2b7b4306afb369f1e3265975462ace76e553a2064299b1c5e9f8d67260674db4

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-09-2024 03:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dbc21acf503483a2fb05f55faebcba18_JaffaCakes118.html
Size

18KB
MD5

dbc21acf503483a2fb05f55faebcba18
SHA1

1ffc91d5fbe736b3502200a97a02c41fb0472057
SHA256

2b7b4306afb369f1e3265975462ace76e553a2064299b1c5e9f8d67260674db4
SHA512

099a94b8c183d346d9612f37e9f79156a0651fa84872af69ccff03328b7b221870d7e32147c2c2a04b448a4ff6dad69c3433136ad4ab38fe3264dc022425cd05
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAgZ4BzUnjBhPh82qDB8:SIMd0I5nvHdsvPqxDB8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3232	msedge.exe
3232	msedge.exe
1692	msedge.exe
1692	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe
4116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 1284	1692	msedge.exe	83
PID 1692 wrote to memory of 1284	1692	msedge.exe	83
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3316	1692	msedge.exe	84
PID 1692 wrote to memory of 3232	1692	msedge.exe	85
PID 1692 wrote to memory of 3232	1692	msedge.exe	85
PID 1692 wrote to memory of 3632	1692	msedge.exe	86
PID 1692 wrote to memory of 3632	1692	msedge.exe	86
PID 1692 wrote to memory of 3632	1692	msedge.exe	86
PID 1692 wrote to memory of 3632	1692	msedge.exe	86
PID 1692 wrote to memory of 3632	1692	msedge.exe	86
PID 1692 wrote to memory of 3632	1692	msedge.exe	86
PID 1692 wrote to memory of 3632	1692	msedge.exe	86
PID 1692 wrote to memory of 3632	1692	msedge.exe	86
PID 1692 wrote to memory of 3632	1692	msedge.exe	86
PID 1692 wrote to memory of 3632	1692	msedge.exe	86
PID 1692 wrote to memory of 3632	1692	msedge.exe	86
PID 1692 wrote to memory of 3632	1692	msedge.exe	86
PID 1692 wrote to memory of 3632	1692	msedge.exe	86
PID 1692 wrote to memory of 3632	1692	msedge.exe	86
PID 1692 wrote to memory of 3632	1692	msedge.exe	86
PID 1692 wrote to memory of 3632	1692	msedge.exe	86
PID 1692 wrote to memory of 3632	1692	msedge.exe	86
PID 1692 wrote to memory of 3632	1692	msedge.exe	86
PID 1692 wrote to memory of 3632	1692	msedge.exe	86
PID 1692 wrote to memory of 3632	1692	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dbc21acf503483a2fb05f55faebcba18_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7afd46f8,0x7ffe7afd4708,0x7ffe7afd4718
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,11687652465537312845,16256075002679668845,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1828,11687652465537312845,16256075002679668845,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1828,11687652465537312845,16256075002679668845,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,11687652465537312845,16256075002679668845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1828,11687652465537312845,16256075002679668845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1828,11687652465537312845,16256075002679668845,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ca018d01e1249b4a13bf4a2359389ecc

SHA1
3483d5dc987b3fc07c0f116ab3acd5eda0b06cf4

SHA256
25d590352b1f1f658dbfe3fa88103e0eaabdbf7785342e179c3c11e10c78a6ac

SHA512
8b643c8ed6d58fcd679f80f49197f2e582272ad67af8c8d5a97ad046f22b4f61eb3e0f4bbbeb27a4f85dbfd47a82d26033c71950d622bea51f4ebf26a8c1f983

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6155046a275ee5f15acb36bd0f79e8f1

SHA1
13c9490941fce38bdc30a12772a9d8fb1d770239

SHA256
a1ad45685d8977dfae93f7d068f7aa322ad126d6375df069dc624e2b5590ec15

SHA512
fff546166cd9223ea9755bb37c113ae027852f3a76a0fa6d3a44eb0eaad4857e708b2cea351311ad74fd6374da93a1530da55d379822a914952efdd3b74cc21d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e0115e532cc8c9070e80b9b7b1f835f1

SHA1
17c95f580ec94cbd5d4681aa359fc2ba9b2ceab6

SHA256
78a435088f47bac03374211880708694ba36ca9383c219f6bee35880ec73c0ee

SHA512
c208e179243111ca836b6d560650fd3cb9ba143a5058636870cde010cd2d5bb658d46e7b61e466ad25676c0589788acba39618e3081d27966aaac44571d13cd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e466e8ac8c82f0c1293774959a3b9558

SHA1
585326b59487bb37600b97292bf07e69374c0ca7

SHA256
06330ca22b0bf9185a13bc7737e306d8df2f69a84114e4584897acf86a38b903

SHA512
eed6bcfd9d09a39757c407968d49a63348a75b03ad445776574d4bfd319635ce5aee684c4d728d0e91e4226f8807b46c6e34915e4a0364324a1f810654216d0f

Download Submit