66e0448f7b859f0e853513a619b60d07958a11777d8eddae29bc128042c6ecc2

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 04:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fdc9b6469a40fa612262b20a9b2d785d_JaffaCakes118.html
Size

215KB
MD5

fdc9b6469a40fa612262b20a9b2d785d
SHA1

1f628eef52b90168a7b8d02cbb46147ff8d3060b
SHA256

66e0448f7b859f0e853513a619b60d07958a11777d8eddae29bc128042c6ecc2
SHA512

0a29d6086bd3fbcb2dc9c1133befb142ad3625e27e6827108b4e38d1bd232157ac3268595a6f52b98b18aa4cfdbbaa112c51d40c3eb10b6ad7c9fddb530bd8c6
SSDEEP

3072:+wlTAANInefxELfDpbIqvU9vXu+uw9vXuHud9vXHT9vXuXuoyxmJPPMYuwPapCcp:+wyAinefKLbp0nJHFsyxmaysXVnZH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3608	msedge.exe
3608	msedge.exe
1156	msedge.exe
1156	msedge.exe
4928	identity_helper.exe
4928	identity_helper.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 1288	1156	msedge.exe	82
PID 1156 wrote to memory of 1288	1156	msedge.exe	82
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 1040	1156	msedge.exe	83
PID 1156 wrote to memory of 3608	1156	msedge.exe	84
PID 1156 wrote to memory of 3608	1156	msedge.exe	84
PID 1156 wrote to memory of 1028	1156	msedge.exe	85
PID 1156 wrote to memory of 1028	1156	msedge.exe	85
PID 1156 wrote to memory of 1028	1156	msedge.exe	85
PID 1156 wrote to memory of 1028	1156	msedge.exe	85
PID 1156 wrote to memory of 1028	1156	msedge.exe	85
PID 1156 wrote to memory of 1028	1156	msedge.exe	85
PID 1156 wrote to memory of 1028	1156	msedge.exe	85
PID 1156 wrote to memory of 1028	1156	msedge.exe	85
PID 1156 wrote to memory of 1028	1156	msedge.exe	85
PID 1156 wrote to memory of 1028	1156	msedge.exe	85
PID 1156 wrote to memory of 1028	1156	msedge.exe	85
PID 1156 wrote to memory of 1028	1156	msedge.exe	85
PID 1156 wrote to memory of 1028	1156	msedge.exe	85
PID 1156 wrote to memory of 1028	1156	msedge.exe	85
PID 1156 wrote to memory of 1028	1156	msedge.exe	85
PID 1156 wrote to memory of 1028	1156	msedge.exe	85
PID 1156 wrote to memory of 1028	1156	msedge.exe	85
PID 1156 wrote to memory of 1028	1156	msedge.exe	85
PID 1156 wrote to memory of 1028	1156	msedge.exe	85
PID 1156 wrote to memory of 1028	1156	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fdc9b6469a40fa612262b20a9b2d785d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce26946f8,0x7ffce2694708,0x7ffce2694718
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17495258262436731028,4523691220071307116,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,17495258262436731028,4523691220071307116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,17495258262436731028,4523691220071307116,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17495258262436731028,4523691220071307116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17495258262436731028,4523691220071307116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17495258262436731028,4523691220071307116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17495258262436731028,4523691220071307116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17495258262436731028,4523691220071307116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17495258262436731028,4523691220071307116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17495258262436731028,4523691220071307116,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17495258262436731028,4523691220071307116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17495258262436731028,4523691220071307116,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17495258262436731028,4523691220071307116,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\20e354a9-6171-47de-b647-f1db75e157bd.tmp

Filesize
6KB

MD5
08fd809809a550dfe7976525d5247f03

SHA1
def2b44298a2d45d8f72c844a16fa8aa76f4e132

SHA256
d71bc1ec3a29da2061b48d4153b6939736cc8ed8117c09f37284ee6c8fc3ed65

SHA512
1b39cf6497fefbb078bf22e1c27d22377e2f09f971a6afb793c86b440f92cf76786f97b6e25b2b02fc669778b5cc83161cdd75056b6305d94932b167a9566cd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
b02dececbaef993e1ba8e5aed4220a69

SHA1
5ab3f2b25368f8ef0d80748609882a6b77fe7344

SHA256
7a3eaaf8d05f306cca8e2bf1ee7a8249d6735972c5c6024311613c0989d46503

SHA512
ddb15db0a48c8625418f3e7e40db95139d86d7e8f41d8d20dae25e0cbdff16a633ed5fc35bf9db8617a5fe06dc6bbbc7685c36d02a01f6f0da2d0df3e3434a6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
852B

MD5
43c3d5f3fb86dc906ad58c2905b00357

SHA1
0c755342cf09d5a2231829659a5dca9117357b5d

SHA256
75017680c365801b8638267b1a1883d491f8ba7586242ed1c3d470d16c851d37

SHA512
0481ee75e297853e2dc14ca90808632ff095023ef40ac58e7a0d66ad45d2f36b2c39def3e917cd2a5b19cd94dcf815f2ecf68eb1a3d2fd64bfa614202956a1a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
14bfac7e8be270d957ca5e54ec6cc355

SHA1
59745d1b932875e3daed88c3d93017778538dc41

SHA256
29e80a1f5e65227459b173a60b67c25391a0e096f72fc4403a38366d0378290f

SHA512
c412fb5591148ebff0a966d17c7714c64b2ff186a4c19a6532ae41e39b40ed911eb39af8964ae9206c9091363071346d6a90b4413ea0ec5a569498bbc74b11b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
515c7276eadae4b21679f42a5e6d541d

SHA1
ca352f8cadbe3635ac29c32771df2a8c38bb555e

SHA256
184c251898c09ced39281ba4349f232e8198f2deaf04fb5add7c7bcba87c59fc

SHA512
53fae871b7e8f0ff58fe7809f7c2b68de765a7b4d2bfc1608508342a2a78ac9ae8b27ef9c4c748d1378d4ba8546b7f269a172b574e317cb95aebefb7845ab74e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bdab70c0ae18de1016d6e4e9adbd62a1

SHA1
0b0811005023c8a182b259101619760f18f8d09f

SHA256
6ee3f96b4f8373e67e62adfd9172214fa8b9c06a385bf9df83261905bbbfc38c

SHA512
c24a897aa7b64049ed183249096024648799852550dd9bd60abd6bdba5cb99242de57f04f2fcee0e9dd31b82b8143f93f727b0837714c00078b477c9bac95ce6

Download Submit