b0abfbb56bfe18f6e4f4636b720f74824b839ecf5183f01423a98f2c687561ee

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09-09-2024 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d678ac7ee3cb1767ae5fc7365dad216c_JaffaCakes118.html
Size

24KB
MD5

d678ac7ee3cb1767ae5fc7365dad216c
SHA1

2d63bf5900bdf2226cc3ae14251451294aa14bd7
SHA256

b0abfbb56bfe18f6e4f4636b720f74824b839ecf5183f01423a98f2c687561ee
SHA512

473ede85496c2087b9b625629ce30bc62102a3ace07cc32f36abdb31d5844d3a6e6e051cf2ba9fa54ef617f38f2574aecd77a861058b93fb36ccfade10b8a1e7
SSDEEP

768:Sg3t3UYUZknhDkVZQc9q0BOnPbC6R96C6J6o6SsB0KtOx7el2:Sg3t3UYUZknhDkVZQc9q0BOnPbC6R9JA

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3760	msedge.exe
3760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 4068	4760	msedge.exe	83
PID 4760 wrote to memory of 4068	4760	msedge.exe	83
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 4412	4760	msedge.exe	84
PID 4760 wrote to memory of 3760	4760	msedge.exe	85
PID 4760 wrote to memory of 3760	4760	msedge.exe	85
PID 4760 wrote to memory of 692	4760	msedge.exe	86
PID 4760 wrote to memory of 692	4760	msedge.exe	86
PID 4760 wrote to memory of 692	4760	msedge.exe	86
PID 4760 wrote to memory of 692	4760	msedge.exe	86
PID 4760 wrote to memory of 692	4760	msedge.exe	86
PID 4760 wrote to memory of 692	4760	msedge.exe	86
PID 4760 wrote to memory of 692	4760	msedge.exe	86
PID 4760 wrote to memory of 692	4760	msedge.exe	86
PID 4760 wrote to memory of 692	4760	msedge.exe	86
PID 4760 wrote to memory of 692	4760	msedge.exe	86
PID 4760 wrote to memory of 692	4760	msedge.exe	86
PID 4760 wrote to memory of 692	4760	msedge.exe	86
PID 4760 wrote to memory of 692	4760	msedge.exe	86
PID 4760 wrote to memory of 692	4760	msedge.exe	86
PID 4760 wrote to memory of 692	4760	msedge.exe	86
PID 4760 wrote to memory of 692	4760	msedge.exe	86
PID 4760 wrote to memory of 692	4760	msedge.exe	86
PID 4760 wrote to memory of 692	4760	msedge.exe	86
PID 4760 wrote to memory of 692	4760	msedge.exe	86
PID 4760 wrote to memory of 692	4760	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d678ac7ee3cb1767ae5fc7365dad216c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8d4546f8,0x7ffd8d454708,0x7ffd8d454718
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,5539061869105492896,11215800182149873004,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,5539061869105492896,11215800182149873004,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,5539061869105492896,11215800182149873004,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,5539061869105492896,11215800182149873004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,5539061869105492896,11215800182149873004,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,5539061869105492896,11215800182149873004,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4924 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e3f45918abfc03e520afee481a760b9e

SHA1
0dc7d13f6c7c6be40a11a2a4f4cd35109f4804da

SHA256
97f83e8af1148a85e39205157f8ac097e2afb10f9cd12c72b1863ae5300a9053

SHA512
52346353f74883f8e1ab39a84cf2d1b42b6836ee0ae559b6760e5e91a2532869eb8871632ebdd2da714d0128b40a407104e05e1f93050c9149bfdd2b705bdd42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
55b87e752ed62607c30776ce04e7e313

SHA1
bd3ddb0bfada6d836a1d99d3eee75e6f99381ced

SHA256
42833ba2482e36da8629c2f952f42bd76fb677642438813554d99d89c6c2e029

SHA512
67aa1ad22f96b4bd652712110c2ee0ef0682d51c132072e2f46d434d715dec41e01b37097a796fed510d4b1fd59a9d976d3810164e2b57bfbbfa89e1c13aef62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a7cad63f496bd9c627f44ac12b1c92f1

SHA1
03e8c2ddee2e37bb6899dc5572bc2a139db9a174

SHA256
f2d1e65534dcfbe038834a3f88b6de2ba542c9c5d43fcab584ce15b34ed95257

SHA512
cc59cad215a6ae53ca0a013cc3575d8d3cf437e5c3bf8f2358ee9679c3706434a24086101b9c624c56c80dd7525f8434c3f08c13c44dd5d959e4b8d235e901a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
2eec6ada97b5e3c0834c877712861f36

SHA1
531a8ccc9d56b97192a4ed43c25f78f68f74a903

SHA256
b531f90bdd39e8028f9f580b83934f9ce1f86ec08f3d0818a7ffff210ff8e1c1

SHA512
88f6b71ab005d7ed499f04f2cf9b48ff4ff915e0731deba99296f67e4289abf41f7bf9f3f61b14fe6cc13f98d160546ab7280b872f785d87848a09d08ea4a51f

Download Submit