299d8d844ad357b311e241105ffbb99b1a613f812b3bc86552e0d19363c767a4

Analysis

max time kernel
94s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eab7a4d628d0c49391edb8fce80e82de_JaffaCakes118.html
Size

111KB
MD5

eab7a4d628d0c49391edb8fce80e82de
SHA1

bc157727fb861c4e2c9ac7dc84ea86105fca2393
SHA256

299d8d844ad357b311e241105ffbb99b1a613f812b3bc86552e0d19363c767a4
SHA512

9a283e4bb2e224afacfa513732e5ba5c5079c8027ddb89f6b3d4e58a82fcca26865507388d3ca55c309713767e24e7e0958651115434daaea5cddb3c33ccba14
SSDEEP

1536:/yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsQSz:/yfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1316	msedge.exe
1316	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
220	msedge.exe
220	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 1536	220	msedge.exe	82
PID 220 wrote to memory of 1536	220	msedge.exe	82
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1688	220	msedge.exe	83
PID 220 wrote to memory of 1316	220	msedge.exe	84
PID 220 wrote to memory of 1316	220	msedge.exe	84
PID 220 wrote to memory of 2336	220	msedge.exe	85
PID 220 wrote to memory of 2336	220	msedge.exe	85
PID 220 wrote to memory of 2336	220	msedge.exe	85
PID 220 wrote to memory of 2336	220	msedge.exe	85
PID 220 wrote to memory of 2336	220	msedge.exe	85
PID 220 wrote to memory of 2336	220	msedge.exe	85
PID 220 wrote to memory of 2336	220	msedge.exe	85
PID 220 wrote to memory of 2336	220	msedge.exe	85
PID 220 wrote to memory of 2336	220	msedge.exe	85
PID 220 wrote to memory of 2336	220	msedge.exe	85
PID 220 wrote to memory of 2336	220	msedge.exe	85
PID 220 wrote to memory of 2336	220	msedge.exe	85
PID 220 wrote to memory of 2336	220	msedge.exe	85
PID 220 wrote to memory of 2336	220	msedge.exe	85
PID 220 wrote to memory of 2336	220	msedge.exe	85
PID 220 wrote to memory of 2336	220	msedge.exe	85
PID 220 wrote to memory of 2336	220	msedge.exe	85
PID 220 wrote to memory of 2336	220	msedge.exe	85
PID 220 wrote to memory of 2336	220	msedge.exe	85
PID 220 wrote to memory of 2336	220	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eab7a4d628d0c49391edb8fce80e82de_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa47c746f8,0x7ffa47c74708,0x7ffa47c74718
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2272,6425814739515875439,13262077753977872531,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2272,6425814739515875439,13262077753977872531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2272,6425814739515875439,13262077753977872531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,6425814739515875439,13262077753977872531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,6425814739515875439,13262077753977872531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
76149627fbe1de9da027afad3782635f

SHA1
d058fa5a0f048c52b391205f12b7e34c4a440c5f

SHA256
b0c5477f283909d10451bb8fcc80f1fa80751d136621b9da6f5bd818099b1299

SHA512
3b11ce5b309eb5bd6f6df40ba3af4f3ab471639be107d7ae428b6172690213d07f6816e9f7db76a8e6756a6e00862c67dc3e5b33d0e7866a2e0c2a8ff35bdc2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
32a0b8c485b39f641a4bed5244cfc4d6

SHA1
94b5af453bd3580d11a3413971709f51961f5143

SHA256
4ac34e38fc353a7e165d1f913a3ab54e95a39e7cf1a938edcd170f53f2aed19e

SHA512
39247628c139d1a06e8b8528b054be4a1d39fe0a7f5f8660ef030fbedbac7c8b19855b98b4dc1cdfb93032be2c86a59ad6f44d7acc74aaab96e64604fd7d8207

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
be76d139a3087a8c7db3c95e7b8b6b46

SHA1
9b7639b9dc30778f263ab40c7ef96d55fce9e8dd

SHA256
e186537508fd56c596a4129d2504532b219b5b7d8976d21362c97a79f0ef7cdb

SHA512
244ecd9084e138d783905030dae6e57535b1d817435e6ddb2093f6a0b538768118de85033fce8fbcf9f714eac00bb6442e806aa6bf7e735f30df953d3393daaa

Download Submit