7ab50fd2881cbba088db3059acfd34db060f0e3abb8a9879c058d0433400d1d7

Analysis

max time kernel
145s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/08/2024, 17:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9421d23215012ff8fa41599c21b4a062_JaffaCakes118.html
Size

84KB
MD5

9421d23215012ff8fa41599c21b4a062
SHA1

985437a864a27314d3c7a4829270730f60f0f5d5
SHA256

7ab50fd2881cbba088db3059acfd34db060f0e3abb8a9879c058d0433400d1d7
SHA512

62bfc16f5a76f446f04108d526252fad3add45d0d68945a5ebfc028128fb12fc0282bcce6d5f089019dbb0aebc9d0db38e1b3d9be49badab6c9f76d5e9c6d312
SSDEEP

1536:pbMjw2fMk1D3O9Pj2fcRhLHANDZLlfrbcZmxxpPp:s2YtLxH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4988	msedge.exe
4988	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 3128	4988	msedge.exe	84
PID 4988 wrote to memory of 3128	4988	msedge.exe	84
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 760	4988	msedge.exe	85
PID 4988 wrote to memory of 4592	4988	msedge.exe	86
PID 4988 wrote to memory of 4592	4988	msedge.exe	86
PID 4988 wrote to memory of 3548	4988	msedge.exe	87
PID 4988 wrote to memory of 3548	4988	msedge.exe	87
PID 4988 wrote to memory of 3548	4988	msedge.exe	87
PID 4988 wrote to memory of 3548	4988	msedge.exe	87
PID 4988 wrote to memory of 3548	4988	msedge.exe	87
PID 4988 wrote to memory of 3548	4988	msedge.exe	87
PID 4988 wrote to memory of 3548	4988	msedge.exe	87
PID 4988 wrote to memory of 3548	4988	msedge.exe	87
PID 4988 wrote to memory of 3548	4988	msedge.exe	87
PID 4988 wrote to memory of 3548	4988	msedge.exe	87
PID 4988 wrote to memory of 3548	4988	msedge.exe	87
PID 4988 wrote to memory of 3548	4988	msedge.exe	87
PID 4988 wrote to memory of 3548	4988	msedge.exe	87
PID 4988 wrote to memory of 3548	4988	msedge.exe	87
PID 4988 wrote to memory of 3548	4988	msedge.exe	87
PID 4988 wrote to memory of 3548	4988	msedge.exe	87
PID 4988 wrote to memory of 3548	4988	msedge.exe	87
PID 4988 wrote to memory of 3548	4988	msedge.exe	87
PID 4988 wrote to memory of 3548	4988	msedge.exe	87
PID 4988 wrote to memory of 3548	4988	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9421d23215012ff8fa41599c21b4a062_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe664d46f8,0x7ffe664d4708,0x7ffe664d4718
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,6396485346043626486,15574034556448101711,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,6396485346043626486,15574034556448101711,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,6396485346043626486,15574034556448101711,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6396485346043626486,15574034556448101711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6396485346043626486,15574034556448101711,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,6396485346043626486,15574034556448101711,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7485bb3ed6bc2b4d4de5601e8517caa5

SHA1
1f46041ba4a5eccd8338dbab39e0927fa160d151

SHA256
bc803c85d6ca3b611774d655eef0434a61b725adf3d8a311a3ec4b060b452048

SHA512
2e7a149a49fcba132e466fdad10f72b7711f7832d46290575273e874d49aa52234aeb424198eb3f24c2264cc3b3b15f374422677c93c1d91d585988f37447ede

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3a2d9b4f536a2fa000ce93894169d225

SHA1
0219ff277c8e957a258f29984c5c70dcbbd055fc

SHA256
8b6b269eb2a1f765d1dd613e5df77227ef4cb4220b53accb855df2a1eee2ee58

SHA512
4a592d7232aa261c54007824bc16285e09a473de89aae0bc69a82579240ca93e3046ac180047acd02b5f69ce93a4742e86701e15b704c47cf63f1a953856c3a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d74d1ffbf826afa4539794da0d886fe3

SHA1
1b8ec43b9c2a2c617787b5b2411385db8883f644

SHA256
1cf4e23503efc41bbe80bb9a39bfffd8af4ae9267696d027f058b25267515036

SHA512
9f52d4f8407fd15e01b86decef1962b58cca5ea5757936f23daa7bc1fd57523c855ea85f811562e8d573e8d6779dc50b4c046fd1d5e62c3ee9b518fd9d0dd651

Download Submit