0e990b3a90fe4c851ecdae018ad004773726cd00b7e9a3945badc75b763fb685

Resubmissions

13/10/2024, 19:01

241013-xpk2naxdkm 3

13/10/2024, 18:59

241013-xm7gwaxclq 3

13/10/2024, 18:51

241013-xhldvawhqn 10

Analysis

max time kernel
1681s
max time network
1685s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
13/10/2024, 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41805ae55328e736681b95068fd1c3c1_JaffaCakes118.html
Size

158KB
MD5

41805ae55328e736681b95068fd1c3c1
SHA1

03ef740037336f0f01fa96ab99907c001ed19deb
SHA256

0e990b3a90fe4c851ecdae018ad004773726cd00b7e9a3945badc75b763fb685
SHA512

8f1900277620b173d7df1606c9c571505e3c1054a1a19c858cd96a455e76319636d38b087474909005742e453906451e5e5491f481df733af8cdeb7abb57464d
SSDEEP

3072:i0x3JO0F4yfkMY+BES09JXAnyrZalI+YQ:ic53F1sMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
5816	msedge.exe
5816	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
6092	msedge.exe
4196	msedge.exe
4196	msedge.exe
5784	identity_helper.exe
5784	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5816 wrote to memory of 5780	5816	msedge.exe	77
PID 5816 wrote to memory of 5780	5816	msedge.exe	77
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 3620	5816	msedge.exe	78
PID 5816 wrote to memory of 4136	5816	msedge.exe	79
PID 5816 wrote to memory of 4136	5816	msedge.exe	79
PID 5816 wrote to memory of 3560	5816	msedge.exe	80
PID 5816 wrote to memory of 3560	5816	msedge.exe	80
PID 5816 wrote to memory of 3560	5816	msedge.exe	80
PID 5816 wrote to memory of 3560	5816	msedge.exe	80
PID 5816 wrote to memory of 3560	5816	msedge.exe	80
PID 5816 wrote to memory of 3560	5816	msedge.exe	80
PID 5816 wrote to memory of 3560	5816	msedge.exe	80
PID 5816 wrote to memory of 3560	5816	msedge.exe	80
PID 5816 wrote to memory of 3560	5816	msedge.exe	80
PID 5816 wrote to memory of 3560	5816	msedge.exe	80
PID 5816 wrote to memory of 3560	5816	msedge.exe	80
PID 5816 wrote to memory of 3560	5816	msedge.exe	80
PID 5816 wrote to memory of 3560	5816	msedge.exe	80
PID 5816 wrote to memory of 3560	5816	msedge.exe	80
PID 5816 wrote to memory of 3560	5816	msedge.exe	80
PID 5816 wrote to memory of 3560	5816	msedge.exe	80
PID 5816 wrote to memory of 3560	5816	msedge.exe	80
PID 5816 wrote to memory of 3560	5816	msedge.exe	80
PID 5816 wrote to memory of 3560	5816	msedge.exe	80
PID 5816 wrote to memory of 3560	5816	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\41805ae55328e736681b95068fd1c3c1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb23ba3cb8,0x7ffb23ba3cc8,0x7ffb23ba3cd8
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,9683744638079714535,3252130726292673370,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,9683744638079714535,3252130726292673370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,9683744638079714535,3252130726292673370,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,9683744638079714535,3252130726292673370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,9683744638079714535,3252130726292673370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,9683744638079714535,3252130726292673370,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1580 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,9683744638079714535,3252130726292673370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,9683744638079714535,3252130726292673370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,9683744638079714535,3252130726292673370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,9683744638079714535,3252130726292673370,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,9683744638079714535,3252130726292673370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,9683744638079714535,3252130726292673370,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
003b92b33b2eb97e6c1a0929121829b8

SHA1
6f18e96c7a2e07fb5a80acb3c9916748fd48827a

SHA256
8001f251d5932a62bfe17b0ba3686ce255ecf9adb95a06ecb954faa096be3e54

SHA512
18005c6c07475e6dd1ec310fe511353381cf0f15d086cf20dc6ed8825c872944185c767f80306e56fec9380804933aa37a8f12c720398b4b3b42cb216b41cf77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
051a939f60dced99602add88b5b71f58

SHA1
a71acd61be911ff6ff7e5a9e5965597c8c7c0765

SHA256
2cff121889a0a77f49cdc4564bdd1320cf588c9dcd36012dbc3669cf73015d10

SHA512
a9c72ed43b895089a9e036aba6da96213fedd2f05f0a69ae8d1fa07851ac8263e58af86c7103ce4b4f9cfe92f9c9d0a46085c066a54ce825ef53505fdb988d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
09fec4a95a987c1e3b298eae35a8eff0

SHA1
8c590ca2d3dd6122e68ecf73beff8f42dba546d9

SHA256
98a7c678a9b85922dbbfee562f2ed939fe98c70aa35b7346f0d6da5a9038b10a

SHA512
51cd21d70791024b56ea919ddb1a5eee480e3462731aaf946bb36ea3f8e27bd0cdeacee0bed03d59d36a5e828fdcf1c17c5615683f556e846b54f21197304853

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c685f608b04853adc63fe2dbb295f989

SHA1
78db0806db6c460495972a41b75e8bb4fdb7488f

SHA256
4b9891833e3251ac917853d08d1b094fb7ed293579c747b1d076ad96a754d285

SHA512
3731f2995088fcbd645481e30ba5e621b8c23e42dff019cf9e6e93223218230c488e1a12081e4d1602ef9229ab6051ed6967e7aca32108eb89c97722a7739c87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9d77ab87107ef69d9340427c34c1eb13

SHA1
b0cea5d90694cb2b5593b512ddecf10ed237468d

SHA256
3e842acb73560813ab9f5d00d574647f2a98d6c2dd1a3678145573f4bafb8f87

SHA512
56ea5b6d2461dd67fa603e30f3b7dc05925e8fa6583696e52a5146729bbb35eabc1ee3264ad11db368d081730b50f12a53a3c938570ca34ec45b9e199b971600

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6c6c34893566d2ae5853e0adfb23e3e2

SHA1
e1dc04cd33b59b0700437dff84f63261cc223071

SHA256
d7bc5092583cd7180674c7e16912353ad49e02b5534030ab553b7584a0e44b77

SHA512
707d9b0aece76a4e6a3684587ea6bd0d17973e5e914c4a76f41196d4c2133e95a6ffc145e49f2c79d3398a93b35abcc3c8d4505bb67aa76876dc8e3356d76e26

Download Submit