a361a3e1c4aea2353b0bb68e12f45bd9c76b1e8b87e0ea049f5dae1f0f7e80c3

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fda5715a0bef92365fa7901d84361021_JaffaCakes118.html
Size 192KB
Sample240929-c8ry4azcnf
SHA256 a361a3e1c4aea2353b0bb68e12f45bd9c76b1e8b87e0ea049f5dae1f0f7e80c3
MD5 fda5715a0bef92365fa7901d84361021
SHA1 f8eb7da99464c24e69c34e8acf36b33525f252f6
SHA512 11d33d4f3d0d1229459b248dc4452f21e98505f5f717fbe9ebbad634005257f92c5a4f4aacb30d33e39ae0540738c45c452fddbdf8cbf09b240bd06774191fe6
SSDEEP 6144:9ApBCJFb1OLWREAYj+s8vBhgUseprskZDi05U6wf5JoVhJ1oWRP4UBLS48k17Y+K:epeFb1OLWREAYj+s8vBhgUseprskZDi1
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
956	msedge.exe
956	msedge.exe
2284	msedge.exe
2284	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe
2284	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 3672	2284	msedge.exe	82
PID 2284 wrote to memory of 3672	2284	msedge.exe	82
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 712	2284	msedge.exe	83
PID 2284 wrote to memory of 956	2284	msedge.exe	84
PID 2284 wrote to memory of 956	2284	msedge.exe	84
PID 2284 wrote to memory of 2996	2284	msedge.exe	85
PID 2284 wrote to memory of 2996	2284	msedge.exe	85
PID 2284 wrote to memory of 2996	2284	msedge.exe	85
PID 2284 wrote to memory of 2996	2284	msedge.exe	85
PID 2284 wrote to memory of 2996	2284	msedge.exe	85
PID 2284 wrote to memory of 2996	2284	msedge.exe	85
PID 2284 wrote to memory of 2996	2284	msedge.exe	85
PID 2284 wrote to memory of 2996	2284	msedge.exe	85
PID 2284 wrote to memory of 2996	2284	msedge.exe	85
PID 2284 wrote to memory of 2996	2284	msedge.exe	85
PID 2284 wrote to memory of 2996	2284	msedge.exe	85
PID 2284 wrote to memory of 2996	2284	msedge.exe	85
PID 2284 wrote to memory of 2996	2284	msedge.exe	85
PID 2284 wrote to memory of 2996	2284	msedge.exe	85
PID 2284 wrote to memory of 2996	2284	msedge.exe	85
PID 2284 wrote to memory of 2996	2284	msedge.exe	85
PID 2284 wrote to memory of 2996	2284	msedge.exe	85
PID 2284 wrote to memory of 2996	2284	msedge.exe	85
PID 2284 wrote to memory of 2996	2284	msedge.exe	85
PID 2284 wrote to memory of 2996	2284	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fda5715a0bef92365fa7901d84361021_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e39c46f8,0x7ff9e39c4708,0x7ff9e39c4718
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,12385232760097772630,9106805527550933409,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,12385232760097772630,9106805527550933409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,12385232760097772630,9106805527550933409,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12385232760097772630,9106805527550933409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12385232760097772630,9106805527550933409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12385232760097772630,9106805527550933409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12385232760097772630,9106805527550933409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,12385232760097772630,9106805527550933409,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
MD5 53bc70ecb115bdbabe67620c416fe9b3
SHA1 af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA512 cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
MD5 e765f3d75e6b0e4a7119c8b14d47d8da
SHA1 cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA512 a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
MD5 SHA1 SHA512

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011
Size 23KB
SHA256 60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf
MD5 2f24e0f5d2c2997a89fb4a8d943c141f
SHA1 99515bde1a5bf72105116ac902ccf3db1dd3df29
SHA512 0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d
SSDEEP 384:VSCKOXcXVC6fizIN66yBc1Ei49Zvi2fSZ886pETkDCm510VS7X+r27Z:aOX/jd6yJiOZa2aZZNAFmS7X+rEZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 768428b15be11a2606d01e7d48e1f87fc3a46ed5941a0fd71b025890d113dbfd
MD5 658a865bc8aca398315c16b6577cf450
SHA1 6726fb75f99bd146f885a4168a870cd42141ef00
SHA512 efec6e15bf7197332873c09560ec0ab05f1325b58ca080c97c27a8f04e979b990fb5af37462d69a3365aa0d9fbe65d0d6b4d2e860f1882563dd17fb8a42659ad
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 5c5b20c5acb7de4f3326495550d937fb65bc0c635ce8b8cff1c972074fb0a3dd
MD5 d12ddfaa1d0f980a274cee9c72bea0ec
SHA1 65a9fd95e455a4683814600600318487cc0ee898
SHA512 cf0d1846ab04c0fce4a82300d8c3554c2cdd67df90f1ec9f4fbb643cb41c5952228badd55661e1f721ed38cdc316556a311d8e5da6432b0cc10946043bdc0781
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 b0522719726d8cd9650a68e5e532df4113ca50ddb47d4d14f24dc162a205b621
MD5 a81426ca19b19b47a5fdc484954119f7
SHA1 40f3e62d36daf064813e1a46ff39317a878113cf
SHA512 7a8a92d5b7bebdfd94f9d873f9e301f8ad06ec22a5209647e0ae4f7438ef561139e2209921357721598de221a66c2af9bc12eae8295d48df0911daa564d340e4
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 af3b59b2a06899f0e77cec505a6304bd5b3844a81694f4db83d92f3130e2750b
MD5 40f335fd06355aa856cace8e2fdeffd4
SHA1 04d1ee30e2f239a6c61341aab1b5898baaa71465
SHA512 ecfd857a7a1acf2568e7598920ce1135fa24488b28ee5cdc438e49fb47bf3ce1598bdded1310b3368370cd92df4552bb257e5d01bc82631c1b2c7b68ddc37254
SSDEEP 96:n7kzo81OhQwpvWMoiVmdeVVtkiu+TG2n+285qErj4UWQyV+VDCAiEwb:n7kz5chQGWMlHkiu+TG2n+2gcrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 e1c1654af329c3c7883e89d09ec41ff1775639111c4728dfa54ba882183b93af
MD5 39551824e9ca80f5ee6b1336b1401aa8
SHA1 ab8e71c7862d7d1aa72f17e824a7c8e29172e1ab
SHA512 5ebe802d1c30beca77c18e2e885f0bdd9d455f9f4d9fe914d87a8cba2b8b442b36b22a452ec9d4231da340afa44fb3bfde7ce7c3274c366997d15cf92666eb12
SSDEEP 96:n7kz281ORQwpvWMoiVmdeH85qErj4UWQyV+VDCziEwb:n7kz3cRQGWMXgcro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 c95cd70de53b9bdd07d2ceef836ae2d12a564e2a3714611b64ec873db97f4305
MD5 33ab36b99b49b1edde05a2ca6ab66401
SHA1 0ad1c70823b0871b5cf34c4bd8bbda4f3b8566ab
SHA512 d8b4e2c1dc7833a330ea67ada178c187c958564b051484019a7757c3f8d8e37a5a0a9a0206b0e5fb8c9d63ff3baa4ac11c513b9418db5ead9df97aa8fe5769ca
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupIRclXe2RUi/7i+HIcM/boO:A9iIxuERzA83h09RZxYIofHTV4qZxE
MD5 SHA1 SHA512 SSDEEP

Submit Download