b427bac47a522aa9e573ea75c3ccdbf070e7badd81d7807c21f81013d0d460d1

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2024, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a78cc15e5a2e2a4491ce729b114ddeb3_JaffaCakes118.html
Size 204KB
Sample241127-m8faea1lct
SHA256 b427bac47a522aa9e573ea75c3ccdbf070e7badd81d7807c21f81013d0d460d1
MD5 a78cc15e5a2e2a4491ce729b114ddeb3
SHA1 ec1d59ca2dbf9f78cbc7b861cfd7c68676637f49
SHA512 7e4b164e59129cddf35cec7555cbd707a7b08b0f5759099e3f16d65c2085f457bd4bc248c7f073cf4ffdecf1ad8789112c465a5d60acbc48b02244b04e12b803
SSDEEP 3072:StHFy+mXryZHJwpJBkjquyfkMY+BES09JXAnyrZalI+Y8cTmiiiiiiyn2zv:StMdG5AsMYod+X3oI+YdTmiiiiiiy2v
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2612	msedge.exe
2612	msedge.exe
3296	msedge.exe
3296	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe
3652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe
3296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 2360	3296	msedge.exe	82
PID 3296 wrote to memory of 2360	3296	msedge.exe	82
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2444	3296	msedge.exe	83
PID 3296 wrote to memory of 2612	3296	msedge.exe	84
PID 3296 wrote to memory of 2612	3296	msedge.exe	84
PID 3296 wrote to memory of 1888	3296	msedge.exe	85
PID 3296 wrote to memory of 1888	3296	msedge.exe	85
PID 3296 wrote to memory of 1888	3296	msedge.exe	85
PID 3296 wrote to memory of 1888	3296	msedge.exe	85
PID 3296 wrote to memory of 1888	3296	msedge.exe	85
PID 3296 wrote to memory of 1888	3296	msedge.exe	85
PID 3296 wrote to memory of 1888	3296	msedge.exe	85
PID 3296 wrote to memory of 1888	3296	msedge.exe	85
PID 3296 wrote to memory of 1888	3296	msedge.exe	85
PID 3296 wrote to memory of 1888	3296	msedge.exe	85
PID 3296 wrote to memory of 1888	3296	msedge.exe	85
PID 3296 wrote to memory of 1888	3296	msedge.exe	85
PID 3296 wrote to memory of 1888	3296	msedge.exe	85
PID 3296 wrote to memory of 1888	3296	msedge.exe	85
PID 3296 wrote to memory of 1888	3296	msedge.exe	85
PID 3296 wrote to memory of 1888	3296	msedge.exe	85
PID 3296 wrote to memory of 1888	3296	msedge.exe	85
PID 3296 wrote to memory of 1888	3296	msedge.exe	85
PID 3296 wrote to memory of 1888	3296	msedge.exe	85
PID 3296 wrote to memory of 1888	3296	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\a78cc15e5a2e2a4491ce729b114ddeb3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc46f246f8,0x7ffc46f24708,0x7ffc46f24718
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6922565849703650831,16511084313786014382,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,6922565849703650831,16511084313786014382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,6922565849703650831,16511084313786014382,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6922565849703650831,16511084313786014382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6922565849703650831,16511084313786014382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6922565849703650831,16511084313786014382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1012 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6922565849703650831,16511084313786014382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6922565849703650831,16511084313786014382,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5412 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea
MD5 fab8d8d865e33fe195732aa7dcb91c30
SHA1 2637e832f38acc70af3e511f5eba80fbd7461f2c
SHA512 39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6
MD5 36988ca14952e1848e81a959880ea217
SHA1 a0482ef725657760502c2d1a5abe0bb37aebaadb
SHA512 d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 ea76404c40a334fb268708ba1486e8b3fd451e17995cded031adf4673f0ba9c2
MD5 ffbc1d0d8904452819dbb0b165a3af12
SHA1 611e6bcbf1f7016db7511cd0cf5beab06f209e74
SHA512 66dcf552eeda1b52c6ec69449e7066d79e6fc168b31dbd59ae644bc7be95f5249aea3166405fc21c301bbf50cb0bf90c1f920daae5b7db3fabee0f3d99fae024
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 191B
SHA256 bc2e43ada8af732726a0baf953f4f973826763610a8e39d39503061a4570115a
MD5 a32cac947bf96ffffa6655e35afdc52a
SHA1 7de36712ec76416d21f78d5b484b2d4a10a5dfc6
SHA512 537dc375361a9cf94369c0c2a6b67837041b055de7ee95e88e5164134bb96680bc4a7127473c4e67d49d83cf8070ae26ce6c5701844e2ca250857297cb64996b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 409B
SHA256 99baf1d12a2f80e4e7d4ec4fae88054aa4d32e06a0ff749923ce7477470f71cb
MD5 593f87230ef01dcdadbebf9d99e0f7d8
SHA1 84b85d8ad16102db25bebe8bbfb5f0de16109b40
SHA512 e3bbb3ec36827195b5372440b6885f10f5d50e5b541465eef0fefb630ecc33bb9f74d22db99269ce6afbf1d8b782cf12ffa452666046bc24a32c7fa54a190182
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 834ede438e9a63a0dfd583aa19e013b1a025f7360bbc825281849ecea28bbd5f
MD5 8dfb8f5e2b30b12c7d57cf4adda08ecc
SHA1 ee776a0fe4cc0998021d30039101784c1348ef33
SHA512 8f740e0b556146cba76613db2fb870694a132181fb7894459cb65ce2b8f88df996d3858a259387ff44934e8e1be9d04e55849b92dee354cd5ab30385b2cb3758
SSDEEP 96:nCukJS41sKhSwpvWMoiVmdebzqBjVs78YIUWQyV+VDCAiEwb:n9kF2K8GWM3qB1rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 53fe148208f8e5b172d6f05ee3719a2dd3c6122140d17a28fed93a54c7ba1010
MD5 17264e1a57a1de6f588a4db773b23bda
SHA1 f3fa2226a02961b7ace12d6f308e27f1130b547a
SHA512 958bbfbd5eefdff764753d448ec66dfa0d4f0936d4e8ed82b5f05b102b98fe4bd05a6bc78b4fb824e0e9f8af5a6e602f33212ee6ba260d7353e961ab3aa86f3c
SSDEEP 96:nCukyS41sKaSwpvWMoiVmdeHBjs78YIUWQyV+VDCziEwb:n9k42KBGWMXBbro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4c8da7512783a73d3ff5a97386818fe4807408190e4ea50f1564b44ee168d82b
MD5 18465b412c0078900b2b0b57fdc7967d
SHA1 c3c8e2ecfe61c3a1dae6e70de8e525825b46fd5b
SHA512 e81014f3565dda2ae0aef2c197cba33e36f069c5d1398fa308dd4183e0d71b0757f67b9922671a2134cca76185d7cc61f6e61df1a817302a0a7ae7da321f68d3
SSDEEP 96:nCukJS41sKaSwpvWMoiVmdeHBjs78YIUWQyV+VDCAiEwb:n9kF2KBGWMXBbrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 d76e5fecd78415f86f8769fcb1969c8fb42c9ca293d3a6155edbb87a1abd9d46
MD5 e448e938589ca11091a140c46f1f8831
SHA1 fd580697edab84e307e239dd962638c7ffd13178
SHA512 5731de952403c625dc13d93a6fd5c93d39f0e4a234a20b29cb0f43ef9942d189e617214fd39c6112d2898e545daab5061de80d226156cb94878d26b9f656d9e6
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupme2RUcichM/YdF980JQwU6:A9iIxuERzA83h09RZxYolNM/Yi0YTu
MD5 SHA1 SHA512 SSDEEP

Submit Download