4b57a79cd0f63648dd455b55074c4364a7b13ea2dd20afece232b9d4877c925b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 05:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaaae4830f38709893176ec82f3c86cc_JaffaCakes118.html
Size

53KB
MD5

eaaae4830f38709893176ec82f3c86cc
SHA1

f690d3cd353cbe25bed334eb23deeb8e1ef8d114
SHA256

4b57a79cd0f63648dd455b55074c4364a7b13ea2dd20afece232b9d4877c925b
SHA512

7b4859fff34cf3cda788ff2684e6bb2601e5c6959b1d6714bbf2450377bd0563b8e32f596a53b879fe9f768afaec6a2dc0469919cc5fe31b8ae4ae93cf30044e
SSDEEP

768:SHemr9UrQn7jKJ1IOg+vkARFk7Pod0rUAPt/45r4vm2NNZIlKx2M+yAnMyzgDBrd:Sfr9UrhWaT0H5WUsK

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3640	msedge.exe
3640	msedge.exe
4664	msedge.exe
4664	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe
2168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 3636	4664	msedge.exe	82
PID 4664 wrote to memory of 3636	4664	msedge.exe	82
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 5040	4664	msedge.exe	83
PID 4664 wrote to memory of 3640	4664	msedge.exe	84
PID 4664 wrote to memory of 3640	4664	msedge.exe	84
PID 4664 wrote to memory of 3688	4664	msedge.exe	85
PID 4664 wrote to memory of 3688	4664	msedge.exe	85
PID 4664 wrote to memory of 3688	4664	msedge.exe	85
PID 4664 wrote to memory of 3688	4664	msedge.exe	85
PID 4664 wrote to memory of 3688	4664	msedge.exe	85
PID 4664 wrote to memory of 3688	4664	msedge.exe	85
PID 4664 wrote to memory of 3688	4664	msedge.exe	85
PID 4664 wrote to memory of 3688	4664	msedge.exe	85
PID 4664 wrote to memory of 3688	4664	msedge.exe	85
PID 4664 wrote to memory of 3688	4664	msedge.exe	85
PID 4664 wrote to memory of 3688	4664	msedge.exe	85
PID 4664 wrote to memory of 3688	4664	msedge.exe	85
PID 4664 wrote to memory of 3688	4664	msedge.exe	85
PID 4664 wrote to memory of 3688	4664	msedge.exe	85
PID 4664 wrote to memory of 3688	4664	msedge.exe	85
PID 4664 wrote to memory of 3688	4664	msedge.exe	85
PID 4664 wrote to memory of 3688	4664	msedge.exe	85
PID 4664 wrote to memory of 3688	4664	msedge.exe	85
PID 4664 wrote to memory of 3688	4664	msedge.exe	85
PID 4664 wrote to memory of 3688	4664	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eaaae4830f38709893176ec82f3c86cc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8964d46f8,0x7ff8964d4708,0x7ff8964d4718
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10421322374016805468,2051172123174809304,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,10421322374016805468,2051172123174809304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,10421322374016805468,2051172123174809304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10421322374016805468,2051172123174809304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10421322374016805468,2051172123174809304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10421322374016805468,2051172123174809304,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1316 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6cfe325ed5b930e10cc03b9e0984010e

SHA1
311bde195665871d870ef46fc5c2a258a3d71ed3

SHA256
7e95e7e132bf73923cff4c37f9a50f0b13969440797e0640891fbb8a1f10bdef

SHA512
60e3062c884b1eea57f20a516a00687c0abb6ea4defb49c89ae5953188958d72f10426cde9b3e8570aa0e82402a95243ce4df4039de59e4bde4b353803e1f43c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1239732a11515bc54dd6abc96a0479a5

SHA1
d10dae7f0d3308fb47fc2f21f44de04b565847cb

SHA256
b2d051357e701d493efd3e4f4d7bc35ba51f98d5f37661dd6b730883cbc53980

SHA512
f526209ed4cd6d27c0f9971f1550e6959fda5ef267064fb560cbd5bd3a1dad3cfbdd35019ca42d83214f8a91170a0fd0501225f980f4a1bcc4c2cfe3e8cc0b0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
97e9374d321bf03258fc134a567ba1ea

SHA1
e478c90b0145231c1af1bb075fd0f8de36270b05

SHA256
4f4f3f70e4adf513f076e607f2307e98293480a869b465b97ffaddae0b310dc8

SHA512
9b7f588bca4c446c6eca3d75239e51f3ffbde12e43c11917911b9417a795454b5e02e45da32ceae15f8e171c8799fc785d2a8cc4b3c287df4d082e18a14e13d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
eb2b1a46b0b5f8c486ef5369004d020d

SHA1
d245b2181d67274550850be6598e702b20ca5398

SHA256
c36c5e9869df61b5b81edb35960a09d3b049792d472dbf555ee19ae678ae7210

SHA512
afb14dfa5548b3a7f382670c94a511c868b9a23990dcbeb084ed48d2149216966e179e0414a5fbcc62fa28715aa3ee4d2d1eadb6e1ce9f1ad17a42df4a5f757f

Download Submit