65abbcfa0292d9659c3a3b16c31097962a891876101681ba791eafaea6ddb692

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-09-2024 02:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce7bb13d6b4f0b4d38019849efa38899_JaffaCakes118.html
Size

139KB
MD5

ce7bb13d6b4f0b4d38019849efa38899
SHA1

772387c34b8acdfaaf59185f7d64b34b13debf27
SHA256

65abbcfa0292d9659c3a3b16c31097962a891876101681ba791eafaea6ddb692
SHA512

fd320c1896e0bb2025871c48c7c8c7dc5d2b3107f26fe16f615739618a66955a5ea96c06f5609effa5d2e73a875cc36b5913ad8d755cb71996c9459e1f2e8a97
SSDEEP

1536:SkNr3VaYSliMnyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:SkauMnyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
1804	msedge.exe
1804	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1804	msedge.exe
1804	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe
1804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 4720	1804	msedge.exe	83
PID 1804 wrote to memory of 4720	1804	msedge.exe	83
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 5044	1804	msedge.exe	84
PID 1804 wrote to memory of 2816	1804	msedge.exe	85
PID 1804 wrote to memory of 2816	1804	msedge.exe	85
PID 1804 wrote to memory of 60	1804	msedge.exe	86
PID 1804 wrote to memory of 60	1804	msedge.exe	86
PID 1804 wrote to memory of 60	1804	msedge.exe	86
PID 1804 wrote to memory of 60	1804	msedge.exe	86
PID 1804 wrote to memory of 60	1804	msedge.exe	86
PID 1804 wrote to memory of 60	1804	msedge.exe	86
PID 1804 wrote to memory of 60	1804	msedge.exe	86
PID 1804 wrote to memory of 60	1804	msedge.exe	86
PID 1804 wrote to memory of 60	1804	msedge.exe	86
PID 1804 wrote to memory of 60	1804	msedge.exe	86
PID 1804 wrote to memory of 60	1804	msedge.exe	86
PID 1804 wrote to memory of 60	1804	msedge.exe	86
PID 1804 wrote to memory of 60	1804	msedge.exe	86
PID 1804 wrote to memory of 60	1804	msedge.exe	86
PID 1804 wrote to memory of 60	1804	msedge.exe	86
PID 1804 wrote to memory of 60	1804	msedge.exe	86
PID 1804 wrote to memory of 60	1804	msedge.exe	86
PID 1804 wrote to memory of 60	1804	msedge.exe	86
PID 1804 wrote to memory of 60	1804	msedge.exe	86
PID 1804 wrote to memory of 60	1804	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ce7bb13d6b4f0b4d38019849efa38899_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa4b2446f8,0x7ffa4b244708,0x7ffa4b244718
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,12614704776533353262,14573761896304501477,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,12614704776533353262,14573761896304501477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,12614704776533353262,14573761896304501477,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2960 /prefetch:8
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12614704776533353262,14573761896304501477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12614704776533353262,14573761896304501477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,12614704776533353262,14573761896304501477,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6d6553fed0bc2bfd5b73ec3affb54bca

SHA1
dd3e0b2d36db452d071de75a18f40affacc2ac2c

SHA256
7a0ce23c67ae9bf0ad6ff148554f5ca4c7a75486629edcabd49325a808652056

SHA512
e6c760f8ebb1188176f6ae8083ad6841b9aba24ab956fb7296f2bfb521aed37413e8739fa996205c84a0a94323dd840ae257104f35a996f62e51d94882fdb58c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ae4be3054831e4734e98b336a7fe0cd2

SHA1
4e1637e9e10a6454802966d75550235cfb00d177

SHA256
309a3191e13be1de81e7033c868611586a87e4acbaf7c6d05e49b66710fe69d5

SHA512
e14d369477644eb74a4b6b84448285812ff29e0cdced50ce503916107fb81b975a9c19e9b10d8d31b6cb7b68d4b789e44f819ce16de2f4caa4f5caf9ad1797df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ab8591aa5f278d4d3fddc31f7aa7b1ba

SHA1
3fc82e59bcf76827bbc65402bf7b891bf45b7f84

SHA256
d25cc72c70662b9491d9cb56a64b9fe470724f4984f569cf2db6b682f1d167a2

SHA512
b3c475bda80c0188861100a5afaf02dc4b90ad9c4747391195128edcd7438c794927334a68d2b133726a526b9d3aef19a5f31045eeb10c30a3bd0ec670a37288

Download Submit