2d68c0559122bff1076721347ca4b23de58918ef2488907e249c5b652663e71a

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 00:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db82a22ba4bde497b1e47be15bb2824c_JaffaCakes118.html
Size

139KB
MD5

db82a22ba4bde497b1e47be15bb2824c
SHA1

aceae7cf4a5aaa065537c38e5ae5c7554e034b67
SHA256

2d68c0559122bff1076721347ca4b23de58918ef2488907e249c5b652663e71a
SHA512

eac8c4326e31ff0fa91c518efc825d73f1cb6a888555daabf0a71e19fca69831bc3e5ed23ba6b2c16b11b9c13e170fd0adbe3938f4b08e962a041737e8bf5920
SSDEEP

1536:SNzFEjlLaHPyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:SNGZaHPyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
4780	msedge.exe
4780	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 4136	4780	msedge.exe	83
PID 4780 wrote to memory of 4136	4780	msedge.exe	83
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 1924	4780	msedge.exe	84
PID 4780 wrote to memory of 460	4780	msedge.exe	85
PID 4780 wrote to memory of 460	4780	msedge.exe	85
PID 4780 wrote to memory of 3496	4780	msedge.exe	86
PID 4780 wrote to memory of 3496	4780	msedge.exe	86
PID 4780 wrote to memory of 3496	4780	msedge.exe	86
PID 4780 wrote to memory of 3496	4780	msedge.exe	86
PID 4780 wrote to memory of 3496	4780	msedge.exe	86
PID 4780 wrote to memory of 3496	4780	msedge.exe	86
PID 4780 wrote to memory of 3496	4780	msedge.exe	86
PID 4780 wrote to memory of 3496	4780	msedge.exe	86
PID 4780 wrote to memory of 3496	4780	msedge.exe	86
PID 4780 wrote to memory of 3496	4780	msedge.exe	86
PID 4780 wrote to memory of 3496	4780	msedge.exe	86
PID 4780 wrote to memory of 3496	4780	msedge.exe	86
PID 4780 wrote to memory of 3496	4780	msedge.exe	86
PID 4780 wrote to memory of 3496	4780	msedge.exe	86
PID 4780 wrote to memory of 3496	4780	msedge.exe	86
PID 4780 wrote to memory of 3496	4780	msedge.exe	86
PID 4780 wrote to memory of 3496	4780	msedge.exe	86
PID 4780 wrote to memory of 3496	4780	msedge.exe	86
PID 4780 wrote to memory of 3496	4780	msedge.exe	86
PID 4780 wrote to memory of 3496	4780	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\db82a22ba4bde497b1e47be15bb2824c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd70fd46f8,0x7ffd70fd4708,0x7ffd70fd4718
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,17387635889536251062,5303508683434940658,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,17387635889536251062,5303508683434940658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,17387635889536251062,5303508683434940658,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17387635889536251062,5303508683434940658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17387635889536251062,5303508683434940658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,17387635889536251062,5303508683434940658,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4900 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
59261bc748063e6ca30fd9940fa504f1

SHA1
fe00c3b3a8bc5df45943a1788f9d97f6b11fec70

SHA256
569a4c549ec94774990da7ea21d8c876b707e847d46b4a67f1cc08364f8d2274

SHA512
458d64460b6bd843fae86f81bb58c788e84bd601824dc1b1e44c68313c3d46566fc005e7589ca66c6ffcc47bf494b1da9e4e761a7737a88a027112e0486cd27d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a0afa7f3bf8b23d87d7cb5c683338868

SHA1
4bba142d2e559c256677f712142f1fe4ee64d05b

SHA256
2239aafef6a99f6d277957fcb3d456b5d32c7a82f66a040cf12db628d1a2a815

SHA512
e96205235cbad8741beef8141435d003f7ce30c0b0bd2f588973561c79c861c0ad9b381b0b11062e0f8919e957aee77dd85bd3f611b9d0cdb7801902b4e03b97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
aec40b252de9b9977ecb5cf82837160c

SHA1
770e9b2bff538f4935dd4df831a5be4ae2cb2190

SHA256
c72d1cad675433f8c56354843d3eeb5392d88d5d32f98e280299151d918792a5

SHA512
568e092cf209dfb9fe02f3e594117ae20bbe7c03148c2e9fe0d5c48a64cc65795355ede7d0caea43b0ade7e438c046b483fcb8c8142e9c0452fda053d080cc3f

Download Submit