99f3848fe2e183049cc48e84c009d2e3a877f379829ef10f4fd7c87cff05838c

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 05:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fde54a22ccf5547b26c2fe7b91226c25_JaffaCakes118.html
Size

58KB
MD5

fde54a22ccf5547b26c2fe7b91226c25
SHA1

7c93a2b1097194cc10e59b3e0aae62a71cdf40d3
SHA256

99f3848fe2e183049cc48e84c009d2e3a877f379829ef10f4fd7c87cff05838c
SHA512

10583d036661c2fc1369b974c4f8f4c6697c13ab1914337690c9c1442a371a7920ef66f09e9d9b1ab339b2e7eb553bbd934dc0a0a2969c38ed70fabe4eb50e83
SSDEEP

1536:saWKSzFdFIexvCpRsy9FSDi3Ej16E32WC1QIr32KzybwCKYFhBsf:3WK6deXS+I16u2WC1QIr32KzybwCKYFs

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3696	msedge.exe
3696	msedge.exe
3628	msedge.exe
3628	msedge.exe
212	identity_helper.exe
212	identity_helper.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe
3628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 4712	3628	msedge.exe	83
PID 3628 wrote to memory of 4712	3628	msedge.exe	83
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3796	3628	msedge.exe	84
PID 3628 wrote to memory of 3696	3628	msedge.exe	85
PID 3628 wrote to memory of 3696	3628	msedge.exe	85
PID 3628 wrote to memory of 2756	3628	msedge.exe	86
PID 3628 wrote to memory of 2756	3628	msedge.exe	86
PID 3628 wrote to memory of 2756	3628	msedge.exe	86
PID 3628 wrote to memory of 2756	3628	msedge.exe	86
PID 3628 wrote to memory of 2756	3628	msedge.exe	86
PID 3628 wrote to memory of 2756	3628	msedge.exe	86
PID 3628 wrote to memory of 2756	3628	msedge.exe	86
PID 3628 wrote to memory of 2756	3628	msedge.exe	86
PID 3628 wrote to memory of 2756	3628	msedge.exe	86
PID 3628 wrote to memory of 2756	3628	msedge.exe	86
PID 3628 wrote to memory of 2756	3628	msedge.exe	86
PID 3628 wrote to memory of 2756	3628	msedge.exe	86
PID 3628 wrote to memory of 2756	3628	msedge.exe	86
PID 3628 wrote to memory of 2756	3628	msedge.exe	86
PID 3628 wrote to memory of 2756	3628	msedge.exe	86
PID 3628 wrote to memory of 2756	3628	msedge.exe	86
PID 3628 wrote to memory of 2756	3628	msedge.exe	86
PID 3628 wrote to memory of 2756	3628	msedge.exe	86
PID 3628 wrote to memory of 2756	3628	msedge.exe	86
PID 3628 wrote to memory of 2756	3628	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fde54a22ccf5547b26c2fe7b91226c25_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b22a46f8,0x7ff8b22a4708,0x7ff8b22a4718
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,4349153937961194870,8015486606036365666,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,4349153937961194870,8015486606036365666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,4349153937961194870,8015486606036365666,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4349153937961194870,8015486606036365666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4349153937961194870,8015486606036365666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4349153937961194870,8015486606036365666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,4349153937961194870,8015486606036365666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,4349153937961194870,8015486606036365666,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4349153937961194870,8015486606036365666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4349153937961194870,8015486606036365666,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4349153937961194870,8015486606036365666,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,4349153937961194870,8015486606036365666,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2084 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,4349153937961194870,8015486606036365666,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6096 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
b3122cc6945efe5da54e10408e073e8a

SHA1
0cce5be3c36bdfa4c1dbeec23a759c74babf3b31

SHA256
1cd02346297d786374830bc18cb26f715930b83c3b63da08f2eb002b5d45d3b7

SHA512
008494c47628ff0d966ef0661e2a5b1d67b75ed4936e64cf2d888cc4dcbd55350d8ce4a93f17afce69a1fc6f5665626735fdd3780324a21795ccc2cbbeb1027e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
787B

MD5
6b84d38629a7ac82a9dc6ae8c0568e36

SHA1
e5c9afe9e776e3ecdd61349da5eeeca466b833e0

SHA256
ca607a5a46477f853249c7c4e5064ad81b7d1a044c16cc6981f49c2851da201a

SHA512
c8f5a904c8a50077f4dbaea171897cc88b9ef5cf8c866314340a60b4bd864386ee33a690f1bf1d5201278f42e25871dd9dfef15edd033324a2c84dcb05739937

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3f19f39864476f5d68f5eed4cc0c1c90

SHA1
68b76c7c0a1ec9da72b697e08e2d21d556415d8f

SHA256
b92fd8b8a08c54478ed568906c7fe47b1c62f740ae3c3b7e15a256c2b9897921

SHA512
ca6829ac101212152e24d54adbab22b11ea770e93a251349ea4ebc91524186f4f82edb5f9e0d8a9144d920bc6318715ffb5ca5fd281335377f84d4592385309e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1f7b2844c4d0a041e528438938952c8b

SHA1
1bc2c28186fa22a08fb216970292d9dd28c609e8

SHA256
5f55436e88026ba173bd735c61936041daab85457298aff2364314aa9c3dff5e

SHA512
5928f050711956c428e398c1ef17695cda45422d1bab58bea0b9ab881a2c0ab9ac8cd03ca95257e9cb70f726329ba0547300bc1d83e07742ae753c9121aa8bb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ad8cd14210e8cc8d68066d2de2f56309

SHA1
7e4357149491125a31655f44d7edb5b856748c17

SHA256
dad1767bf2fd701f5453de3fbe74db68357b23a0f681f00d11362aefd8bc887b

SHA512
004e5f898b052abc6ad2ec030d815e3a6178ce804aa13e5b72de1ce3df0300f1a5aedde24eb76438ecc9f4ef0e449eac2d00939051378260e9a335d8799fe362

Download Submit