ebbc2f95302866d31c97d25f5429265348259077b737a151c32dd17b21cf928a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe1edde7eeb258eca92944d187f85945_JaffaCakes118.html
Size

36KB
MD5

fe1edde7eeb258eca92944d187f85945
SHA1

fe005cfca4acd67f465b9997e596eba2b53fab99
SHA256

ebbc2f95302866d31c97d25f5429265348259077b737a151c32dd17b21cf928a
SHA512

ee2e296f751536731e50ccb6773acf6d0d4d8d83033776eb6868fbb531c76073334ad3968c5297d5ec1e2681719ef3d79b8aa48d8114a012bc1fa05bc9adceda
SSDEEP

768:zwx/MDTHnf88hARNZPX8E1XnXrFLxNLlDNoPqkPTHlnkM3Gr6ThZOg6f9U56lLRD:Q/7bJxNVNufSM/P8yK

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1972	msedge.exe
1972	msedge.exe
2420	msedge.exe
2420	msedge.exe
3592	identity_helper.exe
3592	identity_helper.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe
2420	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2548	2420	msedge.exe	86
PID 2420 wrote to memory of 2548	2420	msedge.exe	86
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 4900	2420	msedge.exe	87
PID 2420 wrote to memory of 1972	2420	msedge.exe	88
PID 2420 wrote to memory of 1972	2420	msedge.exe	88
PID 2420 wrote to memory of 1872	2420	msedge.exe	89
PID 2420 wrote to memory of 1872	2420	msedge.exe	89
PID 2420 wrote to memory of 1872	2420	msedge.exe	89
PID 2420 wrote to memory of 1872	2420	msedge.exe	89
PID 2420 wrote to memory of 1872	2420	msedge.exe	89
PID 2420 wrote to memory of 1872	2420	msedge.exe	89
PID 2420 wrote to memory of 1872	2420	msedge.exe	89
PID 2420 wrote to memory of 1872	2420	msedge.exe	89
PID 2420 wrote to memory of 1872	2420	msedge.exe	89
PID 2420 wrote to memory of 1872	2420	msedge.exe	89
PID 2420 wrote to memory of 1872	2420	msedge.exe	89
PID 2420 wrote to memory of 1872	2420	msedge.exe	89
PID 2420 wrote to memory of 1872	2420	msedge.exe	89
PID 2420 wrote to memory of 1872	2420	msedge.exe	89
PID 2420 wrote to memory of 1872	2420	msedge.exe	89
PID 2420 wrote to memory of 1872	2420	msedge.exe	89
PID 2420 wrote to memory of 1872	2420	msedge.exe	89
PID 2420 wrote to memory of 1872	2420	msedge.exe	89
PID 2420 wrote to memory of 1872	2420	msedge.exe	89
PID 2420 wrote to memory of 1872	2420	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fe1edde7eeb258eca92944d187f85945_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc84f46f8,0x7fffc84f4708,0x7fffc84f4718
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,12770841149429917454,9059964062593384265,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,12770841149429917454,9059964062593384265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,12770841149429917454,9059964062593384265,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12770841149429917454,9059964062593384265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12770841149429917454,9059964062593384265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,12770841149429917454,9059964062593384265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,12770841149429917454,9059964062593384265,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12770841149429917454,9059964062593384265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12770841149429917454,9059964062593384265,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12770841149429917454,9059964062593384265,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12770841149429917454,9059964062593384265,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,12770841149429917454,9059964062593384265,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5268 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7006aacd11b992cd29fca21e619e86ea

SHA1
f224b726a114d4c73d7379236739d5fbb8e7f7b7

SHA256
3c434b96841d5a0fa0a04a6b503c3c4d46f1c4e3a1be77853175e5680e182814

SHA512
6de169882c0e01217c4ca01f6ead8e5ebb316a77558e51cd862532dbf9147d9e267f8db667ff6e9fa33164243724f5e437cb882392382f3cae1072dadb762c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b80cf20d9e8cf6a579981bfaab1bdce2

SHA1
171a886be3a882bd04206295ce7f1db5b8b7035e

SHA256
10d995b136b604440ac4033b2222543975779068a321d7bddf675d0cb2a4c2b1

SHA512
0233b34866be1afd214a1c8a9dcf8328d16246b3a5ef142295333547b4cfdc787c8627439a2ca03c20cb49107f7428d39696143b71f56b7f1f05029b3a14376a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
614B

MD5
3d68dde0196de344c76efc23e425a42a

SHA1
e1bb4005ce9b1ef2e3036c36fd015688dd048c2f

SHA256
6e1f1da775cb64a1ad077bfd271dae609a7cfd3c2864fc28896b2cf0c0ef0e23

SHA512
2ebd0259fffd7c12f47906ee12aed0cb5d9d3db036d55d5a62162605034af3384c61610229017d59fa0ba28d77e66d145031593ffa8daa657f98f6aa94965b32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
415d9320c75ac8ba610156b173924278

SHA1
84434171ce07fee0b1643c8e1b9475e875904ad6

SHA256
236ed18fa82bfc444510e034200e3b8e1726a4f42fa1cec115cc32f2f6d3bbcb

SHA512
f35f2910b7e3f4eb0acb7632be90d4d7abb8a22bfb3866c86dc6d258b543758fc21455698e01bc96cffea13b5bf59cd2ece59d58f92583a6fbadaa1cc058c170

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e4785cf4e69c267630676863eb4d8cb1

SHA1
d8174b8dbc54c7a7e2554929e7357a6ccd32551c

SHA256
460be289f4a49046cd266abcfd0fd4c25f5f6a14ac08179b973c3ae702bd46da

SHA512
b55e6e9a34ec6d705f90f79e8b841bb8294252ee38cdc746be694f30bfe04bdd6cb5e5cb8baa40d939355889b28d1ae1dd1f3cfe475286e3b32e6bd47c9440c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cda9f46e1bfb33bcce6ee5d301688cf0

SHA1
67ce2bf37af248f5c5a1d618a582b6d204ea0026

SHA256
7a61762c709c4556fa97d1569827073d0bd5ce0e30c30053ae5f3a02c552009a

SHA512
79a482cf12c6374469f70bc2a555c0aa702276777421770b1a5bdc56e684f810089e726d39fbe79687dfa5f6541c61c49f9608599e0ab41e904a51c4e7e6ca3f

Download Submit