800cf77d70eb4c60cb0305c917756187231ecb562a63d46a2bf6ffd80ec698f4

Analysis

max time kernel
139s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 02:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9c248ed9420f4111e715c24ebf9fb8f_JaffaCakes118.html
Size

157KB
MD5

f9c248ed9420f4111e715c24ebf9fb8f
SHA1

e28dd2981f6dd219e7de26dff5cb06ff5939eb38
SHA256

800cf77d70eb4c60cb0305c917756187231ecb562a63d46a2bf6ffd80ec698f4
SHA512

81e40d0a6c4537283414cf2d96561fcd3d1fd93e2f6c610a428be4493584809a7475b4a25d58fef4d48419c69f2140e90b5bebdbc1f08ddd12329e159237ae61
SSDEEP

1536:i/RToAnuL4+yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:iR64+yfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3336	msedge.exe
3336	msedge.exe
1912	msedge.exe
1912	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4192	identity_helper.exe
4192	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 4448	1912	msedge.exe	82
PID 1912 wrote to memory of 4448	1912	msedge.exe	82
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 740	1912	msedge.exe	83
PID 1912 wrote to memory of 3336	1912	msedge.exe	84
PID 1912 wrote to memory of 3336	1912	msedge.exe	84
PID 1912 wrote to memory of 4784	1912	msedge.exe	85
PID 1912 wrote to memory of 4784	1912	msedge.exe	85
PID 1912 wrote to memory of 4784	1912	msedge.exe	85
PID 1912 wrote to memory of 4784	1912	msedge.exe	85
PID 1912 wrote to memory of 4784	1912	msedge.exe	85
PID 1912 wrote to memory of 4784	1912	msedge.exe	85
PID 1912 wrote to memory of 4784	1912	msedge.exe	85
PID 1912 wrote to memory of 4784	1912	msedge.exe	85
PID 1912 wrote to memory of 4784	1912	msedge.exe	85
PID 1912 wrote to memory of 4784	1912	msedge.exe	85
PID 1912 wrote to memory of 4784	1912	msedge.exe	85
PID 1912 wrote to memory of 4784	1912	msedge.exe	85
PID 1912 wrote to memory of 4784	1912	msedge.exe	85
PID 1912 wrote to memory of 4784	1912	msedge.exe	85
PID 1912 wrote to memory of 4784	1912	msedge.exe	85
PID 1912 wrote to memory of 4784	1912	msedge.exe	85
PID 1912 wrote to memory of 4784	1912	msedge.exe	85
PID 1912 wrote to memory of 4784	1912	msedge.exe	85
PID 1912 wrote to memory of 4784	1912	msedge.exe	85
PID 1912 wrote to memory of 4784	1912	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\f9c248ed9420f4111e715c24ebf9fb8f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93b0346f8,0x7ff93b034708,0x7ff93b034718
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,13755400485265534816,5938443109331783967,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,13755400485265534816,5938443109331783967,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,13755400485265534816,5938443109331783967,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13755400485265534816,5938443109331783967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13755400485265534816,5938443109331783967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,13755400485265534816,5938443109331783967,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4952 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,13755400485265534816,5938443109331783967,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3076 /prefetch:8
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,13755400485265534816,5938443109331783967,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13755400485265534816,5938443109331783967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13755400485265534816,5938443109331783967,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13755400485265534816,5938443109331783967,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,13755400485265534816,5938443109331783967,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:2628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8caa08ec-3b8a-4127-aede-119c5607f220.tmp

Filesize
5KB

MD5
e8095615b91fc5668f62eec58bc0429c

SHA1
e47af91279825005cdcb3c7d11b6d661b835fdec

SHA256
35102d74f959e58e102292182bf754bb90311ddd4c858dc01caa2a4ae3ee6a19

SHA512
19b9d2b38f10d0c539a9dd29885ad53ab16f6e3363b86c0687f32731963127104e87db5bb3c228737cc267784737acf9a161262b0b6f5bb8f6ad126809d1868b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b8b30f3e4f663fbf42b914f86b6c167d

SHA1
6f5ce1d90a15f7a6b083399ba6f89affb104234c

SHA256
3eb4234e8e91c102f5161f0f47689dd380ea3fdb674411078e9e1fedc741e47f

SHA512
b2678b4710103a5e3e49fe0571915919aca67116a6bff57f27d26e74fe24f09d8dea04126853768bde03761f11a07c6a1a649f6a5e26006d98fa7e101f1896f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5590d9ad8b24c28ea179fa9b54015fb2

SHA1
d3512ac74f33acaee6f9319afe855d7f3bf7d1df

SHA256
f66033ce3e2121e9146ce798541e4d8104cd544e76c4eaa8edeca0b499e786b3

SHA512
bcd718cdbf94e36964a13d6b24546c9f59be4599d0f33bc5f2d956d253e064ed9831d5376005368a40c748a57bd1391bf4d971bf4283c10302d6411f20d591a0

Download Submit