a3ca910ff29028c60a0e19e70129e191801fbfe6ca067aa588fda2fe2656a4eb

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 02:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
37f72173fd392bb944d42fbcd364cb0d_JaffaCakes118.html
Size 33KB
Sample241012-cn2mssxcke
SHA256 a3ca910ff29028c60a0e19e70129e191801fbfe6ca067aa588fda2fe2656a4eb
MD5 37f72173fd392bb944d42fbcd364cb0d
SHA1 84498247c4386bb84bf6425544884b9f3ba3d991
SHA512 afc7e0cd53c2a0a54f6328235a11ce030eaddf244539327ea8b31fda61c220cd3ad60463e9c62eb57357c1019afe5014677afad2ac607edb02573add809a9317
SSDEEP 384:SjEFo9XQLOegUTZE98WCraL4XwsYJoatFnFs+BLqceSvuE1J:SjH9bRrL4XXyoaLWceSv1b
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1808	msedge.exe
1808	msedge.exe
4024	msedge.exe
4024	msedge.exe
3568	identity_helper.exe
3568	identity_helper.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 1104	4024	msedge.exe	85
PID 4024 wrote to memory of 1104	4024	msedge.exe	85
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 2596	4024	msedge.exe	87
PID 4024 wrote to memory of 1808	4024	msedge.exe	88
PID 4024 wrote to memory of 1808	4024	msedge.exe	88
PID 4024 wrote to memory of 4948	4024	msedge.exe	89
PID 4024 wrote to memory of 4948	4024	msedge.exe	89
PID 4024 wrote to memory of 4948	4024	msedge.exe	89
PID 4024 wrote to memory of 4948	4024	msedge.exe	89
PID 4024 wrote to memory of 4948	4024	msedge.exe	89
PID 4024 wrote to memory of 4948	4024	msedge.exe	89
PID 4024 wrote to memory of 4948	4024	msedge.exe	89
PID 4024 wrote to memory of 4948	4024	msedge.exe	89
PID 4024 wrote to memory of 4948	4024	msedge.exe	89
PID 4024 wrote to memory of 4948	4024	msedge.exe	89
PID 4024 wrote to memory of 4948	4024	msedge.exe	89
PID 4024 wrote to memory of 4948	4024	msedge.exe	89
PID 4024 wrote to memory of 4948	4024	msedge.exe	89
PID 4024 wrote to memory of 4948	4024	msedge.exe	89
PID 4024 wrote to memory of 4948	4024	msedge.exe	89
PID 4024 wrote to memory of 4948	4024	msedge.exe	89
PID 4024 wrote to memory of 4948	4024	msedge.exe	89
PID 4024 wrote to memory of 4948	4024	msedge.exe	89
PID 4024 wrote to memory of 4948	4024	msedge.exe	89
PID 4024 wrote to memory of 4948	4024	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\37f72173fd392bb944d42fbcd364cb0d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa388d46f8,0x7ffa388d4708,0x7ffa388d4718
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,8448199657978207996,5513487346467605110,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,8448199657978207996,5513487346467605110,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,8448199657978207996,5513487346467605110,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,8448199657978207996,5513487346467605110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,8448199657978207996,5513487346467605110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,8448199657978207996,5513487346467605110,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,8448199657978207996,5513487346467605110,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,8448199657978207996,5513487346467605110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,8448199657978207996,5513487346467605110,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,8448199657978207996,5513487346467605110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,8448199657978207996,5513487346467605110,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,8448199657978207996,5513487346467605110,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32
MD5 6960857d16aadfa79d36df8ebbf0e423
SHA1 e1db43bd478274366621a8c6497e270d46c6ed4f
SHA512 6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841
MD5 f426165d1e5f7df1b7a3758c306cd4ae
SHA1 59ef728fbbb5c4197600f61daec48556fec651c1
SHA512 8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 616B
SHA256 01ac82e348b5ea0fa63e0ffc0326e726badf7b4c324d05f3f4b04e8cb8ace4a7
MD5 711966522d714f6527d8f6daa388eed0
SHA1 22516c25f502b8aa58c39bb2b929f5c6353fd4e3
SHA512 2f107dbc8272961eb037f621aa7f10b4f91d721d83268f3cac7c9fc7f3436770c762fcd788bf391f1f94146a1a1dddc798df15d29f42c4b2e9d0891dbb2ed132
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fe89c96ce2a3fb003e961054bb6531479d4cd5b78b1bc3bcd8665e5dffae9262
MD5 f58606854638921343f17c7ff5302664
SHA1 ac8421de331c232ed05bf62f476bfe4329d77537
SHA512 ba8c1fcd045306b5486454d67abdf19618073a9e6ac7916a3ac7c65c31849f7a266234acf93e1c3611266b06155de83c39224174d2768566c9d01781a6f83b77
SSDEEP 96:nakuxm/BQYmqR16l1SnwpvWMoiVmdeHdwu+UWQyV+VDCziEwb:nakjK2QPaGWMXN+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 3adf3b2a147003bd4eb8db976f12334117c4cac7f6e8e7ba15e977f108af5573
MD5 5feac9c6c2707f3aca215b8a3af7ca56
SHA1 31fa49c84daf8b296fc9bb818f30cd7b5cf7bd34
SHA512 c4bd33c730d2cd20480437c44c5a5217fd7100f4bdd9acb16c57056ee7933913f31f99af5dd548cf27d4a9022523db88bc15ba263deb7691e51c86b6b9c56540
SSDEEP 96:nakuxm/B6mqR16v1SnwpvWMoiVmdeK1zcRVdMjp2dwu+UWQyV+VD7AiEwb:nakj/2QNaGWMad0DMjp2N+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 251498b8127a8a31991a2f40dc535ca614787147dcc5ef19e958d83f4423452a
MD5 00b8aa3b498851ec1f6ed820691cf48e
SHA1 5db7aa6b6f42f7caddfaa828e01fdf8d7497f0b3
SHA512 35e5863e5cce4ab139f32c1947e36385154e18bb9ad4eebc47aed9d66347328c827305f76bdf0a7224cb8024ac532c28e0e2f3ed33cdbdc0d76001451f42ba38
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupz2be2RUGRHj6+B1EdxKu:A9iIxuERzA83h09RZxYChZbETKu
MD5 SHA1 SHA512 SSDEEP

Submit Download