ad6a9c746242d5fefd4e0c9cb26849399a8717d0b1c7c8a85dbf6abcf45a790b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 21:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b51e29b225200a8f3afab91fa46f9b70_JaffaCakes118.html
Size

278KB
MD5

b51e29b225200a8f3afab91fa46f9b70
SHA1

2d80d6171cda46104acd99aad8a448e8ad23f00c
SHA256

ad6a9c746242d5fefd4e0c9cb26849399a8717d0b1c7c8a85dbf6abcf45a790b
SHA512

f542a197d18bf055c1cf021caefd543bf8331ea6e2f3e5626a40c92315c6ae724109d7bb6d0f3b815904c8ac7f38abdc36f058e57b63dc5dbabb238bf5e28cfa
SSDEEP

3072:EJiyfkMY+BES09JXAnyrZalI+Y5Q3CspF4yfkMY+BES09JXAnyrZalI+YW:8sMYod+X3oI+Y5Q3CspsMYod+X3oI+YW

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
2304	msedge.exe
2304	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2304	msedge.exe
2304	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe
2304	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 4248	2304	msedge.exe	84
PID 2304 wrote to memory of 4248	2304	msedge.exe	84
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 3812	2304	msedge.exe	85
PID 2304 wrote to memory of 4220	2304	msedge.exe	86
PID 2304 wrote to memory of 4220	2304	msedge.exe	86
PID 2304 wrote to memory of 4124	2304	msedge.exe	87
PID 2304 wrote to memory of 4124	2304	msedge.exe	87
PID 2304 wrote to memory of 4124	2304	msedge.exe	87
PID 2304 wrote to memory of 4124	2304	msedge.exe	87
PID 2304 wrote to memory of 4124	2304	msedge.exe	87
PID 2304 wrote to memory of 4124	2304	msedge.exe	87
PID 2304 wrote to memory of 4124	2304	msedge.exe	87
PID 2304 wrote to memory of 4124	2304	msedge.exe	87
PID 2304 wrote to memory of 4124	2304	msedge.exe	87
PID 2304 wrote to memory of 4124	2304	msedge.exe	87
PID 2304 wrote to memory of 4124	2304	msedge.exe	87
PID 2304 wrote to memory of 4124	2304	msedge.exe	87
PID 2304 wrote to memory of 4124	2304	msedge.exe	87
PID 2304 wrote to memory of 4124	2304	msedge.exe	87
PID 2304 wrote to memory of 4124	2304	msedge.exe	87
PID 2304 wrote to memory of 4124	2304	msedge.exe	87
PID 2304 wrote to memory of 4124	2304	msedge.exe	87
PID 2304 wrote to memory of 4124	2304	msedge.exe	87
PID 2304 wrote to memory of 4124	2304	msedge.exe	87
PID 2304 wrote to memory of 4124	2304	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b51e29b225200a8f3afab91fa46f9b70_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdea5446f8,0x7ffdea544708,0x7ffdea544718
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,7221048241481277636,16715739695798792446,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,7221048241481277636,16715739695798792446,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,7221048241481277636,16715739695798792446,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7221048241481277636,16715739695798792446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7221048241481277636,16715739695798792446,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,7221048241481277636,16715739695798792446,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a60504df0b883fce70e370ef4d9f87a3

SHA1
bf8a9a03af09f6cfd1ee9be11cbb441cfad3d17a

SHA256
3febc6c650411886669f5146320fd1cb56fb422ab5e7b72711735a627f94182d

SHA512
5d035402981aeda59605db0db5363443bb73449b6209746ed2a735ed789c78e6b7c8868bb8579bbdd037e63858d470876f55e338df3a6b8114310995827efd3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1b8cf3b931ec14eb0ab2210f1e3da1dd

SHA1
8164977c8eb2d969fd091ec22c1c0d817dcd1dab

SHA256
891533a210b96af20d7d893a2a981683d5ec867aa2d4ffc483a6987e8bdbb109

SHA512
530c303bc87ce595ced0d0a9d087ea6071a68ea93d7a4f4d2efc609100c7808e3c6f6ac916ee53f137365527ef152ef92396f12100d263d15ac06d1c175dd424

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ea2e1e252db6c53e5a3dc77511b85926

SHA1
1162686418e1f9fa11eb74e4f425179d2b5a603e

SHA256
19f8ff2c6be39bfc6461979d8c66db4c97926d645876771ee7ebcb4ec3a522f5

SHA512
aaa48d3e267f71e30184847c7df012a1c254efffd7c6b8d976ffa360c0ca7cc9c472d855689d962550251539957bab0b829f9fe3171d227aaf9109715ead6509

Download Submit