29f542e2c769c26b2f25955cf8aee0017f88044dcc95d5438fd67f25f47b0675

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaa658d1fe0c46ab77f1dfe9b4633ad6_JaffaCakes118.html
Size

18KB
MD5

eaa658d1fe0c46ab77f1dfe9b4633ad6
SHA1

23f2415e06fdeaa73e93b82938d7adfb343a63bb
SHA256

29f542e2c769c26b2f25955cf8aee0017f88044dcc95d5438fd67f25f47b0675
SHA512

89a692acc373b27c54f7fe23c0bd39fc2e199c336725f3e1ac3b4896d906413790d74b6cbf39b80ca773cc1aeab97431e1d48a62759ebf42e4efbd89ccd7df39
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIc4ezUnjBhSk82qDB8:SIMd0I5nvHfsvSnxDB8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2944	msedge.exe
2944	msedge.exe
3736	msedge.exe
3736	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 4188	3736	msedge.exe	82
PID 3736 wrote to memory of 4188	3736	msedge.exe	82
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 336	3736	msedge.exe	83
PID 3736 wrote to memory of 2944	3736	msedge.exe	84
PID 3736 wrote to memory of 2944	3736	msedge.exe	84
PID 3736 wrote to memory of 5052	3736	msedge.exe	85
PID 3736 wrote to memory of 5052	3736	msedge.exe	85
PID 3736 wrote to memory of 5052	3736	msedge.exe	85
PID 3736 wrote to memory of 5052	3736	msedge.exe	85
PID 3736 wrote to memory of 5052	3736	msedge.exe	85
PID 3736 wrote to memory of 5052	3736	msedge.exe	85
PID 3736 wrote to memory of 5052	3736	msedge.exe	85
PID 3736 wrote to memory of 5052	3736	msedge.exe	85
PID 3736 wrote to memory of 5052	3736	msedge.exe	85
PID 3736 wrote to memory of 5052	3736	msedge.exe	85
PID 3736 wrote to memory of 5052	3736	msedge.exe	85
PID 3736 wrote to memory of 5052	3736	msedge.exe	85
PID 3736 wrote to memory of 5052	3736	msedge.exe	85
PID 3736 wrote to memory of 5052	3736	msedge.exe	85
PID 3736 wrote to memory of 5052	3736	msedge.exe	85
PID 3736 wrote to memory of 5052	3736	msedge.exe	85
PID 3736 wrote to memory of 5052	3736	msedge.exe	85
PID 3736 wrote to memory of 5052	3736	msedge.exe	85
PID 3736 wrote to memory of 5052	3736	msedge.exe	85
PID 3736 wrote to memory of 5052	3736	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eaa658d1fe0c46ab77f1dfe9b4633ad6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd2a9f46f8,0x7ffd2a9f4708,0x7ffd2a9f4718
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,6891179743294785005,7245711448351388066,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,6891179743294785005,7245711448351388066,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,6891179743294785005,7245711448351388066,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6891179743294785005,7245711448351388066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,6891179743294785005,7245711448351388066,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,6891179743294785005,7245711448351388066,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1268 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
48e67812b259ce3b343ace0a97f2dc77

SHA1
97d02d444e54f57b278124117a9d20ac1589d2d9

SHA256
a82a005fc879ea6d068001606dfa550ccf63270706011f79124614afdb226c9e

SHA512
b1b89726069a12de0f68ef52b1719ca945617892f1c0adbdf2908676821583f6476badbb2d35c66b6611c5e59e733ea9c84ed2888748334afd7298d6269720bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a07ba64ca094a167315598b4c1a97022

SHA1
0f8d5d959dfe0a8b0b712c3890e25845d2ac2bc6

SHA256
54cbe3b61f8166553df976d3b6a4a1df723e2834c5dc3e64a2fbbb8a1ada3ab9

SHA512
d1c7f9a63596d0d4ba29e5fda14205dd52b96042d6286d2423d1e6bb7ea615342d73866c6f3ef38a41c9180be77605ad75220cea0ec5ccfda3c159c768079574

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7e790c9654d0cd62198e03476972673a

SHA1
fc4e4207fb1ab97e0fa8696d8f296f4a6dd19849

SHA256
299c4c41a901868cb989aaa1ab7e7c8f60aeb46aea863130435d7018394de3fc

SHA512
86cac8bc8472f2067a0d18635914bf0e6fe1b773b699656909b08d0abc84f6b21b4cd25e66ab9a5ef77659beefd877665e64e3ffa9302582d8d6cb694811e05a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fe24c3c0596ac592bc0ef4bb7223b92d

SHA1
403de2c3c7c75e3e94dea8642e87653185cbdc44

SHA256
51b04f3288574cbffa269a22e9cb23a49502074d70aeda83d67deeebe09be20e

SHA512
af4c7dbcfa7676dc81ca561274c234f6364124c2918b279e241aecc06082a4c742eaac404aac8e0c7853bd62abdc6ea656129fbcd33d46c30042e59c7ab3df26

Download Submit