2e69f935142dd0c541797d238d16b9e619aaf73f212c524964e1f2fe2e4c5a12

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d21d9f18c2f0c07e1755a54182c38956_JaffaCakes118.html
Size

90KB
MD5

d21d9f18c2f0c07e1755a54182c38956
SHA1

2930e28afd9036a0cf85c77e7e51dac3a592ff00
SHA256

2e69f935142dd0c541797d238d16b9e619aaf73f212c524964e1f2fe2e4c5a12
SHA512

781d8352ac88db6bf8051ebc556b792a5712ab22f6d2ab49cbbf473aec2cbbe21a63a13059b95054ecd4dc7438752e7976e2bf444e55a52c9d738f3ba00b8c30
SSDEEP

1536:7pPMlbN6H7bTM7Nbmcpvrn8USLIr3BpOxpxJGlSWE5/ezOlSYqKyM4WvsUWZkojV:7pPMlbN0bTM7NbBTRIQE5/ezOlSs0UC

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1936	msedge.exe
1936	msedge.exe
1076	msedge.exe
1076	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 3672	1076	msedge.exe	83
PID 1076 wrote to memory of 3672	1076	msedge.exe	83
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 736	1076	msedge.exe	84
PID 1076 wrote to memory of 1936	1076	msedge.exe	85
PID 1076 wrote to memory of 1936	1076	msedge.exe	85
PID 1076 wrote to memory of 1860	1076	msedge.exe	86
PID 1076 wrote to memory of 1860	1076	msedge.exe	86
PID 1076 wrote to memory of 1860	1076	msedge.exe	86
PID 1076 wrote to memory of 1860	1076	msedge.exe	86
PID 1076 wrote to memory of 1860	1076	msedge.exe	86
PID 1076 wrote to memory of 1860	1076	msedge.exe	86
PID 1076 wrote to memory of 1860	1076	msedge.exe	86
PID 1076 wrote to memory of 1860	1076	msedge.exe	86
PID 1076 wrote to memory of 1860	1076	msedge.exe	86
PID 1076 wrote to memory of 1860	1076	msedge.exe	86
PID 1076 wrote to memory of 1860	1076	msedge.exe	86
PID 1076 wrote to memory of 1860	1076	msedge.exe	86
PID 1076 wrote to memory of 1860	1076	msedge.exe	86
PID 1076 wrote to memory of 1860	1076	msedge.exe	86
PID 1076 wrote to memory of 1860	1076	msedge.exe	86
PID 1076 wrote to memory of 1860	1076	msedge.exe	86
PID 1076 wrote to memory of 1860	1076	msedge.exe	86
PID 1076 wrote to memory of 1860	1076	msedge.exe	86
PID 1076 wrote to memory of 1860	1076	msedge.exe	86
PID 1076 wrote to memory of 1860	1076	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d21d9f18c2f0c07e1755a54182c38956_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ff83db846f8,0x7ff83db84708,0x7ff83db84718
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,11594945944626040444,2919794266538451366,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,11594945944626040444,2919794266538451366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,11594945944626040444,2919794266538451366,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11594945944626040444,2919794266538451366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11594945944626040444,2919794266538451366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,11594945944626040444,2919794266538451366,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5252 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
502B

MD5
bf5c89256baf42c916c045597dc42209

SHA1
39e15696954346bb18dfcfbcacec7a4a6b06865c

SHA256
4f5ff766a4f67785ae99e04a4b87cf65fb0c477fe11c775bc55c107077111fcb

SHA512
0f503e750820327492d20f5f882c11411a79a9002a1cb65f06a6fa99be9ddb74be9600026ad26262be40bbc45881745a395d87012e4ce7f906c29e30f0b94c89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d2dec2d4a14b7b9c9bce692d12a1ae3e

SHA1
e1e2ee948d792bde54e0e265feeca95c234a8341

SHA256
1d71d4ddc70600a3cb846c291b2149cf6809840d62344b5c2549c1366bca5753

SHA512
1b51dad97202254cc28803dc39bce666b6ebdc87cbd0884f36908fe8cf3ecd8b052cbb383ceb0060b26a020c109119ceb58b0bf2f77dee165165056d3c1009ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b1082f41efec53f85dadae5ac4a207aa

SHA1
5e724f0c3988cbe70f42bf9744b9833b264b9699

SHA256
3c2b47ac721d57156aa7adcad999cfd92f92ed4adfa49bc79d1baca504e17483

SHA512
8638c118ecd6ed904175ed8d3c5054f52c3071bc4e9f5d28f878a0c2c64c4745419b0475eff5d5ae5e80e685e85de0f07aa19bbdc9e16e2105647c30c18f2a4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c3c216469cc5b5818aa9f6379b7eafa8

SHA1
80c66b13dfd8821856fc198c18fb9601541ecdba

SHA256
d201616edb10356f8e76d6777da414ea86895f5805651fdad9a764ddecb9ba64

SHA512
dbe32f1d880a6ec1d28f48c80e14b25cf6545b28a4493623b00eab9e10193c789a2de201b3a27251b1f8172ba6757e790c5a5adcb645752a9ad7372430a8e1c9

Download Submit