d2d4dec6adc14963e8e9ccdebb9019fc4ff3afdbabf809d046ebb3916c33f93a

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/09/2024, 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea26dba7a630ea38c11ac65e6f95b532_JaffaCakes118.html
Size

91KB
MD5

ea26dba7a630ea38c11ac65e6f95b532
SHA1

46c10235b384acb1ce10d8831084ed730ab72d43
SHA256

d2d4dec6adc14963e8e9ccdebb9019fc4ff3afdbabf809d046ebb3916c33f93a
SHA512

a8ad965d1b80fd569db9099178890586cbf576655f36f21469219509a1bfbab5008963e497e65ef2a08611f0bce6a2c2792b71e98cd0dc4806c67778775ca2eb
SSDEEP

1536:AGFbdFIatl0+35h/5y5dmbbTHgRTw9wCwUz32xOwzws57U9L:DbhnD35h/45dmPr3U7U9L

Score

6^/10

discovery

Malware Config

Signatures

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4344	msedge.exe
4344	msedge.exe
4196	msedge.exe
4196	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe
620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4196	msedge.exe
4196	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 3892	4196	msedge.exe	82
PID 4196 wrote to memory of 3892	4196	msedge.exe	82
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4508	4196	msedge.exe	83
PID 4196 wrote to memory of 4344	4196	msedge.exe	84
PID 4196 wrote to memory of 4344	4196	msedge.exe	84
PID 4196 wrote to memory of 212	4196	msedge.exe	85
PID 4196 wrote to memory of 212	4196	msedge.exe	85
PID 4196 wrote to memory of 212	4196	msedge.exe	85
PID 4196 wrote to memory of 212	4196	msedge.exe	85
PID 4196 wrote to memory of 212	4196	msedge.exe	85
PID 4196 wrote to memory of 212	4196	msedge.exe	85
PID 4196 wrote to memory of 212	4196	msedge.exe	85
PID 4196 wrote to memory of 212	4196	msedge.exe	85
PID 4196 wrote to memory of 212	4196	msedge.exe	85
PID 4196 wrote to memory of 212	4196	msedge.exe	85
PID 4196 wrote to memory of 212	4196	msedge.exe	85
PID 4196 wrote to memory of 212	4196	msedge.exe	85
PID 4196 wrote to memory of 212	4196	msedge.exe	85
PID 4196 wrote to memory of 212	4196	msedge.exe	85
PID 4196 wrote to memory of 212	4196	msedge.exe	85
PID 4196 wrote to memory of 212	4196	msedge.exe	85
PID 4196 wrote to memory of 212	4196	msedge.exe	85
PID 4196 wrote to memory of 212	4196	msedge.exe	85
PID 4196 wrote to memory of 212	4196	msedge.exe	85
PID 4196 wrote to memory of 212	4196	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ea26dba7a630ea38c11ac65e6f95b532_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb61a646f8,0x7ffb61a64708,0x7ffb61a64718
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,4427309245119217386,3593872222357971379,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,4427309245119217386,3593872222357971379,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,4427309245119217386,3593872222357971379,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,4427309245119217386,3593872222357971379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,4427309245119217386,3593872222357971379,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,4427309245119217386,3593872222357971379,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6392 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
309B

MD5
2e9a6b2aedece4a0c32fa5a20dc3cc18

SHA1
dfefd6f209c0c7e073246f35454a59419a46d2e5

SHA256
818d20dac8cb63a744479a9e5bbb042f2deaa1c68b3407e9c3267a40db5d6efc

SHA512
e7d2445e633c0dfba6897cc4f830cd28e0137f825f9cac00cd76eebfe92dae1f966185968cd71f45060b8d26f3d992f49808cc37cb03b164c1d42b07b06aa6e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8a5444ab8a3987b5adc9210c8feb5d75

SHA1
028e1fe9e1c5c77c543afa27235689edfa0d45b3

SHA256
a41c16ba8e0cf83c190387b8d434b82ac5c63ab9d2eb406a37be98ebf5aa759d

SHA512
2c13bb3afe1747b1b6b9b32aba1d92dea7c24669c1dcac58a1824698894cd10808f018f3d6dad1c8527a16eec1ca19010396dc98d9e8b9d0f856249a3e9485c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
66c7e5d5d35c6f71e07453381d1a80fc

SHA1
c83e813d7e317021e251f84ef169afaf6077bc3f

SHA256
8f10f7045cc3c85fb0d38f7a24215928bd605c60a984ffe513591361064f0de5

SHA512
7d197e074a897e818e9f29333ac0309c1cd8509c8c87a0c84e23ab4ada25b7fd84cf84e8f30e1a917ccd0feaa38667ace7f300ebe7a1bebdbbbc35ada75e9e11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6d0a5f86ec2241de9d875bd1f345d6c7

SHA1
17956e5a6a381161719ede3c3dd9ddbbfabef24f

SHA256
ea1af880581695899e3719be53078ce48747b3f1a4bcb771365df9873a38b16a

SHA512
e488ebf0676a84d28960d6c39935499d91a4aaf6e91be9d52c46316675d4f9f3dc3985867a36990ce45ede2787eb112d592726104c02e25d89a966fa40f02372

Download Submit