17240f0ee22c464867764676e4a1a3007788d42ff289e4bcdb82724e322082c0

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 06:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

eac51b2cbcdb1671f03e17a240df8971_JaffaCakes118.html
Size

132KB
MD5

eac51b2cbcdb1671f03e17a240df8971
SHA1

acb9558c7fad0ac39fc099e15a59cdeb652b8091
SHA256

17240f0ee22c464867764676e4a1a3007788d42ff289e4bcdb82724e322082c0
SHA512

0cc8174fe39449d4eca3bf7c9b8e2a9a50eb20221c3d2662fae4f1010655bf92b97a85b75fb3c04b3c06359549fe4b61af3c0f9890733dffaeec6e4a947acc4e
SSDEEP

1536:S92m5GuumZgLQnWvMNP49yGNQvT+XMqWROJzh8MEyLi+rffMxqNisaQx4V5roEIj:SBJyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4084	msedge.exe
4084	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 2152	4084	msedge.exe	82
PID 4084 wrote to memory of 2152	4084	msedge.exe	82
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4784	4084	msedge.exe	83
PID 4084 wrote to memory of 4396	4084	msedge.exe	84
PID 4084 wrote to memory of 4396	4084	msedge.exe	84
PID 4084 wrote to memory of 1432	4084	msedge.exe	85
PID 4084 wrote to memory of 1432	4084	msedge.exe	85
PID 4084 wrote to memory of 1432	4084	msedge.exe	85
PID 4084 wrote to memory of 1432	4084	msedge.exe	85
PID 4084 wrote to memory of 1432	4084	msedge.exe	85
PID 4084 wrote to memory of 1432	4084	msedge.exe	85
PID 4084 wrote to memory of 1432	4084	msedge.exe	85
PID 4084 wrote to memory of 1432	4084	msedge.exe	85
PID 4084 wrote to memory of 1432	4084	msedge.exe	85
PID 4084 wrote to memory of 1432	4084	msedge.exe	85
PID 4084 wrote to memory of 1432	4084	msedge.exe	85
PID 4084 wrote to memory of 1432	4084	msedge.exe	85
PID 4084 wrote to memory of 1432	4084	msedge.exe	85
PID 4084 wrote to memory of 1432	4084	msedge.exe	85
PID 4084 wrote to memory of 1432	4084	msedge.exe	85
PID 4084 wrote to memory of 1432	4084	msedge.exe	85
PID 4084 wrote to memory of 1432	4084	msedge.exe	85
PID 4084 wrote to memory of 1432	4084	msedge.exe	85
PID 4084 wrote to memory of 1432	4084	msedge.exe	85
PID 4084 wrote to memory of 1432	4084	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eac51b2cbcdb1671f03e17a240df8971_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffade5446f8,0x7ffade544708,0x7ffade544718
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2923934490597550939,18056602910173842042,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,2923934490597550939,18056602910173842042,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,2923934490597550939,18056602910173842042,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2923934490597550939,18056602910173842042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2923934490597550939,18056602910173842042,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2923934490597550939,18056602910173842042,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1336 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ca69f66f404b8a7217280b4bc6edc192

SHA1
b72f04db57b8fb51893e091d9b171af5cdd45e18

SHA256
2940b4a21680b716f765f95e3a984b62bf5a2264a0bcaf4a7864f2f9c2a0c168

SHA512
e71a3d629bfde33d1027506fb6e90b1df47a95759ba0c31d57ce483022b07979bbb0caa40a3189e102fc8d2b3e5183bfdd5868f46bb71aecd91594faf5704bce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
48587e43944661cc22fcec1a3594feb6

SHA1
6bf8a3024fbc235c9275865dc6ce6cba2405d1bf

SHA256
353c599526bd77a9735adcabd5bf75431fd531e3dac68039099deb36c4b03009

SHA512
48652f0769689d01f0bd9150e3da7c2da8e7055f05d58d2174a83a1b958575076891d625fd25ef030bb87daeaaab36126843fe41718f34d17dc12bb5ba615942

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fde91f6c318af58938a826a39f34a767

SHA1
4a5a9ce10f6b560e610d118de0c1d1b468e83489

SHA256
05b3db0a2ebfe40d307d8a4c887ccb3672138c6476a88830da177d1fc2e0cccd

SHA512
568c037d0128fe0b1af4be8471a9dd038b4cf8b7bbbc4f2e1a91cacad3d578330e071977f42701e5689864a2de65d82c09c409fc0d0d6d53bcbb4ec1b9e50065

Download Submit