6ebacbb2f5f7dbb30cc84b6fa36566d59acad691e42c1897ffac60fff2dce384

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a991a0bfdae1df95521d8cac1cec5cc7_JaffaCakes118.html
Size

98KB
MD5

a991a0bfdae1df95521d8cac1cec5cc7
SHA1

e8866e1ded925410e05f7440133c3a91919d4e09
SHA256

6ebacbb2f5f7dbb30cc84b6fa36566d59acad691e42c1897ffac60fff2dce384
SHA512

e7b283c3f66c4e19410c97c94d74acd345a64ceddc1a877ea7cafe0c786696ae1884a8047f87717965a99a562ae45b6c3e2ec48d38194d71696b52c736ce0416
SSDEEP

1536:9V1+B4yz6GWuRAaHaG1WNGaeASfEQm7xpDG9lE/LIMUmNL4cqePmn:H1A1b1WNJeASf8DDG9lE/sMUmBqePmn

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1752	msedge.exe
1752	msedge.exe
4496	msedge.exe
4496	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe
3108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 3712	4496	msedge.exe	84
PID 4496 wrote to memory of 3712	4496	msedge.exe	84
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 3580	4496	msedge.exe	85
PID 4496 wrote to memory of 1752	4496	msedge.exe	86
PID 4496 wrote to memory of 1752	4496	msedge.exe	86
PID 4496 wrote to memory of 4204	4496	msedge.exe	87
PID 4496 wrote to memory of 4204	4496	msedge.exe	87
PID 4496 wrote to memory of 4204	4496	msedge.exe	87
PID 4496 wrote to memory of 4204	4496	msedge.exe	87
PID 4496 wrote to memory of 4204	4496	msedge.exe	87
PID 4496 wrote to memory of 4204	4496	msedge.exe	87
PID 4496 wrote to memory of 4204	4496	msedge.exe	87
PID 4496 wrote to memory of 4204	4496	msedge.exe	87
PID 4496 wrote to memory of 4204	4496	msedge.exe	87
PID 4496 wrote to memory of 4204	4496	msedge.exe	87
PID 4496 wrote to memory of 4204	4496	msedge.exe	87
PID 4496 wrote to memory of 4204	4496	msedge.exe	87
PID 4496 wrote to memory of 4204	4496	msedge.exe	87
PID 4496 wrote to memory of 4204	4496	msedge.exe	87
PID 4496 wrote to memory of 4204	4496	msedge.exe	87
PID 4496 wrote to memory of 4204	4496	msedge.exe	87
PID 4496 wrote to memory of 4204	4496	msedge.exe	87
PID 4496 wrote to memory of 4204	4496	msedge.exe	87
PID 4496 wrote to memory of 4204	4496	msedge.exe	87
PID 4496 wrote to memory of 4204	4496	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a991a0bfdae1df95521d8cac1cec5cc7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97c7046f8,0x7ff97c704708,0x7ff97c704718
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,15252957893503872473,15989011567033455433,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,15252957893503872473,15989011567033455433,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,15252957893503872473,15989011567033455433,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15252957893503872473,15989011567033455433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15252957893503872473,15989011567033455433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15252957893503872473,15989011567033455433,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,15252957893503872473,15989011567033455433,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
6e9179913d880299a3c29d11204b9020

SHA1
af6a7f7d6550ea0a58b75b1780215f75b09088f7

SHA256
d7e27ab76cc195493d72a48893dae8e1f459e16eab5f92074fb8cc0eb67bc9af

SHA512
1b262611e2263f8c60dd33342a05362ba5e21935a553a29dffde50cbd21132cdaf3fa44dc86adad9755d327c76076f5a400a194c1f0c54ba8d88f0bad38b206a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
775354a287012897efb07c8eff090b05

SHA1
9dec3b5f8ea4b27d3f24ed03857ee796d70b60ed

SHA256
a2961b676a192fe5ad6f8c3733bee40369ab23ea3e0acbe9a6dc9ec660fbb04c

SHA512
62f348d108d30d4b40860f2b0f0792626ca81dc9e445d784335296e02de208e6006a737ae01a88c769ad0b4b6e401d3b3a52550dfc3cc21874f09f4765d8b1ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
104ef19340a434e926b3804580597f53

SHA1
e73e85822a9e89c05f2968de5191cf0a7d73444f

SHA256
c624c92a68c642165583ecdcbdb20e72c9697de65e552cbad44da35bc1f31e23

SHA512
bf871e822c6433557c46b1dc3d2bc0821a09c4f40ece8a372cffef2e9fdc6a1bc31e6728beb5beee8dd9cd02c15bf18dc8dd52c30ac286c82da5f55f131b325e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7758fa7e2825d003e4b256b386631a51

SHA1
f0e0948f23fce7143682a2f5b6fb1b7212024a79

SHA256
fb7088ad33e24e381f996e4e95c374cd0505cf64a9474c5deb0ede3e9fd79c2f

SHA512
325bc5e42c139009bb4f05b8149236419305bac15dd62c0187eb6eb8c3982f097f0ae2de6536ed2c8bce8e0b0f086250c2e849686624f0e2a2ac2ecba4312b4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8473e63b0ecb2b3c5497e14793cb36e5

SHA1
a15ef756839878eb5295493af7ec8d63b31672cd

SHA256
aaecf7ef2392402e4720d81d6cd2086d32e878d9463578fcc5eb6f6c13e93c4c

SHA512
ff8c760e36b3a66f5d4dc5965cf8f699aaff15d86ae2d3171f043e83e4a8ddfd925823cfc4c8b05e2a688dfb1bbff797053f4fa6c8e5155f45bba6995f1f0d0e

Download Submit