221ff1b79187915210e668e53e00417d6b1a93f1fe819e075b2ec0ac97b3a6db

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

db5c85b93fdf7304174e8699a9108e17_JaffaCakes118.html
Size

214KB
MD5

db5c85b93fdf7304174e8699a9108e17
SHA1

fbbdfd10dbee3cfd56bacd9ea74bcfdbaee5e7eb
SHA256

221ff1b79187915210e668e53e00417d6b1a93f1fe819e075b2ec0ac97b3a6db
SHA512

ae482ecd3f1f8d6ddfbb8b8bd153f44a90e44fd6041144470d82a5249269649888b4256df5299cee2b6623489cf1dc9989a1c64fea150669a4dbd8c5f93cab52
SSDEEP

3072:BrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJw:Vz9VxLY7iAVLTBQJlw

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2612	msedge.exe
2612	msedge.exe
1160	msedge.exe
1160	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe
1160	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1936	1160	msedge.exe	83
PID 1160 wrote to memory of 1936	1160	msedge.exe	83
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 1776	1160	msedge.exe	84
PID 1160 wrote to memory of 2612	1160	msedge.exe	85
PID 1160 wrote to memory of 2612	1160	msedge.exe	85
PID 1160 wrote to memory of 2340	1160	msedge.exe	86
PID 1160 wrote to memory of 2340	1160	msedge.exe	86
PID 1160 wrote to memory of 2340	1160	msedge.exe	86
PID 1160 wrote to memory of 2340	1160	msedge.exe	86
PID 1160 wrote to memory of 2340	1160	msedge.exe	86
PID 1160 wrote to memory of 2340	1160	msedge.exe	86
PID 1160 wrote to memory of 2340	1160	msedge.exe	86
PID 1160 wrote to memory of 2340	1160	msedge.exe	86
PID 1160 wrote to memory of 2340	1160	msedge.exe	86
PID 1160 wrote to memory of 2340	1160	msedge.exe	86
PID 1160 wrote to memory of 2340	1160	msedge.exe	86
PID 1160 wrote to memory of 2340	1160	msedge.exe	86
PID 1160 wrote to memory of 2340	1160	msedge.exe	86
PID 1160 wrote to memory of 2340	1160	msedge.exe	86
PID 1160 wrote to memory of 2340	1160	msedge.exe	86
PID 1160 wrote to memory of 2340	1160	msedge.exe	86
PID 1160 wrote to memory of 2340	1160	msedge.exe	86
PID 1160 wrote to memory of 2340	1160	msedge.exe	86
PID 1160 wrote to memory of 2340	1160	msedge.exe	86
PID 1160 wrote to memory of 2340	1160	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\db5c85b93fdf7304174e8699a9108e17_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffa62ab46f8,0x7ffa62ab4708,0x7ffa62ab4718
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,4123582608004677465,6448354277184946208,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,4123582608004677465,6448354277184946208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,4123582608004677465,6448354277184946208,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4123582608004677465,6448354277184946208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4123582608004677465,6448354277184946208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,4123582608004677465,6448354277184946208,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
46d4a32a13fbab123a1591ba71463bb1

SHA1
c3e092177d3725efa33960a83ac548dfb079cdf2

SHA256
9a8644bb180930e77f2bb9ea14eceb7fffb04db0436c3a8413c4875684791e24

SHA512
f9f15874b748d7cfc2f2c38ad317920d56c25adaa16fb256068c49a315627cd68e7e6a600c8283e4f1ede761cfd42e6a968356b425535018d090dcdf38eabe0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1252a6e2509d20cab99e2c783ec0ba3f

SHA1
52d11e4426c384e09c7d7befe5c3ff8711d95960

SHA256
c92737b31cb1a74699058857930c81fd6c671925031eb698f059472cb56ca5c9

SHA512
6fcc388bbe7d495f4fcdca94520a2b4acabc350e571301d2bcda82b3a0a992313fe5a6ba040a3c774eddf20dfc7e92eaa4d8808e5eba9828580767e6cd5a5c88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a67e7adf13d6446df15a7fd13359a4b6

SHA1
12d1e0279aeb7d0b40c4cbff17333c2d5102a941

SHA256
336ed58ab7b136e0f901c2a640e6ba4ba9ea2b142999f7e444b227c58c14fcb3

SHA512
fb7a3e09637e18e859708028a9653bbcba08ff161271d677cb9df45c1fe7a71e5c5a8786f47cfe634d5240f341c728d0fbe4972076ec2440dd5d0a7c29020649

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
73ca97fcb767e2ee5e51d9c055cc0138

SHA1
b300cdeb0acc10dc3a40bb2d3d6d2e33b59965cb

SHA256
a7366a4c4629aacb6d69ca1f81b91bcc293269520925151cdd14117b509e4c0d

SHA512
3f63ebcc1f8715188a4ad4c298fe64f2fb9f903815354fbdbe4d2f3318a1d7df1a9af7ea672e09b45e822dacfc40d11827647b4b0b8a08b23b7db18b6657c27c

Download Submit