d6faccac00c8cf09ecc31d4e29cf0e8c0639dc960d0def69d0680b633f37279e

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 03:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea82ac445330bc1449eed9bfcad661e0_JaffaCakes118.html
Size

61KB
MD5

ea82ac445330bc1449eed9bfcad661e0
SHA1

d5a1fc12c10798be80e7ebb44ca791902f5c9df8
SHA256

d6faccac00c8cf09ecc31d4e29cf0e8c0639dc960d0def69d0680b633f37279e
SHA512

8076ae4a814e96aa6fbda07db1db80420d8c99d5cb9a280e31c2ae8350063776ef2f15488eb52770f1e4bec81b83ea4f7955e0301f18a35458b6d8f410328911
SSDEEP

1536:IeYCsKg2H2rrGqR1Hp57fOPJX0GsowH9Fn:8rNJ57fyJX0KC9Fn

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
5796	msedge.exe
5796	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe
5796	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5796 wrote to memory of 5616	5796	msedge.exe	82
PID 5796 wrote to memory of 5616	5796	msedge.exe	82
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 5304	5796	msedge.exe	83
PID 5796 wrote to memory of 4900	5796	msedge.exe	84
PID 5796 wrote to memory of 4900	5796	msedge.exe	84
PID 5796 wrote to memory of 4496	5796	msedge.exe	85
PID 5796 wrote to memory of 4496	5796	msedge.exe	85
PID 5796 wrote to memory of 4496	5796	msedge.exe	85
PID 5796 wrote to memory of 4496	5796	msedge.exe	85
PID 5796 wrote to memory of 4496	5796	msedge.exe	85
PID 5796 wrote to memory of 4496	5796	msedge.exe	85
PID 5796 wrote to memory of 4496	5796	msedge.exe	85
PID 5796 wrote to memory of 4496	5796	msedge.exe	85
PID 5796 wrote to memory of 4496	5796	msedge.exe	85
PID 5796 wrote to memory of 4496	5796	msedge.exe	85
PID 5796 wrote to memory of 4496	5796	msedge.exe	85
PID 5796 wrote to memory of 4496	5796	msedge.exe	85
PID 5796 wrote to memory of 4496	5796	msedge.exe	85
PID 5796 wrote to memory of 4496	5796	msedge.exe	85
PID 5796 wrote to memory of 4496	5796	msedge.exe	85
PID 5796 wrote to memory of 4496	5796	msedge.exe	85
PID 5796 wrote to memory of 4496	5796	msedge.exe	85
PID 5796 wrote to memory of 4496	5796	msedge.exe	85
PID 5796 wrote to memory of 4496	5796	msedge.exe	85
PID 5796 wrote to memory of 4496	5796	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ea82ac445330bc1449eed9bfcad661e0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ffaa10646f8,0x7ffaa1064708,0x7ffaa1064718
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2352092676011621711,10661650295886938466,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,2352092676011621711,10661650295886938466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,2352092676011621711,10661650295886938466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2352092676011621711,10661650295886938466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2352092676011621711,10661650295886938466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2352092676011621711,10661650295886938466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2352092676011621711,10661650295886938466,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c32e29091d9e25bc80e59d2b4a153a05

SHA1
28b1031ff42cf3e8b24fff7e71b0cb6eaf9c0e0f

SHA256
e88e34ba3bb0688578a35271cba5084997fe07d32a0fb081623586f6dcb8b406

SHA512
b859432db1e33c56f70e6dac8506cf66759c96667958e0adfe81fc8662d8c31504b717b240086bb6eba3990488dee800e9cb96b6d970aa41bfe297581a8492b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4e067354428148d4c1ef1c54310089dc

SHA1
6e1390b3a17fd95decf420446024b9d554bc07c3

SHA256
1f4416d38b5f95eebdefb0e1d4d45bb3753028072670b796d17c52f9a383f7dc

SHA512
11c377dba69d5333a66056492369b9241463a999201f2546742dab53bd98a5b633841e54883a71e1e5d4fe6bfab11d9c0703319aa1ee511ad85dac197ec61213

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
49c34c5749309aeab024e6fd553158d3

SHA1
94fbd646f5b26ea17d240a93e82a968510d9cc99

SHA256
d4d9eb7ad0edcad93c5012d423a480dd049f32c7c27c00f96cef467a087a2383

SHA512
7f4c8ed6defacf6e63623c57e01471d3634fa52dcf5fc8dcfb295798c364da9c6cfea2bbeb312e3d22cb4cb876062ee81f34848bfeb6c14905e834e550fe0b8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b28a7361bbc9ceb634935baef3904566

SHA1
42df8970c9fc4c7803f4f0b07b07a14da9640b7d

SHA256
bf468e6cd449b43d01d267bce092c03ceee93c9f4c95d667aa2ea0d1ca9f2edc

SHA512
ce8c6495d5a5a433aaa53e1fb3cadc5abb5e8e160bbb542ff366547c209c88c4df6fdbe0a378fa2a9aab91584f029e6fefab301bd3cdae032e350a195163ec63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3d5edb09ec84696e66adc78c3b300fbf

SHA1
1a14905c265a4ef898534ec4584f4bd9ed2248f0

SHA256
125cdc7cb91a97b36c96c1b4abe9a8a1b022ee45825bd549c42c0e95ec14da6d

SHA512
80417b8a58da0c3c2294adb43fc1d5826ebac5a8a76adf8cc3081ee932d6bcb405693c52624729b8c25aeae551f3ff1b8ca2c1b660f0b7d0679758b08ded6b6b

Download Submit