61561a56b89299fe3edb4382f0a9f79e9ca30857f85c3c3cc0e5aec3f52902c2

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 10:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de334c22d62bb97356aa43ceddd55875_JaffaCakes118.html
Size

138KB
MD5

de334c22d62bb97356aa43ceddd55875
SHA1

b424d00ba20f27fa113e730530dd5e9740bd08bb
SHA256

61561a56b89299fe3edb4382f0a9f79e9ca30857f85c3c3cc0e5aec3f52902c2
SHA512

6689b570efa84ba64fae5295556ddb25a6bf59d4ed2d0ab4a888b3e51228786a635b365f8567fed598d9ec780c7e78611336333003106a23697667c99d928ff3
SSDEEP

1536:SZdtS4alxngyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:SZkgyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
2564	msedge.exe
2564	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 1124	2564	msedge.exe	83
PID 2564 wrote to memory of 1124	2564	msedge.exe	83
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 3688	2564	msedge.exe	84
PID 2564 wrote to memory of 1676	2564	msedge.exe	85
PID 2564 wrote to memory of 1676	2564	msedge.exe	85
PID 2564 wrote to memory of 2612	2564	msedge.exe	86
PID 2564 wrote to memory of 2612	2564	msedge.exe	86
PID 2564 wrote to memory of 2612	2564	msedge.exe	86
PID 2564 wrote to memory of 2612	2564	msedge.exe	86
PID 2564 wrote to memory of 2612	2564	msedge.exe	86
PID 2564 wrote to memory of 2612	2564	msedge.exe	86
PID 2564 wrote to memory of 2612	2564	msedge.exe	86
PID 2564 wrote to memory of 2612	2564	msedge.exe	86
PID 2564 wrote to memory of 2612	2564	msedge.exe	86
PID 2564 wrote to memory of 2612	2564	msedge.exe	86
PID 2564 wrote to memory of 2612	2564	msedge.exe	86
PID 2564 wrote to memory of 2612	2564	msedge.exe	86
PID 2564 wrote to memory of 2612	2564	msedge.exe	86
PID 2564 wrote to memory of 2612	2564	msedge.exe	86
PID 2564 wrote to memory of 2612	2564	msedge.exe	86
PID 2564 wrote to memory of 2612	2564	msedge.exe	86
PID 2564 wrote to memory of 2612	2564	msedge.exe	86
PID 2564 wrote to memory of 2612	2564	msedge.exe	86
PID 2564 wrote to memory of 2612	2564	msedge.exe	86
PID 2564 wrote to memory of 2612	2564	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\de334c22d62bb97356aa43ceddd55875_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa62ab46f8,0x7ffa62ab4708,0x7ffa62ab4718
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,15385388832175664496,5681586878075914078,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,15385388832175664496,5681586878075914078,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,15385388832175664496,5681586878075914078,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15385388832175664496,5681586878075914078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15385388832175664496,5681586878075914078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,15385388832175664496,5681586878075914078,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4912 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
29f7290979e59e321c5ec9d22aa50c49

SHA1
06e33781229d24808daac68d5c5f3ff6e58c4a09

SHA256
6f3c63b896fe8338cc3d6fed5e7f795cc12f2b2b24ea4a9fac08869971fe6d68

SHA512
79ff378316f07b90c891d74638809ad0f4cf721c23e83992f4ff5b6a607368c6d223d15f6d05494140836b22ff33430064a2891de4601bd92714f9e115779f9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
83e83c885e021e9224cffda72b7ba696

SHA1
ea04746ef47a93c536501e28ea055e30ad044d84

SHA256
c8c71342017800345586a28c01a70a5d53271cb0e0f30bca67e23bcca336a127

SHA512
1951388567d992874f0e892b16b8c8f5db2b9ddebaec7a880a29a432f5cf7d0591886ca4a12a9d1893bb916b52aac0fdd1711d6632f0a47b4c917440dae92246

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
17059c49d1fcdf9dac1f2adae6326f2e

SHA1
3f9dd93bcdc54e9a095885cffe1ac0b41ce2c5f0

SHA256
298dae04991c6b9f98c818e94809ecd1bcc3f155b92fc17c55feeefb772122ac

SHA512
a56bd0dea09701e41a13609505ea0fd8d08522eb8900f7097a49e6d26593adde2458e5b7b6f2f7708c5fcf17d27c303328a63d95363bc160afafe0bdb2e3476a

Download Submit