291ca397e89f71ed535e14d65949c4251a17c1643d308f342cdfe9be5d5a6fcc

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bec4024a89fa78eb4d3df83a23a406bc_JaffaCakes118.html
Size

139KB
MD5

bec4024a89fa78eb4d3df83a23a406bc
SHA1

b462e1811b2e076e22a002991399bac306802d45
SHA256

291ca397e89f71ed535e14d65949c4251a17c1643d308f342cdfe9be5d5a6fcc
SHA512

7d7391b423ac792ebf81e2b10f1b14c3a35444d1ed89fd22d79c26fdb769187edb5b343d3d89be0690568d0fd06aa49ffb3c93b0ec45cd8172fb9fbc05281ced
SSDEEP

1536:SEJnlYLEMl36RyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:SErYLd6RyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2188	msedge.exe
2188	msedge.exe
3920	msedge.exe
3920	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2188	msedge.exe
2188	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2160	2188	msedge.exe	84
PID 2188 wrote to memory of 2160	2188	msedge.exe	84
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 448	2188	msedge.exe	85
PID 2188 wrote to memory of 3920	2188	msedge.exe	86
PID 2188 wrote to memory of 3920	2188	msedge.exe	86
PID 2188 wrote to memory of 2424	2188	msedge.exe	87
PID 2188 wrote to memory of 2424	2188	msedge.exe	87
PID 2188 wrote to memory of 2424	2188	msedge.exe	87
PID 2188 wrote to memory of 2424	2188	msedge.exe	87
PID 2188 wrote to memory of 2424	2188	msedge.exe	87
PID 2188 wrote to memory of 2424	2188	msedge.exe	87
PID 2188 wrote to memory of 2424	2188	msedge.exe	87
PID 2188 wrote to memory of 2424	2188	msedge.exe	87
PID 2188 wrote to memory of 2424	2188	msedge.exe	87
PID 2188 wrote to memory of 2424	2188	msedge.exe	87
PID 2188 wrote to memory of 2424	2188	msedge.exe	87
PID 2188 wrote to memory of 2424	2188	msedge.exe	87
PID 2188 wrote to memory of 2424	2188	msedge.exe	87
PID 2188 wrote to memory of 2424	2188	msedge.exe	87
PID 2188 wrote to memory of 2424	2188	msedge.exe	87
PID 2188 wrote to memory of 2424	2188	msedge.exe	87
PID 2188 wrote to memory of 2424	2188	msedge.exe	87
PID 2188 wrote to memory of 2424	2188	msedge.exe	87
PID 2188 wrote to memory of 2424	2188	msedge.exe	87
PID 2188 wrote to memory of 2424	2188	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bec4024a89fa78eb4d3df83a23a406bc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe26cb46f8,0x7ffe26cb4708,0x7ffe26cb4718
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,14359116515839420034,3708836917644246919,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,14359116515839420034,3708836917644246919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,14359116515839420034,3708836917644246919,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14359116515839420034,3708836917644246919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3088 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14359116515839420034,3708836917644246919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3112 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,14359116515839420034,3708836917644246919,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4964 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7d344eb589ffec60f333bd187e8d504a

SHA1
ae4b9b3ca87bb0a47e6a11a2e2e9f338b081850e

SHA256
494e7d08403626faf2dbf6c32a51f9835d3d4b08864c2bb388e6ba782182a841

SHA512
b29dcbbc54e0855de4caf26fb2fc9b6f3f31fc21b33425a73da17192612beb17f04b2f9fd80aed1fd58677b52294b25cb10e4e5226b44745bb4310d514ff599b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6689f1a59c955ced6d26336eaeedb6dd

SHA1
a95aa841a8c3ddb5013bb04a65349341896fa4b9

SHA256
dbc43e80a6acde75b6bcdeb0913c9b26732eb077849b3c2879bfd89e844223bf

SHA512
0241c646b5dc84a118f8711c938fcbe8ca212b25a8371d81f28b836a27bbece9b9eedbb2812dbdc5c90a17c4f34199aa6038e74533f6793ef9e4864441eb0909

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3b81d40088e9e35b9c576924d07a4b54

SHA1
6981452675660d05de3f3d3e5091cfd9d9f2ccbd

SHA256
f86adb0d4292a1e3ba6fb2651e0b57c53e9483830326bb4fe9480ef466d7b790

SHA512
adbaa4e54fc1d0c929f9cd3a42a7b7b7dadaeeda1c655774c12dd5dc5b254ee2145d13f35e93f8771ce89cbe1269d329263338d6a1acd9fbb8f6a43df4969c61

Download Submit