81e28aebc2197486e6a75e4bccbd56ca2e5acf3bf44354aa47059d6c4d6cce25

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
381ddfa281913962397c9a97a84de2ce_JaffaCakes118.html
Size 22KB
Sample241012-denv1stcmj
SHA256 81e28aebc2197486e6a75e4bccbd56ca2e5acf3bf44354aa47059d6c4d6cce25
MD5 381ddfa281913962397c9a97a84de2ce
SHA1 f8208e5d15267cf4ed554e5be7255140df0724a2
SHA512 22584902cba05e0ed8092b5547432ab7bd95b82e2ccfa832397e9e6e6ef8fdcc378a8eb0c9689be901632b95b412b42b55123e18f48da14f8098c87a6dbc2b54
SSDEEP 384:CjjN3hvsIxTNG4bwAeLxghaM2Ae7o11TGP72:CPNtsIxTNG4bwA0xYaM2A0o1TGPy
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
1356	msedge.exe
1356	msedge.exe
3924	identity_helper.exe
3924	identity_helper.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 1184	1356	msedge.exe	83
PID 1356 wrote to memory of 1184	1356	msedge.exe	83
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 1764	1356	msedge.exe	84
PID 1356 wrote to memory of 2816	1356	msedge.exe	85
PID 1356 wrote to memory of 2816	1356	msedge.exe	85
PID 1356 wrote to memory of 944	1356	msedge.exe	86
PID 1356 wrote to memory of 944	1356	msedge.exe	86
PID 1356 wrote to memory of 944	1356	msedge.exe	86
PID 1356 wrote to memory of 944	1356	msedge.exe	86
PID 1356 wrote to memory of 944	1356	msedge.exe	86
PID 1356 wrote to memory of 944	1356	msedge.exe	86
PID 1356 wrote to memory of 944	1356	msedge.exe	86
PID 1356 wrote to memory of 944	1356	msedge.exe	86
PID 1356 wrote to memory of 944	1356	msedge.exe	86
PID 1356 wrote to memory of 944	1356	msedge.exe	86
PID 1356 wrote to memory of 944	1356	msedge.exe	86
PID 1356 wrote to memory of 944	1356	msedge.exe	86
PID 1356 wrote to memory of 944	1356	msedge.exe	86
PID 1356 wrote to memory of 944	1356	msedge.exe	86
PID 1356 wrote to memory of 944	1356	msedge.exe	86
PID 1356 wrote to memory of 944	1356	msedge.exe	86
PID 1356 wrote to memory of 944	1356	msedge.exe	86
PID 1356 wrote to memory of 944	1356	msedge.exe	86
PID 1356 wrote to memory of 944	1356	msedge.exe	86
PID 1356 wrote to memory of 944	1356	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\381ddfa281913962397c9a97a84de2ce_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd366746f8,0x7ffd36674708,0x7ffd36674718
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6935210493744084842,15692166218045699836,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,6935210493744084842,15692166218045699836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,6935210493744084842,15692166218045699836,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6935210493744084842,15692166218045699836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6935210493744084842,15692166218045699836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6935210493744084842,15692166218045699836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6935210493744084842,15692166218045699836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6935210493744084842,15692166218045699836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6935210493744084842,15692166218045699836,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6935210493744084842,15692166218045699836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6935210493744084842,15692166218045699836,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6935210493744084842,15692166218045699836,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5696 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405
MD5 bffcefacce25cd03f3d5c9446ddb903d
SHA1 8923f84aa86db316d2f5c122fe3874bbe26f3bab
SHA512 761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6
MD5 d22073dea53e79d9b824f27ac5e9813e
SHA1 6d8a7281241248431a1571e6ddc55798b01fa961
SHA512 97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 485B
SHA256 fe0b7ab618f9d2f9cc5b39a0a46aa7f12e961f504b387b9c2dd0af244358859e
MD5 f90d0c04002060d9c6aa57731d7a22ef
SHA1 f8a19d487fd28c3a468f262d41c52c0d52c34a6e
SHA512 373b85bf1e1145463ba77c5bc3848e92dda4d5323595351698c43bfe89ea24c97905bf2017d622d5f87e700a8f3bcc250287fe8d0ddc3c3c40351496fb856606
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 62d6883f302d1203d56e889e7d5112a732d438d4c51c0a0d91902e16a39ffb00
MD5 88f99aa5ee67ccb4a1472b5c04963840
SHA1 38c92a72b2c3ef6ab4654f97f27154481d61fc8b
SHA512 08d1795c47e6cc7d8efc084315d75f3ec06a1d76a534795bdf43707314659b6b9e5774bde0256d0e9fd40b81e2d2ecd4fc1b89cb8ca118c0fb5302a93ec10956
SSDEEP 96:nOkAxm/BQYmqb12WcwbwpvWMoiVmdeHXj+RD0UWQyV+VDCziEwb:nOkxKEowbGWMXSD0ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c1de632ce766d503d70009773f1d517cc60abe8fb7e591a8a6ec2eb995cfc93c
MD5 fd45cedfd385bf8019225715e658e559
SHA1 62e98b7199796cc93f7f4eb8be96b10bd5cca8ea
SHA512 d1f712b1d1d67ab632705a484e9cb872e5384e30701ec3e5694504a59c172a19ae53aa81204f757d19bf5200765e06633bd7451098d65a3f581f58c838055812
SSDEEP 96:nOkAxm/B6mqb12WcwbwpvWMoiVmdeHXj+RD0UWQyV+VDCAiEwb:nOkx/EowbGWMXSD0rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 8c840230dbf17de923d16210d097373d37f35a43f64464aaab1b6344d23800b9
MD5 e9de4815f8ecbb468d3d532459e1c1a8
SHA1 8c3653850d4cd35135f5cef86e8d072d3c4685b5
SHA512 2f725d85df9c8505ffd677bb57a1c0510fc2ab9994d3b75714b2a990d4e06d77ac431a0e5a0b1c6a6d05e14204923067eb28010edefbc0af72ba8f7d3e506087
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupn3e2RUE4Ove6+B1Ei3Nu:A9iIxuERzA83h09RZxY/GY+bEsNu
MD5 SHA1 SHA512 SSDEEP

Submit Download