2b69e47d0a89ac1dc4f2113da832d6537d9fe14b58891bb932a9c55436d18fbc

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 07:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfba99fb63567259fb881bf264298f3c_JaffaCakes118.html
Size

41KB
MD5

dfba99fb63567259fb881bf264298f3c
SHA1

35bc7b7c4355db670756a081acb117685a19df25
SHA256

2b69e47d0a89ac1dc4f2113da832d6537d9fe14b58891bb932a9c55436d18fbc
SHA512

c20f62956f3655939936556f648c793c4221c1c8cc39d82bc4d03e6ac16e0f6ed11c244ee6b8bdc494c22b1b5027234ad3d40ce946ff39de5d3808ab35c8c26a
SSDEEP

768:1ATWn3VnJL5h3Dk78qfus9PVjR/mlbNSCWMKSePfr:acVJ99QJvjR/mlbNSCWM+fr

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe
4996	msedge.exe
4996	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 4512	4996	msedge.exe	83
PID 4996 wrote to memory of 4512	4996	msedge.exe	83
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 2036	4996	msedge.exe	84
PID 4996 wrote to memory of 3908	4996	msedge.exe	85
PID 4996 wrote to memory of 3908	4996	msedge.exe	85
PID 4996 wrote to memory of 4316	4996	msedge.exe	86
PID 4996 wrote to memory of 4316	4996	msedge.exe	86
PID 4996 wrote to memory of 4316	4996	msedge.exe	86
PID 4996 wrote to memory of 4316	4996	msedge.exe	86
PID 4996 wrote to memory of 4316	4996	msedge.exe	86
PID 4996 wrote to memory of 4316	4996	msedge.exe	86
PID 4996 wrote to memory of 4316	4996	msedge.exe	86
PID 4996 wrote to memory of 4316	4996	msedge.exe	86
PID 4996 wrote to memory of 4316	4996	msedge.exe	86
PID 4996 wrote to memory of 4316	4996	msedge.exe	86
PID 4996 wrote to memory of 4316	4996	msedge.exe	86
PID 4996 wrote to memory of 4316	4996	msedge.exe	86
PID 4996 wrote to memory of 4316	4996	msedge.exe	86
PID 4996 wrote to memory of 4316	4996	msedge.exe	86
PID 4996 wrote to memory of 4316	4996	msedge.exe	86
PID 4996 wrote to memory of 4316	4996	msedge.exe	86
PID 4996 wrote to memory of 4316	4996	msedge.exe	86
PID 4996 wrote to memory of 4316	4996	msedge.exe	86
PID 4996 wrote to memory of 4316	4996	msedge.exe	86
PID 4996 wrote to memory of 4316	4996	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dfba99fb63567259fb881bf264298f3c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7b6546f8,0x7ffa7b654708,0x7ffa7b654718
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,14730133967092212531,16818487873344961403,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,14730133967092212531,16818487873344961403,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,14730133967092212531,16818487873344961403,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14730133967092212531,16818487873344961403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,14730133967092212531,16818487873344961403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,14730133967092212531,16818487873344961403,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
266B

MD5
89b056240af807a1278d46f325dc5f62

SHA1
1e66dd4c9e030c5d2c23047a085822a372f17887

SHA256
f5f9f29fbb067a58ba60bebb0f36a61c535a234e45ff52f47f192d2836bac9f7

SHA512
109696dba2069f9b711948a93ebb6be8ee851336b14512c613196ca495158e8e53c3ad9bbc07aed6ea037b432f1101492a0e3c761d658f78e6e04d87b2715044

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
751a196e56bfc986304585ea9631120b

SHA1
51a2f2c3c544ad0ba43461b0dfddf64914289e5e

SHA256
70e7693250b6a4daaa32ac7e9bd01211fe8a8e3430c339396d04be43565b02a3

SHA512
259637165d5f3c5bc21684e3ecccc0ca8c6ef316c47e43d5ff6a16cff79d0f8a3d893c8a266beb46ed810f3c9ff69dc9c986fb561432cd02a8fe2fd0d41119ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e7e2e10ea42874f0dca2e0b5a12ef29b

SHA1
8863ce86f24b1edd5a963419ccd6a5bf8f921e46

SHA256
c0c50535e9ffb8672adf07f807486a800e8f2500430796fe5c55214147e143c9

SHA512
31f7441eeeaf2e83e3a94fc2c3fd2f0da39dd9c0f65ce50641ee2e4cb217719635d88d2bcf4e41a47bee399597dbefbd44591945d9c9dae5a0dde94ab77204d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
268b8831f39afcd691bc0dc19bbdc41e

SHA1
bba72ab15b3624968f6542de2bc74c08d840bf95

SHA256
47a90cf34e74495543a71f32bdc5143fdc5d26373be35642a65a17b039e509c2

SHA512
f65f6b3771234e4ec1391ae0c5ea0f49d517629ba32465046e2658e9151217e67ef69ed11ee68f7b434e401747b189feb746c88fbf6a955c6a61ed1788d4b382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ff6f44653aadaf3718b80066e4d28335

SHA1
54c30e8954c513ec2547d6f8dec40b1893dbfae2

SHA256
bf546fb3dd96d8228bee474193ca6ae6e8d1df997d98d8d72f6a92db2839b98c

SHA512
121327cc3892b6e6aea180444d97605263028bbd7ed7c687691f12e47e2252a56099e4a5d2cd8475505e4410fd30b8c427243a183a68973e919a7b2922312fc4

Download Submit