df93c7c23a4f01581148d76472fab6255b663be5281e68e1cd288735e07e1b4d

Analysis

max time kernel
139s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2024 06:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9309fc2ffde2fabe2e8ae09aae813c8f_JaffaCakes118.html
Size

157KB
MD5

9309fc2ffde2fabe2e8ae09aae813c8f
SHA1

991dc726acb6fd6b98b1691ee4716b43c8e74594
SHA256

df93c7c23a4f01581148d76472fab6255b663be5281e68e1cd288735e07e1b4d
SHA512

b34873f7893dfe9b87dd5ee452606984ab366128a1c6b23de53f9853662507a2e59dc24799cad69e75629e172f8cd0af7ff87441b3124ee161cc1194c7e89be6
SSDEEP

1536:idRTm1m7Kfb5+pyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:i7QV+pyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exe

pid	Process
3888	msedge.exe
3888	msedge.exe
488	msedge.exe
488	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
1464	msedge.exe
4860	identity_helper.exe
4860	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid	Process
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	Process
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe
488	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 488 wrote to memory of 4624	488	msedge.exe	82
PID 488 wrote to memory of 4624	488	msedge.exe	82
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 184	488	msedge.exe	83
PID 488 wrote to memory of 3888	488	msedge.exe	84
PID 488 wrote to memory of 3888	488	msedge.exe	84
PID 488 wrote to memory of 4568	488	msedge.exe	85
PID 488 wrote to memory of 4568	488	msedge.exe	85
PID 488 wrote to memory of 4568	488	msedge.exe	85
PID 488 wrote to memory of 4568	488	msedge.exe	85
PID 488 wrote to memory of 4568	488	msedge.exe	85
PID 488 wrote to memory of 4568	488	msedge.exe	85
PID 488 wrote to memory of 4568	488	msedge.exe	85
PID 488 wrote to memory of 4568	488	msedge.exe	85
PID 488 wrote to memory of 4568	488	msedge.exe	85
PID 488 wrote to memory of 4568	488	msedge.exe	85
PID 488 wrote to memory of 4568	488	msedge.exe	85
PID 488 wrote to memory of 4568	488	msedge.exe	85
PID 488 wrote to memory of 4568	488	msedge.exe	85
PID 488 wrote to memory of 4568	488	msedge.exe	85
PID 488 wrote to memory of 4568	488	msedge.exe	85
PID 488 wrote to memory of 4568	488	msedge.exe	85
PID 488 wrote to memory of 4568	488	msedge.exe	85
PID 488 wrote to memory of 4568	488	msedge.exe	85
PID 488 wrote to memory of 4568	488	msedge.exe	85
PID 488 wrote to memory of 4568	488	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\9309fc2ffde2fabe2e8ae09aae813c8f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9840e46f8,0x7ff9840e4708,0x7ff9840e4718
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,5544585456652513064,2847374281360302840,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,5544585456652513064,2847374281360302840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,5544585456652513064,2847374281360302840,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5544585456652513064,2847374281360302840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5544585456652513064,2847374281360302840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,5544585456652513064,2847374281360302840,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,5544585456652513064,2847374281360302840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,5544585456652513064,2847374281360302840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5544585456652513064,2847374281360302840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5544585456652513064,2847374281360302840,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5544585456652513064,2847374281360302840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,5544585456652513064,2847374281360302840,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1b9739f5776a018d1dfea64dee3f4897

SHA1
3dcea83f53d046c24318fb0748f4d0652b213456

SHA256
a667d0d19885a961de72e4ba4b89957e9904bb9ac99e878e7fc106da0b3091e0

SHA512
d22f0a192450d4185fe73674d0bde7f2fa1f68bcc16ade038c372028a891d230391e45d08c02db9d11b8fccc250abbc5a29ca3d7759dbab8cb937cb4066e46e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2c40d5d7c5e0a85321aa5a230e68a231

SHA1
c4ac788ba4da6897adc3c9ef661ca6b469fc547e

SHA256
9bc3a5bef04210d4751fd4ed395131776e8f7737a5a377be09fcddfb7eb45384

SHA512
bb513fae1e4dbaed4ae59181407a24fe987c642451e6546fbcf14555fae575ff2d227fc39dee997fd64407d2927973831bfa14645d675c041b2dfc61ed3d55c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f803f37a46928ee7cf0d57d85a62e7c5

SHA1
b7b5431d7648fd2460117dd60605481c8f69aaa7

SHA256
1adf67786e09df665fdefcfa0bc97b31d5f6e13dfc93ae7036ea774ec09d73c4

SHA512
532ceaeded22a2e1bc01076d55c9e767d05c4bc443153248eb441ee5cae7f079cfc5f022aa0f8fe1b205afc87e75d7b5e991a45126ee54665544a564238c6357

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c613848994419c2475479582438de815

SHA1
68a85f42f79418cabcf2170a8d42328163ec7043

SHA256
799321bbf745bc66e08bbd7e197620e8f458cdc66d5e7edbd2757634957c74c4

SHA512
b8f0797e76e3731a7842b841a00a3186e9483ccba34a91a1371336e05e9f68f584b768a35547b6c39c02a90ae41607c51d76264821009a41ab5fc1788bc3d265

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
62fa438b48fdfb61c360e6d4fd356110

SHA1
6e54e946a5211afa1459715b9f37a18ea92cdd57

SHA256
fe3d2e83848ede65097467a54ea813ed25a51119e87121089b3cfc531ebe5798

SHA512
01ada296a3fefe713f53d80d2c95b6e41231012d0998077b7948a68d961b61292d1e3b1b3457488eaa739fc4ff0974672ee448d29d2fcce2c1bebab49da96624

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
030eb06efcf7467cc5b3b46060dd0ef7

SHA1
446c3a0fb855ebbad676126705c5835cc93a850f

SHA256
792a2522d0971cf52feccaaf55abf353e56878867054e28703921f318bd295da

SHA512
3fe610605d6520a836bbfd3b875f7ec3df13ea2ebe10e81b4020789bb778e04ab686703d81e4ce2d890199baa5fb21e1aa09be1ff6f35ab3f565392cae6dba56

Download Submit
\??\pipe\LOCAL\crashpad_488_BBFZNXPRVNXAIUBQ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit