17e5ae8251c51319aedeb72b50b7b210b552ec1b8203b557fbb12f3e4f949056

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 05:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eab0c0bcf335d0d8db09fd6a2d4b6c56_JaffaCakes118.html
Size

19KB
MD5

eab0c0bcf335d0d8db09fd6a2d4b6c56
SHA1

001daad4f0871d8fd4e264ebe12babf011ea30e7
SHA256

17e5ae8251c51319aedeb72b50b7b210b552ec1b8203b557fbb12f3e4f949056
SHA512

5efdb20f3e8da45be495c8b1e02bd04aaf555a14896eeccafb5486a9063b0fe1273dbdff2aac6a980cc9f2cde89a407142126b3ab49b5dbe28cc08ccb2c81b7f
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAId4fzUnjBhJz82qDB8:SIMd0I5nO9HhsvJoxDB8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
2232	msedge.exe
2232	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2232	msedge.exe
2232	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe
2232	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 4888	2232	msedge.exe	82
PID 2232 wrote to memory of 4888	2232	msedge.exe	82
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4924	2232	msedge.exe	83
PID 2232 wrote to memory of 4080	2232	msedge.exe	84
PID 2232 wrote to memory of 4080	2232	msedge.exe	84
PID 2232 wrote to memory of 4520	2232	msedge.exe	85
PID 2232 wrote to memory of 4520	2232	msedge.exe	85
PID 2232 wrote to memory of 4520	2232	msedge.exe	85
PID 2232 wrote to memory of 4520	2232	msedge.exe	85
PID 2232 wrote to memory of 4520	2232	msedge.exe	85
PID 2232 wrote to memory of 4520	2232	msedge.exe	85
PID 2232 wrote to memory of 4520	2232	msedge.exe	85
PID 2232 wrote to memory of 4520	2232	msedge.exe	85
PID 2232 wrote to memory of 4520	2232	msedge.exe	85
PID 2232 wrote to memory of 4520	2232	msedge.exe	85
PID 2232 wrote to memory of 4520	2232	msedge.exe	85
PID 2232 wrote to memory of 4520	2232	msedge.exe	85
PID 2232 wrote to memory of 4520	2232	msedge.exe	85
PID 2232 wrote to memory of 4520	2232	msedge.exe	85
PID 2232 wrote to memory of 4520	2232	msedge.exe	85
PID 2232 wrote to memory of 4520	2232	msedge.exe	85
PID 2232 wrote to memory of 4520	2232	msedge.exe	85
PID 2232 wrote to memory of 4520	2232	msedge.exe	85
PID 2232 wrote to memory of 4520	2232	msedge.exe	85
PID 2232 wrote to memory of 4520	2232	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eab0c0bcf335d0d8db09fd6a2d4b6c56_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7afd46f8,0x7ffe7afd4708,0x7ffe7afd4718
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,11759921188267878003,8915555246504584618,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,11759921188267878003,8915555246504584618,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,11759921188267878003,8915555246504584618,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11759921188267878003,8915555246504584618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11759921188267878003,8915555246504584618,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,11759921188267878003,8915555246504584618,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5bffe84a-fe35-406a-b3f0-f5bd22b65743.tmp

Filesize
10KB

MD5
dbc878976f3e083aa974a7439f7f6aa6

SHA1
ba00b671195c50f13b455492d0a8648287d88d2b

SHA256
b1be53f203d9082b3cdea5b3edf6dbdcdd730fda9e556955a9883c45d63bc358

SHA512
3842798fe98a36519d86c684d29e2a4ce0609b0b1cbc6135d5169eb5c94f4db34c6c22c994c49a88adeffcb9c963979f4b77e2a1f2ced30d2012a024be376b55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8119a6630bf1542462b4c40854ba03b7

SHA1
00f8d7e568e501988f9d38002c9fa32fa470ac5b

SHA256
d8a11266b39e1a67b93e829b472876da1f9012caec88f84ca4ef24e442f96bbd

SHA512
0da172690e2d7950900b5f0dd80befa7055a20461c8aa31fe075e97733ea6f73fe9b812cf7d6256942dbef3dad6f87e0c77063a70afe4599f52b491f79e19cc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8e0e112649febdd877ea4259fb364650

SHA1
194d2d1923d8d5a0224f4ea8b13dc3d18f41df21

SHA256
5400ffec58e585eedd766741c0444e7e4befb1682d1e0ddfa366bce911296a61

SHA512
0aa37ebff3da6f7900d79c4f4f16b4507d07626f483ca1df29720b713dda7d8969d359c8602866d41c8252d1fd4b4a5eb1edb517f2a7a6d78d88902838420b86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eb7cffa16ec04e138f2dca51f97441f5

SHA1
290ffe1e58491f935a5ce2763553cec338c9c390

SHA256
1e242cc7a3fbfa6a39169c6d08f3b0f68ed9f6e6ccfaa48d0a44b9383d39b63d

SHA512
c7687ce4ba0815018fba99b5328908826cd4b9850b18a70815e99eae8d91e2700423bef5cdca0b88380e9bec35ceb86ce260c189fee5c11c66911a6a7e18f358

Download Submit