ee43baa517ae05f96c0a2a89d0e1aeb12bb109fd05132f55ff8c4fddaded8286

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2024, 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ddac24e5bf3b6483c7306a9ab4e50be1_JaffaCakes118.html
Size

68KB
MD5

ddac24e5bf3b6483c7306a9ab4e50be1
SHA1

f3d8d147bd88558c24a212529658604e15177218
SHA256

ee43baa517ae05f96c0a2a89d0e1aeb12bb109fd05132f55ff8c4fddaded8286
SHA512

8067c43d165e3924e6b2da9ef54444975cbdce4dba2d9c4e2b564107d3fbfd107085613ca562ad79d9d70dc0be0e3037eaa83e9d3f583ad7c10eda2393e2a26e
SSDEEP

1536:qjarmZM7HqXl8qvNbZPSJSX6IMvkHKOvkGfV8qK:qjarmZM7HqXl8qvNbZPSJSX6IMvkxnK

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
3276	msedge.exe
3276	msedge.exe
4436	identity_helper.exe
4436	identity_helper.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 4020	2168	msedge.exe	85
PID 2168 wrote to memory of 4020	2168	msedge.exe	85
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3988	2168	msedge.exe	86
PID 2168 wrote to memory of 3276	2168	msedge.exe	87
PID 2168 wrote to memory of 3276	2168	msedge.exe	87
PID 2168 wrote to memory of 1448	2168	msedge.exe	88
PID 2168 wrote to memory of 1448	2168	msedge.exe	88
PID 2168 wrote to memory of 1448	2168	msedge.exe	88
PID 2168 wrote to memory of 1448	2168	msedge.exe	88
PID 2168 wrote to memory of 1448	2168	msedge.exe	88
PID 2168 wrote to memory of 1448	2168	msedge.exe	88
PID 2168 wrote to memory of 1448	2168	msedge.exe	88
PID 2168 wrote to memory of 1448	2168	msedge.exe	88
PID 2168 wrote to memory of 1448	2168	msedge.exe	88
PID 2168 wrote to memory of 1448	2168	msedge.exe	88
PID 2168 wrote to memory of 1448	2168	msedge.exe	88
PID 2168 wrote to memory of 1448	2168	msedge.exe	88
PID 2168 wrote to memory of 1448	2168	msedge.exe	88
PID 2168 wrote to memory of 1448	2168	msedge.exe	88
PID 2168 wrote to memory of 1448	2168	msedge.exe	88
PID 2168 wrote to memory of 1448	2168	msedge.exe	88
PID 2168 wrote to memory of 1448	2168	msedge.exe	88
PID 2168 wrote to memory of 1448	2168	msedge.exe	88
PID 2168 wrote to memory of 1448	2168	msedge.exe	88
PID 2168 wrote to memory of 1448	2168	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ddac24e5bf3b6483c7306a9ab4e50be1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3dd746f8,0x7fff3dd74708,0x7fff3dd74718
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,6071605496873985425,5200411849483469965,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,6071605496873985425,5200411849483469965,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,6071605496873985425,5200411849483469965,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6071605496873985425,5200411849483469965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6071605496873985425,5200411849483469965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,6071605496873985425,5200411849483469965,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,6071605496873985425,5200411849483469965,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6071605496873985425,5200411849483469965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6071605496873985425,5200411849483469965,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6071605496873985425,5200411849483469965,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,6071605496873985425,5200411849483469965,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,6071605496873985425,5200411849483469965,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f165c1b69774a3a88e611cf5e127091b

SHA1
d2018f2c3345e31687594e7243c743de7745b14b

SHA256
f5fe9de9a8bca1ac6f42321ae0932479d65ac257bd2a5f3e67844282ac38560d

SHA512
a2e07bc87dfbb722a49db5e094791675c7f8c3d58c7f3885ea201fba477f30d3a0507490a7d81d78eb9d60c48c23c540686f60642dc3a3be513abefb4336b777

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e353911e1826958f9b0da6ea5fc69797

SHA1
f71dfa5d14c6aee893739b987fbfced7414de6be

SHA256
38062735c8745b29b2cfedf7df62b800ed3982491242c122db1d1c972ac35bcd

SHA512
ef824d9e40ede1f1264f25e1f51874a1be7c2b32bb166f63eecd5cce5dba2bff03cd7897e077fcd389e622e71b52e01fdf033f203536b6d39d68e3a0ef044aed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0dbbc9aa8f179785633850ed69ea6a34

SHA1
241861e779da8db2e771558d257d372aed9b0601

SHA256
a015be78f0f057225425633ca15feb1fbcb4276965a10eb79bb8b1775c46ced4

SHA512
9d6e0c958c6211c0b7d2dcbfa41f1067301328dfbd6697b9f97d2a4d489271a8a3bd6111cae3cc9bd1aeb71b6172d765fd762c451ba53119bfe15454e52f2c28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ba4987b14a903984ca72893c3c33af2e

SHA1
2db03fa41989bd9a5da3bd8041f278e6912f478f

SHA256
224232c67e1d87d80ea38c6d968e1ac1c1a1f8888124b1348ce57f774dcadba4

SHA512
08bc0c20260bb5c1cce87fea323adc3fec81eab7b0f4c301433b411958e462359b45f7b98e8c3bdb0875d594f23c7305eadd4d942e8f28fb4d5643be5f2abfa4

Download Submit