c124d27263533937f6c445a6bba50a94175a3d70a90e87a66ef1696784dac1d6

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2024 09:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe41105b29e52f9a02d8b59dc5955839_JaffaCakes118.html
Size

106KB
MD5

fe41105b29e52f9a02d8b59dc5955839
SHA1

b9c90a89ee223479e695baad8482c34e99df273c
SHA256

c124d27263533937f6c445a6bba50a94175a3d70a90e87a66ef1696784dac1d6
SHA512

15f743d0e9fabf0d2b848736623c0a759ce074bc14901900f94905eef05e17af74ed3abdc977afc93278629fe6279853cd4c31e416e382768acefeddb9617aee
SSDEEP

768:IYnIpTVpXYCcCIM3iqSptryuNtf/IIs8y976erLp4LmOStrvsmX3zt+6TR+8+2Ld:I7TVpUECeuNt3IIsFXvsmpF+8d66

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
1124	msedge.exe
1124	msedge.exe
1540	identity_helper.exe
1540	identity_helper.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe
1576	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 860	1124	msedge.exe	82
PID 1124 wrote to memory of 860	1124	msedge.exe	82
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 3316	1124	msedge.exe	83
PID 1124 wrote to memory of 2464	1124	msedge.exe	84
PID 1124 wrote to memory of 2464	1124	msedge.exe	84
PID 1124 wrote to memory of 5048	1124	msedge.exe	85
PID 1124 wrote to memory of 5048	1124	msedge.exe	85
PID 1124 wrote to memory of 5048	1124	msedge.exe	85
PID 1124 wrote to memory of 5048	1124	msedge.exe	85
PID 1124 wrote to memory of 5048	1124	msedge.exe	85
PID 1124 wrote to memory of 5048	1124	msedge.exe	85
PID 1124 wrote to memory of 5048	1124	msedge.exe	85
PID 1124 wrote to memory of 5048	1124	msedge.exe	85
PID 1124 wrote to memory of 5048	1124	msedge.exe	85
PID 1124 wrote to memory of 5048	1124	msedge.exe	85
PID 1124 wrote to memory of 5048	1124	msedge.exe	85
PID 1124 wrote to memory of 5048	1124	msedge.exe	85
PID 1124 wrote to memory of 5048	1124	msedge.exe	85
PID 1124 wrote to memory of 5048	1124	msedge.exe	85
PID 1124 wrote to memory of 5048	1124	msedge.exe	85
PID 1124 wrote to memory of 5048	1124	msedge.exe	85
PID 1124 wrote to memory of 5048	1124	msedge.exe	85
PID 1124 wrote to memory of 5048	1124	msedge.exe	85
PID 1124 wrote to memory of 5048	1124	msedge.exe	85
PID 1124 wrote to memory of 5048	1124	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fe41105b29e52f9a02d8b59dc5955839_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeadb946f8,0x7ffeadb94708,0x7ffeadb94718
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3452682276246063572,6584592620050713556,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,3452682276246063572,6584592620050713556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,3452682276246063572,6584592620050713556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3452682276246063572,6584592620050713556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3452682276246063572,6584592620050713556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,3452682276246063572,6584592620050713556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,3452682276246063572,6584592620050713556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3452682276246063572,6584592620050713556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3452682276246063572,6584592620050713556,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3452682276246063572,6584592620050713556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,3452682276246063572,6584592620050713556,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,3452682276246063572,6584592620050713556,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
260B

MD5
757d4a9ffd9e91ad5321439c1010085b

SHA1
53aad9b5e155e474403a6de03dd054ad128fe810

SHA256
c62becfb4dcc20a34e3637cc87cc266f02c005b5f6e681c7ef031c8fd0eac2e5

SHA512
1e89fdd16317280bd18001d3651251d46bf73b74bf9770839c9a3f269b718dbfbce9cb27ed4b6574fb47146ed91191302916e21b87e80faa69e4d59be4afdcf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5ea035cb2c62d22460daf4a5f01fd93c

SHA1
58197ed995269aed8da91e2ac21313c0ecf75a9d

SHA256
b2cf01f09c1772edceca2baca940333774f21bbc108049271cc821204d478d8e

SHA512
61290f213767a8f1775c201fa8fd454f8baad184a8e89881c81aa6550c173c2cb1948537d87292979738e5deea28c7a6dc740591c177137709ecc7a16869a64e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ab4d50ec62ff1c50aabde2c238d36333

SHA1
dc9384d72d7579387c803e52d38193e1c37040f5

SHA256
b9526d12e2818547736bc56cad3f6c9e0ebae6d2ebeeed8354a7af90032b0744

SHA512
0b93684cd3f3d7a3d800a8dfb0fe2a20bd58b5d2f4c6fb31e6d9fc7b9feacaf8b1d33db49fc66f281ee22d6690b1b25386e9914f5f9ce34082b62bb6aff602a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
534B

MD5
29a2136f7d7aa5047eaa8133a9a10238

SHA1
90c100e0e100ed88cf8618c6e36bb8a807c41e22

SHA256
e1def07407eef5b0466fcb996d4cbc83ad15aeb75a411f2debcded5bcd9e50b0

SHA512
8b8fca5151aaf0df854ec8758ef49ad37240a567c6b6b5691c3d90967a1b219954138f3b9726d37ee886aa779c70be0e91860efb798cf28647de26a690ca7a07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
532B

MD5
d5a1b03c6bc2a7c37aeabe68850b92c9

SHA1
0d0b181b45c994b515b6bb22427bf18e28c0dda7

SHA256
5806e820b990f00346f24042b08b4d639c799b058fcd73a0d4801f013da812a9

SHA512
66db727fbcf252f7fd7e8c6eb4f236780907f22ba8719667e613f06ebdf2e822ce624f83a9c3395036418855dd7fa1a2b923c7af7d83443529e7711d939b4746

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585714.TMP

Filesize
532B

MD5
4f1a56162e5537e859574ef7d9744772

SHA1
4e7a5329f74b237b48dbe812831101b96aa9f9cc

SHA256
386a1c8beb039ef890975301e004a39eba1dfae7f2e71d9f85330ce4be7e7753

SHA512
1b3f003aea2007e9c929e6af99de07d6824f8ac11faaa12e61d517059e36f74d63e7d65ece7d70a6e984f6ab150f39107a522f8fb0b6305d49e9cf3a6646ff54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6aa0b1b2f4a9a420cbd17ee16e658421

SHA1
bf802e130514089c971e3792cbb11b0e7501b85a

SHA256
95ac44e8a25763f0006d41aae40e557efe1f2630623aba2a05873c0f34c9a1c2

SHA512
05a2705a922e06ea6388db041e9643da4a82cde15ebb60d90afc67cdf49c8e363069334227ac9e3f2ebca4b307b3f2773a19db68199af609c032356653b5435d

Download Submit