e16e1e86dcae9860ac4e3cb929b31e9ff7009447b3e050ea0dc124333f847923

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ff0e58fa2659e82b8587b90feff3bb8c_JaffaCakes118.html
Size 6KB
Sample240929-weml3atepl
SHA256 e16e1e86dcae9860ac4e3cb929b31e9ff7009447b3e050ea0dc124333f847923
MD5 ff0e58fa2659e82b8587b90feff3bb8c
SHA1 f41aba0ccb7e398c3b25b5767f41875e245dc2fc
SHA512 91262c684cc7b36e30620374a8adbb52c35cd5fe56f9448b177b5a170a1ec4641c3e62a354ce454fdf718625c7ba91ef4af0d97c1c0e7882837c9d8162b0d565
SSDEEP 96:fhM3sHfIboV/TJibpiVB4tNL8GoZWhWJ0fVz:fhM32Ew/ViE4tNgGcWok
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe
1864	msedge.exe
1864	msedge.exe
1968	identity_helper.exe
1968	identity_helper.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 4196	1864	msedge.exe	83
PID 1864 wrote to memory of 4196	1864	msedge.exe	83
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 2400	1864	msedge.exe	84
PID 1864 wrote to memory of 4480	1864	msedge.exe	85
PID 1864 wrote to memory of 4480	1864	msedge.exe	85
PID 1864 wrote to memory of 3512	1864	msedge.exe	86
PID 1864 wrote to memory of 3512	1864	msedge.exe	86
PID 1864 wrote to memory of 3512	1864	msedge.exe	86
PID 1864 wrote to memory of 3512	1864	msedge.exe	86
PID 1864 wrote to memory of 3512	1864	msedge.exe	86
PID 1864 wrote to memory of 3512	1864	msedge.exe	86
PID 1864 wrote to memory of 3512	1864	msedge.exe	86
PID 1864 wrote to memory of 3512	1864	msedge.exe	86
PID 1864 wrote to memory of 3512	1864	msedge.exe	86
PID 1864 wrote to memory of 3512	1864	msedge.exe	86
PID 1864 wrote to memory of 3512	1864	msedge.exe	86
PID 1864 wrote to memory of 3512	1864	msedge.exe	86
PID 1864 wrote to memory of 3512	1864	msedge.exe	86
PID 1864 wrote to memory of 3512	1864	msedge.exe	86
PID 1864 wrote to memory of 3512	1864	msedge.exe	86
PID 1864 wrote to memory of 3512	1864	msedge.exe	86
PID 1864 wrote to memory of 3512	1864	msedge.exe	86
PID 1864 wrote to memory of 3512	1864	msedge.exe	86
PID 1864 wrote to memory of 3512	1864	msedge.exe	86
PID 1864 wrote to memory of 3512	1864	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ff0e58fa2659e82b8587b90feff3bb8c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b75546f8,0x7ff9b7554708,0x7ff9b7554718
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16474961954870204069,5394571430372037151,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,16474961954870204069,5394571430372037151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,16474961954870204069,5394571430372037151,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16474961954870204069,5394571430372037151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16474961954870204069,5394571430372037151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16474961954870204069,5394571430372037151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16474961954870204069,5394571430372037151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16474961954870204069,5394571430372037151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16474961954870204069,5394571430372037151,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16474961954870204069,5394571430372037151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16474961954870204069,5394571430372037151,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16474961954870204069,5394571430372037151,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1292 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4
MD5 9e3fc58a8fb86c93d19e1500b873ef6f
SHA1 c6aae5f4e26f5570db5e14bba8d5061867a33b56
SHA512 e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de
MD5 27304926d60324abe74d7a4b571c35ea
SHA1 78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1
SHA512 f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 4649fcd15da794a8ce012f1d41cad877f3b2059c11b43e333953436d23cd7c85
MD5 3d7f722349bb71dc2b009d2cacf83b28
SHA1 da6f8deb825c601f1050c2588263ed4adac9f890
SHA512 c4e78146116e5f52d3634d0111480bac0feef43b1044f771d9edabf8c1d1413045e1c93917810fa723a9e3a0284d012d2bbca6042471e78c5cf0a1c71547e6e0
SSDEEP 96:nnkx2SV1A9wpvWMoiVmdeH4piNf14UWQyV+VDCziEwb:nnkxFe9GWMX4k1Gro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 79f1ad35c84d818bfbd9bd5ae4e64f125d710d47510fc882413dd3a6a975afcc
MD5 469f9a17d247870d9c45c57e34fa6667
SHA1 815e3ad93520f46ae18ce856cf57f4595063a947
SHA512 4715a601ea0f124a03490a79a4d31109b38bd3838f71aacf3cdc1ca5e77879dfa321f7558c60c6f07513a18bb44175b3f139bef0b5c08e2cd96c2d0d59b54b38
SSDEEP 96:nnkxoSV1ANwpvWMoiVmdeH4piNf14UWQyV+VD7AiEwb:nnkx/eNGWMX4k1Grg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 728110e692683efea6901114530ec1fa7fb6839c12957c87b6ac85ed083db234
MD5 acbdaefb01e909db62fe4bcc093bae82
SHA1 758275f53d3b37579381cd127561771d528b9b2d
SHA512 e6e3467697d1d733a4ba18268967e4150d191b6e7232b6808db62faac57000cc2cb408b79127dfe5a62e5d9bcb995ea2a1e4fb3130cf2d63486797f70e2d23a6
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupKMtbe2RUQc8PIcM/bo5Zx5:A9iIxuERzA83h09RZxYKeLbQqZxPx
MD5 SHA1 SHA512 SSDEEP

Submit Download