7aa3554990547fb61ba7cbd90e1550a50b867c5c849adabc33016279e255f4c8

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 15:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4098e83d2926578bffe3fa44e7e9b23c_JaffaCakes118.html
Size

32KB
MD5

4098e83d2926578bffe3fa44e7e9b23c
SHA1

d17eb7aa9dc123b15e8c96111dd2057f4c5e38cb
SHA256

7aa3554990547fb61ba7cbd90e1550a50b867c5c849adabc33016279e255f4c8
SHA512

881b22d897e4f2cb714e19ac5d1032a1b631cfc3e8ccb59e687b71504e56ae7c3858aca9e3ce788502017b1551a58536b5b527cc9ad41b14a3def77beff735ac
SSDEEP

384:/SlIcqtQ4HPGTHGagz+eAM7tj9saTGs1era1KH17ktuuQFkxchxUm5/gRPVzguLZ:RyGYvJgZVxLZ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4688	msedge.exe
4688	msedge.exe
2892	msedge.exe
2892	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe
4056	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 3424	2892	msedge.exe	85
PID 2892 wrote to memory of 3424	2892	msedge.exe	85
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4084	2892	msedge.exe	86
PID 2892 wrote to memory of 4688	2892	msedge.exe	87
PID 2892 wrote to memory of 4688	2892	msedge.exe	87
PID 2892 wrote to memory of 4508	2892	msedge.exe	88
PID 2892 wrote to memory of 4508	2892	msedge.exe	88
PID 2892 wrote to memory of 4508	2892	msedge.exe	88
PID 2892 wrote to memory of 4508	2892	msedge.exe	88
PID 2892 wrote to memory of 4508	2892	msedge.exe	88
PID 2892 wrote to memory of 4508	2892	msedge.exe	88
PID 2892 wrote to memory of 4508	2892	msedge.exe	88
PID 2892 wrote to memory of 4508	2892	msedge.exe	88
PID 2892 wrote to memory of 4508	2892	msedge.exe	88
PID 2892 wrote to memory of 4508	2892	msedge.exe	88
PID 2892 wrote to memory of 4508	2892	msedge.exe	88
PID 2892 wrote to memory of 4508	2892	msedge.exe	88
PID 2892 wrote to memory of 4508	2892	msedge.exe	88
PID 2892 wrote to memory of 4508	2892	msedge.exe	88
PID 2892 wrote to memory of 4508	2892	msedge.exe	88
PID 2892 wrote to memory of 4508	2892	msedge.exe	88
PID 2892 wrote to memory of 4508	2892	msedge.exe	88
PID 2892 wrote to memory of 4508	2892	msedge.exe	88
PID 2892 wrote to memory of 4508	2892	msedge.exe	88
PID 2892 wrote to memory of 4508	2892	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4098e83d2926578bffe3fa44e7e9b23c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe06a046f8,0x7ffe06a04708,0x7ffe06a04718
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11436738357698973186,8738899883517949378,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,11436738357698973186,8738899883517949378,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,11436738357698973186,8738899883517949378,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11436738357698973186,8738899883517949378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11436738357698973186,8738899883517949378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11436738357698973186,8738899883517949378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11436738357698973186,8738899883517949378,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5148 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
856e3950cb3f929596cfda18b1c38c94

SHA1
69cca369754430ee349afff3978817c99d0bffd8

SHA256
41d5ed4c827101669ecdc1fdbf65bed1364bd641b47711a8141fbcd6bc1494a7

SHA512
6e55dfc563bea5549fa8333eaed8df83df2257e480f6e2651bb81753cb16f06bfc97b873af713dbb37504600db18c5906ef95e4bb35572b26834dafab96c0b76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6478bef5aca5831b7c9697de580ec591

SHA1
f8a3547fef8a1a3b719e1f9055ad3b4d4bf1fe1a

SHA256
12e950448b81c40edaf880e7af5875e568568096dfa77ff621ca688e3382831a

SHA512
0d814e893ebe97ad553a27114b3c0cd253ad9e78a7cfa36a96341d5806aa9c899424db62b7d0f824c6f3dd79661dcdd9e024e0f4a013c9427d9d6f15807cf92e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c7b2a512546d0652b4f0c2ac24a1232a

SHA1
e5d4ec401c5ccc2f30c42fa8fb1536b75ebf104e

SHA256
d69ea31bc3c66fca1c7ca4b600d1fa3b9afcdb39527d4cda5517eb13c0625f54

SHA512
92b280e887fbb50b46ab38812ed84627e4319328420ec36a59cf139e4b9ea52c7df63460bbbd93a6d378c8a3280caac83bc02de06425a8fe269907f93e0be3eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4c07b08163676b1265b95daa5b8e8f5a

SHA1
e02ef84d02983206b303ef2e3bd024cc66b2937a

SHA256
e7739f7b8538d3ec7386ddfb2170ac73b77d09336c2206184629ef9dbf480e3e

SHA512
f1ab8172ea5b5de15bf8c164315a7e0632a392b613436381afa113b282463b69577fae7dc59e843d0f1283009372fd9c711ff00c65ba410d05fbbadfb789d8b3

Download Submit