bc1c250ddbba00ad95cbbea9da2506a2c5467931f7aed8e6eeb4b27fcd45ec0d

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2024, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
94ad7d2663448e73aeb7f15485841d49_JaffaCakes118.html
Size 36KB
Sample241124-ppcfhszjbx
SHA256 bc1c250ddbba00ad95cbbea9da2506a2c5467931f7aed8e6eeb4b27fcd45ec0d
MD5 94ad7d2663448e73aeb7f15485841d49
SHA1 e0efc8dfd88df156f0607a543d469c849783eb21
SHA512 e86c937396b5d73f33e6a38ecd0c806fb2120822566c68d8b7770eda2cef6825a5ce8aa204c89bba22a97ea7d9352afd9815572b7ed04d871c574d9f1dd4314a
SSDEEP 384:S/V+0DxVkDYqSOW2QZhautCgKgSQLDm6PRK0/VL3BawoKoQcCFx0Jp9dkc:S/VhSDYq7+CQLS6Pb/pBzR70Jp9dkc
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3856	msedge.exe
3856	msedge.exe
5036	msedge.exe
5036	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 1340	5036	msedge.exe	83
PID 5036 wrote to memory of 1340	5036	msedge.exe	83
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 1380	5036	msedge.exe	84
PID 5036 wrote to memory of 3856	5036	msedge.exe	85
PID 5036 wrote to memory of 3856	5036	msedge.exe	85
PID 5036 wrote to memory of 1176	5036	msedge.exe	86
PID 5036 wrote to memory of 1176	5036	msedge.exe	86
PID 5036 wrote to memory of 1176	5036	msedge.exe	86
PID 5036 wrote to memory of 1176	5036	msedge.exe	86
PID 5036 wrote to memory of 1176	5036	msedge.exe	86
PID 5036 wrote to memory of 1176	5036	msedge.exe	86
PID 5036 wrote to memory of 1176	5036	msedge.exe	86
PID 5036 wrote to memory of 1176	5036	msedge.exe	86
PID 5036 wrote to memory of 1176	5036	msedge.exe	86
PID 5036 wrote to memory of 1176	5036	msedge.exe	86
PID 5036 wrote to memory of 1176	5036	msedge.exe	86
PID 5036 wrote to memory of 1176	5036	msedge.exe	86
PID 5036 wrote to memory of 1176	5036	msedge.exe	86
PID 5036 wrote to memory of 1176	5036	msedge.exe	86
PID 5036 wrote to memory of 1176	5036	msedge.exe	86
PID 5036 wrote to memory of 1176	5036	msedge.exe	86
PID 5036 wrote to memory of 1176	5036	msedge.exe	86
PID 5036 wrote to memory of 1176	5036	msedge.exe	86
PID 5036 wrote to memory of 1176	5036	msedge.exe	86
PID 5036 wrote to memory of 1176	5036	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\94ad7d2663448e73aeb7f15485841d49_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9acfe46f8,0x7ff9acfe4708,0x7ff9acfe4718
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,4195785691445871440,9109201755329398191,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,4195785691445871440,9109201755329398191,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,4195785691445871440,9109201755329398191,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4195785691445871440,9109201755329398191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4195785691445871440,9109201755329398191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4195785691445871440,9109201755329398191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4195785691445871440,9109201755329398191,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,4195785691445871440,9109201755329398191,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574
MD5 e55832d7cd7e868a2c087c4c73678018
SHA1 ed7a2f6d6437e907218ffba9128802eaf414a0eb
SHA512 897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66
MD5 c2d9eeb3fdd75834f0ac3f9767de8d6f
SHA1 4d16a7e82190f8490a00008bd53d85fb92e379b0
SHA512 d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd
MD5 SHA1 SHA512

Submit Download

931eac2c-1c6b-45a5-9e65-032a0e94ecdc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\931eac2c-1c6b-45a5-9e65-032a0e94ecdc.tmp
Size 5KB
SHA256 19a0a42214811f81210af881130b08ddfcc58c7cb56d601b32bc9c9a91dd5d8a
MD5 2e941a5e752bcc64ca427f243ef57fae
SHA1 41a0912712317f7cd40cb59d4b33c9bcbe99eba9
SHA512 9655a9b3811d2a60f50bcd53db8f43d81d0c66f565da12e850f322390128385772a6b5566971a376acd841980fb569d76937a8b47104910cb8ea34f0490d2d59
SSDEEP 96:n8kOk1K0PfkwpvWMoiVmdeHycdpUWQyV+VDCziEwb:n8knE0UGWMXlpro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 b525e446b13d7b3b11cf9b20a9c5af429f9e582afea9027dc61358c641139568
MD5 dd5fe4e71c174e8c847495b42b0993c7
SHA1 17f403572a329ed513ee20daac3ef59fae04af8d
SHA512 8033c7a922e7e997871ab844f08f3cd458b3d35945aaad23ee7e424ddc0d019e81035e5f3435adec063eb2c03f8c73e5e1c11f2318d307fe5d636237d89dc0bb
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 195a0a1ccbc601d3a86057d1714099968859140bd11c8a2f584be42351434118
MD5 6cd6ce8db3d81bc0cac75921d2edee76
SHA1 255d0bb71f5c9016c1c3c2398e36498e776cacd1
SHA512 0342a03b186187294f2d35be289048c29b4487a4c7adf8b37ae0ca6861d418914e1c8744859d33f14e55d927bcdf6d46a01f3fd920564244f4031bdef45bd7ce
SSDEEP 96:n8kFk1KcPfkwpvWMoiVmdeZhNCK/yi2ycdpUWQyV+VDCAiEwb:n8kWEcUGWMJhNL/yi2lprV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 954ac07b196cb85a529cefcdf5037c221133db2f1a65a93d37f7b87bdce14649
MD5 2a1929c49eb3d8b6d0e9c4b9a428420a
SHA1 576dcf572c6ed34dc05af2fa4bb61215bfdbddad
SHA512 edfec2908f1d538d9a68e6643e61ace20f4f5c7b12307ce771e3378f7c135cd0c2129e07dfc8cf3a596005deef1968e33f33e8eb3962cbccf83d69aee2a44f7e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupCe2RUGhp4zaYdF980JQwUo:A9iIxuERzA83h09RZxY8ZWaYi0YNu
MD5 SHA1 SHA512 SSDEEP

Submit Download