fc6e3fd23b0436013ea440af4923bcb39df93e71744029d02a405546c6f53600

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

576625a4250f93a402cdb9a1fea0bd23_JaffaCakes118.html
Size

121KB
MD5

576625a4250f93a402cdb9a1fea0bd23
SHA1

8441eb35ae35e462e089a4b6b61398a14b0ae3de
SHA256

fc6e3fd23b0436013ea440af4923bcb39df93e71744029d02a405546c6f53600
SHA512

370fe777ce594ce7eac7ce2e8dba62ceda3c0189ec22f212172934da5574eec6fb8ef23d526d3fc6bd66c95e05c390078baddae087e6a8dc0cb9979d324eefc9
SSDEEP

768:Ixd57qMe3vhAoLKIdccvbz4dR6bVJadZoFIvzUVtll84kjUkdebIvcUCLw4:IH5+Fbnnf4PEVJaWWvzUVJ84kjUkQb44

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
940	msedge.exe
940	msedge.exe
4760	msedge.exe
4760	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 1736	4760	msedge.exe	84
PID 4760 wrote to memory of 1736	4760	msedge.exe	84
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 4980	4760	msedge.exe	85
PID 4760 wrote to memory of 940	4760	msedge.exe	86
PID 4760 wrote to memory of 940	4760	msedge.exe	86
PID 4760 wrote to memory of 2940	4760	msedge.exe	87
PID 4760 wrote to memory of 2940	4760	msedge.exe	87
PID 4760 wrote to memory of 2940	4760	msedge.exe	87
PID 4760 wrote to memory of 2940	4760	msedge.exe	87
PID 4760 wrote to memory of 2940	4760	msedge.exe	87
PID 4760 wrote to memory of 2940	4760	msedge.exe	87
PID 4760 wrote to memory of 2940	4760	msedge.exe	87
PID 4760 wrote to memory of 2940	4760	msedge.exe	87
PID 4760 wrote to memory of 2940	4760	msedge.exe	87
PID 4760 wrote to memory of 2940	4760	msedge.exe	87
PID 4760 wrote to memory of 2940	4760	msedge.exe	87
PID 4760 wrote to memory of 2940	4760	msedge.exe	87
PID 4760 wrote to memory of 2940	4760	msedge.exe	87
PID 4760 wrote to memory of 2940	4760	msedge.exe	87
PID 4760 wrote to memory of 2940	4760	msedge.exe	87
PID 4760 wrote to memory of 2940	4760	msedge.exe	87
PID 4760 wrote to memory of 2940	4760	msedge.exe	87
PID 4760 wrote to memory of 2940	4760	msedge.exe	87
PID 4760 wrote to memory of 2940	4760	msedge.exe	87
PID 4760 wrote to memory of 2940	4760	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\576625a4250f93a402cdb9a1fea0bd23_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a4b946f8,0x7ff9a4b94708,0x7ff9a4b94718
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,18102302563653912948,3544729821744821915,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,18102302563653912948,3544729821744821915,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,18102302563653912948,3544729821744821915,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,18102302563653912948,3544729821744821915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,18102302563653912948,3544729821744821915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,18102302563653912948,3544729821744821915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,18102302563653912948,3544729821744821915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,18102302563653912948,3544729821744821915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,18102302563653912948,3544729821744821915,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8e7941960b0129649c48cfc4d7b7d90f

SHA1
47ad34149341c93e60ec805be989ec1fd36e70b6

SHA256
a9776cddac796c4a938119cffcc8174c78080f13944dc06579dd4e75943fd7d1

SHA512
e45cfc879d6197141faf355f1397f6bad05c3e83fb73476b3c49314d7b7158db7ac9615111c35df475ceee826bbcb9fafa83911f00f761028198905981c3bf5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b1c49d714e96ea2b9a223b8a70226885

SHA1
86f440ec7533fb48c01f8497b1b62a28eac62ddd

SHA256
79af1dc24c701bccde8f8af559a71c93a8dd0d30233c957cdaf52d26d018fb96

SHA512
3f92d05574b45d712a64e9f0f20442785d25857dfc3162f310a511008f6d0d7f7a0e8c5ef5caf1863ca688e424660ef66617dbd273944ea28636e8300675b3ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dcda75fe9227cf807004a578b352f0f1

SHA1
3eda5f2180366c86bd4c4fb37c601a731005e912

SHA256
ba7238c57afda7b5b61b9764af0e006349bb618ab349948c02fd6dc7454bfab5

SHA512
a32973eb0f643cd3475e6ba85dfd72ef5d62b56e951d1a845218454b07e3bc4bab55a1f34543f86bcefc38983b7531e0545badb58399f8fdc44b5388484a256c

Download Submit