cbde636e5a7e09c02fe9146635c9cdda747663bbc43321511c129f506cd5bf6a

Analysis

max time kernel
145s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 04:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea905a30c650ee6c58fc6304fc7be847_JaffaCakes118.html
Size

24KB
MD5

ea905a30c650ee6c58fc6304fc7be847
SHA1

98249c38f2abfa97838b1544c6f15bed012dec04
SHA256

cbde636e5a7e09c02fe9146635c9cdda747663bbc43321511c129f506cd5bf6a
SHA512

76b0504160ec9866919b2a66d76552431aa7ed3be04003bf6e6e331dc372def71433630493f541b2cfe72c3f2c2f2dccad810e62f0f5736d43590ce1cea74219
SSDEEP

192:WLZLwKQZUOgc/h13UdQ/uQe/W1ThlBllC8B+4UinPi6bRux5WafW8OhW1ThRxZ9s:fjU2/Ie1T1Ff21T/xZC

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4888	msedge.exe
4888	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 4392	4888	msedge.exe	82
PID 4888 wrote to memory of 4392	4888	msedge.exe	82
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 1880	4888	msedge.exe	83
PID 4888 wrote to memory of 4772	4888	msedge.exe	84
PID 4888 wrote to memory of 4772	4888	msedge.exe	84
PID 4888 wrote to memory of 3980	4888	msedge.exe	85
PID 4888 wrote to memory of 3980	4888	msedge.exe	85
PID 4888 wrote to memory of 3980	4888	msedge.exe	85
PID 4888 wrote to memory of 3980	4888	msedge.exe	85
PID 4888 wrote to memory of 3980	4888	msedge.exe	85
PID 4888 wrote to memory of 3980	4888	msedge.exe	85
PID 4888 wrote to memory of 3980	4888	msedge.exe	85
PID 4888 wrote to memory of 3980	4888	msedge.exe	85
PID 4888 wrote to memory of 3980	4888	msedge.exe	85
PID 4888 wrote to memory of 3980	4888	msedge.exe	85
PID 4888 wrote to memory of 3980	4888	msedge.exe	85
PID 4888 wrote to memory of 3980	4888	msedge.exe	85
PID 4888 wrote to memory of 3980	4888	msedge.exe	85
PID 4888 wrote to memory of 3980	4888	msedge.exe	85
PID 4888 wrote to memory of 3980	4888	msedge.exe	85
PID 4888 wrote to memory of 3980	4888	msedge.exe	85
PID 4888 wrote to memory of 3980	4888	msedge.exe	85
PID 4888 wrote to memory of 3980	4888	msedge.exe	85
PID 4888 wrote to memory of 3980	4888	msedge.exe	85
PID 4888 wrote to memory of 3980	4888	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ea905a30c650ee6c58fc6304fc7be847_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffcc0da46f8,0x7ffcc0da4708,0x7ffcc0da4718
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7892084939547231679,7922590618344647853,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,7892084939547231679,7922590618344647853,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,7892084939547231679,7922590618344647853,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7892084939547231679,7922590618344647853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7892084939547231679,7922590618344647853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7892084939547231679,7922590618344647853,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a86ea748cdb2433eb052d8e33c9d8ac1

SHA1
19992577b7c3fb15a2742e8c2e5a8e61d36e4481

SHA256
9e5baebc09d635559e4bcdf23627060b2ecbc86744f1c7036c1ccdcdcb146e4b

SHA512
bb55d47169c1719562495d15ecb65452eb1122f0db647a45aa38e2e297ddd3cba11467f0dbf9186ccd94151d2657cc724b543d4fe0061d486323dfb441f44a4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f92553c4bed032a24cdc6a277217b2b7

SHA1
ef8423d09f3c2cb80e8fa1e4a26d3a65d25493a3

SHA256
39bcc24757fa8f3a8b5e7f4de80ba9e6a55c17996610e7acb1b6620a74fff908

SHA512
c92f8221ed66862b127fa8d4faf46459d9b9f944d59b97ffb3d2abf13d0e2a80cd9949cb57a87066c6d46355a1cc220e2f5519057896fe3c997cf6cdb1b1f294

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
126a469078fbc9d1061c7c21f97492be

SHA1
9a98cea9029239d54a7de8bbe8fe995e2d256dd0

SHA256
4bdbb2833758a57a3cfd4da92842125f70f4a15508655c49dc5e271cf6b8e370

SHA512
a2b9a6429645af6acb209142843c8fd8b7c2730392ff0d07c54463338f628cc200b0a923b3a243d05bf6e2ecf10f0a172895b93a02b983372f6f84b60d6e6ee1

Download Submit