d239a5506ba89fe0414e44e81f5b1714cd33407e6049e6bccd9e56c0b356b4e4

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 02:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ea6e26481fe47999f2274c0b65dc656c_JaffaCakes118.html
Size

50KB
MD5

ea6e26481fe47999f2274c0b65dc656c
SHA1

12d41b287bae639436fc96807750548629a6dfd8
SHA256

d239a5506ba89fe0414e44e81f5b1714cd33407e6049e6bccd9e56c0b356b4e4
SHA512

0c2849a8471404007749cb388fd948cab08de84fe20d922d0fd7609f8ad674242c8acd9f9796d07769dca60b8e3eeb04e26046939177bf2473c838fb7c1aa9a0
SSDEEP

768:yRzROXvqDKc0kX5P89UzBDDqZEUUekzsI5JortiPq7/DI+oRA2Rg/:cDX8mDDH5w78z2

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4220	msedge.exe
4220	msedge.exe
4324	msedge.exe
4324	msedge.exe
1640	identity_helper.exe
1640	identity_helper.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 3592	4324	msedge.exe	82
PID 4324 wrote to memory of 3592	4324	msedge.exe	82
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 716	4324	msedge.exe	83
PID 4324 wrote to memory of 4220	4324	msedge.exe	84
PID 4324 wrote to memory of 4220	4324	msedge.exe	84
PID 4324 wrote to memory of 2820	4324	msedge.exe	85
PID 4324 wrote to memory of 2820	4324	msedge.exe	85
PID 4324 wrote to memory of 2820	4324	msedge.exe	85
PID 4324 wrote to memory of 2820	4324	msedge.exe	85
PID 4324 wrote to memory of 2820	4324	msedge.exe	85
PID 4324 wrote to memory of 2820	4324	msedge.exe	85
PID 4324 wrote to memory of 2820	4324	msedge.exe	85
PID 4324 wrote to memory of 2820	4324	msedge.exe	85
PID 4324 wrote to memory of 2820	4324	msedge.exe	85
PID 4324 wrote to memory of 2820	4324	msedge.exe	85
PID 4324 wrote to memory of 2820	4324	msedge.exe	85
PID 4324 wrote to memory of 2820	4324	msedge.exe	85
PID 4324 wrote to memory of 2820	4324	msedge.exe	85
PID 4324 wrote to memory of 2820	4324	msedge.exe	85
PID 4324 wrote to memory of 2820	4324	msedge.exe	85
PID 4324 wrote to memory of 2820	4324	msedge.exe	85
PID 4324 wrote to memory of 2820	4324	msedge.exe	85
PID 4324 wrote to memory of 2820	4324	msedge.exe	85
PID 4324 wrote to memory of 2820	4324	msedge.exe	85
PID 4324 wrote to memory of 2820	4324	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ea6e26481fe47999f2274c0b65dc656c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffbfd4046f8,0x7ffbfd404708,0x7ffbfd404718
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,13531590633123290216,14471006114601792438,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,13531590633123290216,14471006114601792438,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,13531590633123290216,14471006114601792438,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13531590633123290216,14471006114601792438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13531590633123290216,14471006114601792438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,13531590633123290216,14471006114601792438,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,13531590633123290216,14471006114601792438,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13531590633123290216,14471006114601792438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13531590633123290216,14471006114601792438,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13531590633123290216,14471006114601792438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13531590633123290216,14471006114601792438,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,13531590633123290216,14471006114601792438,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9a555ecf80639603a7677c2c6b1609b2

SHA1
f294c0be81894f21a7a10236333f7285a26e445e

SHA256
a204070766b272863541bca6cc5a975b5e48a7030ac7c8c74783f548383aede1

SHA512
7128460815e19ccd4cb187355eb2fc4d1aa0bc381e3ffb9ec35fc953f8af6c0ed6b5f39575b9df21e2c7466a71251fd8ea8d74a2a5fc3508a7396a0531f690cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fb81144f329e92ce52f851d38537191c

SHA1
9f59b51c1438d2df1d2e33d4a839dba110e176e2

SHA256
d1ccfc7c105b8437982dc419b436f5b3f8df8fb53c56fae5f72a580600314f95

SHA512
4bce1c868cc8601811b2721ddb27eda0fd0eec0f999be37e9ee04fbbd5909e559664def13b864e6d985e6d2bd2d12ac5237f9628094ceec43751b5ab7375be05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a21c775145d6b5d5ee9f0feff47cbe82

SHA1
8f149cc80282a87ad0a16a64e737ba3711906b9a

SHA256
206ded69030891e39f7d584a3ba876edab278657d235770171a001b978cb31af

SHA512
ad2a13e712cdd00561e94f3caecc049439602174551723d5f5a016329209a22203550e7216021dd51acd018504eeb7a0283f7926587d759417455ed738d5f586

Download Submit