9bb7a4ce008
SHA1

0d00fc2490547cea1c393bc00b1ddd828b260ec5
SHA256

e9f33e1174314820d8bc632df0f5bcf8b4c3e9c5faa14f2dc3c9c89946f21f3b
SHA512

d71b6de1d01e8e90659701de1549d679558310d7fddf1ac9f5d56929e01a6b0e025c80400f5b47eb0a69007d5410d2e674183edac61320e16898ce9a720cb2f3
SSDEEP

192:dmrvQ1f3SupVyeJe6voL3kQz0n+QFKj0hu:dmrvQ16cVyeJe6W0WSu

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe
4892	msedge.exe
4892	msedge.exe
3340	identity_helper.exe
3340	identity_helper.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 3052	4892	msedge.exe	82
PID 4892 wrote to memory of 3052	4892	msedge.exe	82
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 1640	4892	msedge.exe	83
PID 4892 wrote to memory of 3456	4892	msedge.exe	84
PID 4892 wrote to memory of 3456	4892	msedge.exe	84
PID 4892 wrote to memory of 1504	4892	msedge.exe	85
PID 4892 wrote to memory of 1504	4892	msedge.exe	85
PID 4892 wrote to memory of 1504	4892	msedge.exe	85
PID 4892 wrote to memory of 1504	4892	msedge.exe	85
PID 4892 wrote to memory of 1504	4892	msedge.exe	85
PID 4892 wrote to memory of 1504	4892	msedge.exe	85
PID 4892 wrote to memory of 1504	4892	msedge.exe	85
PID 4892 wrote to memory of 1504	4892	msedge.exe	85
PID 4892 wrote to memory of 1504	4892	msedge.exe	85
PID 4892 wrote to memory of 1504	4892	msedge.exe	85
PID 4892 wrote to memory of 1504	4892	msedge.exe	85
PID 4892 wrote to memory of 1504	4892	msedge.exe	85
PID 4892 wrote to memory of 1504	4892	msedge.exe	85
PID 4892 wrote to memory of 1504	4892	msedge.exe	85
PID 4892 wrote to memory of 1504	4892	msedge.exe	85
PID 4892 wrote to memory of 1504	4892	msedge.exe	85
PID 4892 wrote to memory of 1504	4892	msedge.exe	85
PID 4892 wrote to memory of 1504	4892	msedge.exe	85
PID 4892 wrote to memory of 1504	4892	msedge.exe	85
PID 4892 wrote to memory of 1504	4892	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fd6f3f9de0f0ccdcffa3d9bb7a4ce008_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc77046f8,0x7fffc7704708,0x7fffc7704718
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,1146168399910630398,886699871691335077,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,1146168399910630398,886699871691335077,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,1146168399910630398,886699871691335077,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1146168399910630398,886699871691335077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1146168399910630398,886699871691335077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1146168399910630398,886699871691335077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,1146168399910630398,886699871691335077,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,1146168399910630398,886699871691335077,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1146168399910630398,886699871691335077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1146168399910630398,886699871691335077,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1146168399910630398,886699871691335077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1146168399910630398,886699871691335077,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,1146168399910630398,886699871691335077,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
012352236905584d34dfc50effa9765e

SHA1
662156eab006c6227aed2ab42c345cbcda1fa04a

SHA256
df936cdd7a9172167811560bb29b5f54da1479dd04d5f606774df0313524b7af

SHA512
7edd66ae401274d501cd4c03a45ec6f3e87d2949073327391bd043f3192b6f9543ef66ddfc5c41f0fc3d4a90dbf87f67021709e4ad69a58d8f1e7274aefaa50c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2412d25db4cd4b6a3c67eea7e4665fa2

SHA1
ca9c4477d2db7139257391301743fdf09d0a0d19

SHA256
b39763b7f04f17f2cd6e8b34db84ebcd1f1954c22a22e2e84c72ba275c9fc9fe

SHA512
0297900df898bae2c92209c13aaaa373fd713cfde3f7de8f8ae99695e591b78fe9a16532a72207320ce43d5e7006259f4bfdb5c1fd10795b924a3663cc27a1d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1a5f65dc1ec426f41feab5c9c878dddf

SHA1
bc5f3cf6783386f66050bbe97fae093afa8fee77

SHA256
27ae31f911e08075e2ed24cf0501169b149d7f7918574f934e8ff7b3e6e8b6f7

SHA512
e7ba79899bd32548a85fa5ad30c863bd189357af825e18fdc37c6b371498ed0628b3b7680f7a3bbc0c9f02201d5270b952392b85bc2f843ee11413c15f11bf2f

Download Submit