0f06733a7017f20e177d2aacbcdc2a30edf8eac0a04570f67a4be2a95db603e4

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/12/2024, 18:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc966d05a5f7af4601a083ec9b83e99c_JaffaCakes118.html
Size

2.3MB
MD5

fc966d05a5f7af4601a083ec9b83e99c
SHA1

e4be1cadb2b2acc04c61e7e1711d0cf7dc1af514
SHA256

0f06733a7017f20e177d2aacbcdc2a30edf8eac0a04570f67a4be2a95db603e4
SHA512

b30da0b4f6a0427223161c39c2888134ae6a4da67b8230f595cd411c6ff8aac0e065301ee04fafb218abc7390412968cc138c0eb9f14a1e288db825afec04575
SSDEEP

24576:2+Wt9BJ+Wt9Bq+Wt9B8+Wt9BX+Wt9Bt+Wt9B1+Wt9B5+Wt9Bi+Wt9BX+Wt9Bz+Wv:P

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3920	msedge.exe
3920	msedge.exe
484	msedge.exe
484	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
484	msedge.exe
484	msedge.exe
484	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe
484	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 484 wrote to memory of 2304	484	msedge.exe	82
PID 484 wrote to memory of 2304	484	msedge.exe	82
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 4276	484	msedge.exe	83
PID 484 wrote to memory of 3920	484	msedge.exe	84
PID 484 wrote to memory of 3920	484	msedge.exe	84
PID 484 wrote to memory of 1144	484	msedge.exe	85
PID 484 wrote to memory of 1144	484	msedge.exe	85
PID 484 wrote to memory of 1144	484	msedge.exe	85
PID 484 wrote to memory of 1144	484	msedge.exe	85
PID 484 wrote to memory of 1144	484	msedge.exe	85
PID 484 wrote to memory of 1144	484	msedge.exe	85
PID 484 wrote to memory of 1144	484	msedge.exe	85
PID 484 wrote to memory of 1144	484	msedge.exe	85
PID 484 wrote to memory of 1144	484	msedge.exe	85
PID 484 wrote to memory of 1144	484	msedge.exe	85
PID 484 wrote to memory of 1144	484	msedge.exe	85
PID 484 wrote to memory of 1144	484	msedge.exe	85
PID 484 wrote to memory of 1144	484	msedge.exe	85
PID 484 wrote to memory of 1144	484	msedge.exe	85
PID 484 wrote to memory of 1144	484	msedge.exe	85
PID 484 wrote to memory of 1144	484	msedge.exe	85
PID 484 wrote to memory of 1144	484	msedge.exe	85
PID 484 wrote to memory of 1144	484	msedge.exe	85
PID 484 wrote to memory of 1144	484	msedge.exe	85
PID 484 wrote to memory of 1144	484	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\fc966d05a5f7af4601a083ec9b83e99c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfe8646f8,0x7ffdfe864708,0x7ffdfe864718
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,1078932041509533436,4557155602769905143,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,1078932041509533436,4557155602769905143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,1078932041509533436,4557155602769905143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1078932041509533436,4557155602769905143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1078932041509533436,4557155602769905143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1078932041509533436,4557155602769905143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,1078932041509533436,4557155602769905143,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
318B

MD5
3ac700b6b703d42f85a5e44fccccb039

SHA1
306050ed6aa7e710215b2ee2f07ad5392bf594cc

SHA256
19cf364a0cac64b6279e5bef757823689586a3f7713242c4badfbd5435e7c09e

SHA512
556dd523de0fb989152422eab7373456a2613abd264e1c8505259e021cd56549f617cf86548fd1dc9479c4e0ee05378aa062b7b7a61133b6dd848b7f6cebbc5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bb6db1a633b1022455b19caa0dc3885c

SHA1
3437ec9fa2313089b9df4b38360e86a42ebfcc06

SHA256
2e8c2645e8c5d16e424bea3675baa5e37e0fe2cb2bbaacbd1c9574c87cbc317c

SHA512
86b17a18db0fc5603a2a211d62b62cf184d24df0102f9f946af9c79eb0abe0c0d379b967fc9b2d630397b685a5461d4da471a9cd564e4e48a758cf814b016088

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6a0ac89dc046b66bbc86b7734a0581da

SHA1
251e163f270cc4e3d6439ad1bdb524a6b68febe7

SHA256
77954cfa44894003dae6fe256b13edf48a5af154e4717d5ff9748097fed887cf

SHA512
02cb7237f1bbff66ecd09c36956b4a9b07ab7b5933ebef79644e414ed32034623d7ea6a1d67eb4d894e959d8afc47be7aae8dffdb4f3c3b403c67844a451de2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cd38690ff718878c35a908cf905b39df

SHA1
829652e6216ba5dd632966a1700ef8aa65ccbf88

SHA256
cbc446846d6e61f8158f7898b376e6eda5ee5e50f83eb3ef3274277945d5dada

SHA512
e88b594e796f5e5d1dd054b8e00007a635c4e1fcecc75e4239c954e2c228ffe6260e31e4713f66ec4f9f56bd9cc444dff3a0dfc7871c5f98452806980d745380

Download Submit