390f6b40200c5fc10bb7735a93a05572ff2504eea10dd5b361391281098ec3bc

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 07:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fe0546243068ef0ea7ca32fb59896e50_JaffaCakes118.html
Size

22KB
MD5

fe0546243068ef0ea7ca32fb59896e50
SHA1

263b43e9338935188a4a95daa2284ffd58628e47
SHA256

390f6b40200c5fc10bb7735a93a05572ff2504eea10dd5b361391281098ec3bc
SHA512

6840b84e359171d53199e4b551084c10cdfd8f186267a3132f590c70a484e244a23381b83843dae7f96b093fa0be94c949312992fbd8c2714122b045f0cb5776
SSDEEP

384:SIdTEmmfUAqOG5PZt4AnNUUPEPFi+MILwuPV3tjo:SOTEt/qZRY7U+E

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
2588	msedge.exe
2588	msedge.exe
3252	identity_helper.exe
3252	identity_helper.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe
2588	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 2316	2588	msedge.exe	82
PID 2588 wrote to memory of 2316	2588	msedge.exe	82
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3772	2588	msedge.exe	83
PID 2588 wrote to memory of 3204	2588	msedge.exe	84
PID 2588 wrote to memory of 3204	2588	msedge.exe	84
PID 2588 wrote to memory of 3824	2588	msedge.exe	85
PID 2588 wrote to memory of 3824	2588	msedge.exe	85
PID 2588 wrote to memory of 3824	2588	msedge.exe	85
PID 2588 wrote to memory of 3824	2588	msedge.exe	85
PID 2588 wrote to memory of 3824	2588	msedge.exe	85
PID 2588 wrote to memory of 3824	2588	msedge.exe	85
PID 2588 wrote to memory of 3824	2588	msedge.exe	85
PID 2588 wrote to memory of 3824	2588	msedge.exe	85
PID 2588 wrote to memory of 3824	2588	msedge.exe	85
PID 2588 wrote to memory of 3824	2588	msedge.exe	85
PID 2588 wrote to memory of 3824	2588	msedge.exe	85
PID 2588 wrote to memory of 3824	2588	msedge.exe	85
PID 2588 wrote to memory of 3824	2588	msedge.exe	85
PID 2588 wrote to memory of 3824	2588	msedge.exe	85
PID 2588 wrote to memory of 3824	2588	msedge.exe	85
PID 2588 wrote to memory of 3824	2588	msedge.exe	85
PID 2588 wrote to memory of 3824	2588	msedge.exe	85
PID 2588 wrote to memory of 3824	2588	msedge.exe	85
PID 2588 wrote to memory of 3824	2588	msedge.exe	85
PID 2588 wrote to memory of 3824	2588	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fe0546243068ef0ea7ca32fb59896e50_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaba0546f8,0x7ffaba054708,0x7ffaba054718
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11936731146994291218,12740518304413126512,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,11936731146994291218,12740518304413126512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,11936731146994291218,12740518304413126512,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11936731146994291218,12740518304413126512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11936731146994291218,12740518304413126512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,11936731146994291218,12740518304413126512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,11936731146994291218,12740518304413126512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11936731146994291218,12740518304413126512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11936731146994291218,12740518304413126512,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11936731146994291218,12740518304413126512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11936731146994291218,12740518304413126512,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11936731146994291218,12740518304413126512,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a2bcdceea64325297ea25476aa8c8688

SHA1
2c88e5f0cb410a1e8b32459e6625a42a81db769f

SHA256
43af296ce7ddc80c2f23af143428fd3cb6d7f6e6522df938fe208c02c6e09182

SHA512
16095f8cef074070b7cec7c7242cc124bc0761016c636507f87bfc5cfd871068cc98ba3af509713d8498135df2f2e00a7bd018886fe89613da334aa646844b5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
feadc1861ede79d396be6b7dcde19a52

SHA1
8129c9e2d460ac7ea89da5e05b70f21055b82b74

SHA256
538b7e2cc610d71a1e44dd6f6483d49a615cb142b1a62312ffba4731cb74048a

SHA512
7d9d8e12884b87be84d77957c8585bb5e8b5bde434873c7d5effddfd3e0cb8696421ef411ac87d47853e3f0d4353f52f1d05e4d2dc20548b155ee3f9af7f0cd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3973e53b559d4a13824228f1c4917a06

SHA1
6acb3ae0e01bafb12b3c2924c126b6352a8843d8

SHA256
8d44f093d247d37b5b38902a8cca12b89169cdddb39e143217606e544d451c62

SHA512
115709b91707445e0ee2ba47f58d16380ff0f1f15fe22ff97640f4660a17d0ee147493476e5be61c2216153365dcb19da0f212f6c89c458d6eaf5f72669d474f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7b54354d3c358f6ae8652ebb6e9e40a0

SHA1
7b52df44f1797cd80a44c4bba452f7a6ea5f2832

SHA256
34b9a37993a6850ce0c55b5cea354392f3c014c798b209b492df9909248803ae

SHA512
9134706878375337fca8c69d45a8c30b3b9077e332a82d4ccb2a70890205beb2d029c566b077707b2fd09ba38d59b2cb3fc57f63838906a0f2ccdd949ebce50b

Download Submit