2c031eecca190974ea88a0064dbf0cedc0e90f2138f548d93c7420935c829535

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eabc12bf37dfa206ce72f31e9e7b8b47_JaffaCakes118.html
Size

339B
MD5

eabc12bf37dfa206ce72f31e9e7b8b47
SHA1

50599b6ee4afe831dd9eca4580e06aebce517514
SHA256

2c031eecca190974ea88a0064dbf0cedc0e90f2138f548d93c7420935c829535
SHA512

f9feef605a7c088df5edb560360565d0562a54281eb4dd122a87f0d7889eeb6c38ba1c7d310155a8a5d2df43180df1daf2ff22366127f157b33f3be2c82cf2e7

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
3540	msedge.exe
3540	msedge.exe
3836	identity_helper.exe
3836	identity_helper.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe
3540	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 3044	3540	msedge.exe	85
PID 3540 wrote to memory of 3044	3540	msedge.exe	85
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3388	3540	msedge.exe	86
PID 3540 wrote to memory of 3256	3540	msedge.exe	87
PID 3540 wrote to memory of 3256	3540	msedge.exe	87
PID 3540 wrote to memory of 2704	3540	msedge.exe	88
PID 3540 wrote to memory of 2704	3540	msedge.exe	88
PID 3540 wrote to memory of 2704	3540	msedge.exe	88
PID 3540 wrote to memory of 2704	3540	msedge.exe	88
PID 3540 wrote to memory of 2704	3540	msedge.exe	88
PID 3540 wrote to memory of 2704	3540	msedge.exe	88
PID 3540 wrote to memory of 2704	3540	msedge.exe	88
PID 3540 wrote to memory of 2704	3540	msedge.exe	88
PID 3540 wrote to memory of 2704	3540	msedge.exe	88
PID 3540 wrote to memory of 2704	3540	msedge.exe	88
PID 3540 wrote to memory of 2704	3540	msedge.exe	88
PID 3540 wrote to memory of 2704	3540	msedge.exe	88
PID 3540 wrote to memory of 2704	3540	msedge.exe	88
PID 3540 wrote to memory of 2704	3540	msedge.exe	88
PID 3540 wrote to memory of 2704	3540	msedge.exe	88
PID 3540 wrote to memory of 2704	3540	msedge.exe	88
PID 3540 wrote to memory of 2704	3540	msedge.exe	88
PID 3540 wrote to memory of 2704	3540	msedge.exe	88
PID 3540 wrote to memory of 2704	3540	msedge.exe	88
PID 3540 wrote to memory of 2704	3540	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eabc12bf37dfa206ce72f31e9e7b8b47_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc538f46f8,0x7ffc538f4708,0x7ffc538f4718
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3070463137290614350,6106862596163302960,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,3070463137290614350,6106862596163302960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,3070463137290614350,6106862596163302960,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3070463137290614350,6106862596163302960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3070463137290614350,6106862596163302960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,3070463137290614350,6106862596163302960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,3070463137290614350,6106862596163302960,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3070463137290614350,6106862596163302960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3070463137290614350,6106862596163302960,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3070463137290614350,6106862596163302960,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3070463137290614350,6106862596163302960,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3070463137290614350,6106862596163302960,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1388 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\99f72a77-406a-44d6-ba08-e578172e668c.tmp

Filesize
6KB

MD5
e22fee16f2c37ca4560b274532c30be4

SHA1
41b584ee77bbc78257230324cc1f2e106a69ec84

SHA256
dea2bca4159d10d9a78b36e72f4ed6cb93773e633aaff5ab2244832cafc842ee

SHA512
23e224c62391ec7d17dc8f9eb5b3b5e34a219e27a631bb9559fb494b57ae28d8314322e75728a9d6543e9a0234550fc7131711f8785d29392fdbfd65dff0d920

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
395B

MD5
aabbf239e2186ab2f27407bd66de32e2

SHA1
7e5f69536dd0096d8912c3ff9e57167d81a21dd1

SHA256
25adba1ea77d2d7df38dd627ebf168a203f16ce63a5926ff3cf4ea57ca2f13a2

SHA512
c0c279c0d8c527a73831e626772f1e4d2fbcd16b23b01af130c8ee913fa7cda73ff2011c09f9a5e3437a0d99887723a3d89fea753c8f235b8d7b7ea5691a90d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
581501e123ce961693aa9514883f93d9

SHA1
222fd15e0aab1d9c17bb64dedc048ac66493612a

SHA256
e0fff3c85c09412f9b2826b4f77d8e1e49afacffecced688ebc557f009335135

SHA512
2651e5be1aa883024b7bb11384e3d355b5b2d17c0305d33f271895beb99945da110df24e456b87e3833a2293fbfa74abb933a8bc3ebadcf2642ba55e823cd5e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
64d2d8f166ccf70a46fc602ef61d3398

SHA1
bc1d99d7402d6dec7430aa2b540cb15d0ee53fec

SHA256
531f824ff8eb57d036fb3bfff16fcfec2feec56955011f51b0c8a5dfb08ace47

SHA512
44064e10bb5c5643af74624341162d79cd2e14850967b29a6324808a35f82698ab99fd29040b2ed101029c0e2cc2c83dcf7756da8c106c2d7190f95786fdb251

Download Submit