54db795fdbeb0d6c5834db0a032fe659c46684c622273817152fb52eeca1472d

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 06:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac6a3ad80c29fb8666a5bd9b6e7588d_JaffaCakes118.html
Size

63KB
MD5

eac6a3ad80c29fb8666a5bd9b6e7588d
SHA1

839ba54b8371fd050faf3265321520ff3c34aa48
SHA256

54db795fdbeb0d6c5834db0a032fe659c46684c622273817152fb52eeca1472d
SHA512

11f086b28ff8c7abbe0ab660c012ddd45d84dc6b90a6bbb8e769aee2a6fb4c9a6082bfe84837266c6bb22fc390deb1209115ca65568db758ce7016fc5a14655d
SSDEEP

1536:Sd2aYT//yQzNm9F18Hj9QzNm9F18HVAvB4U1XTK/uj7S500wU3Eac9GG6/XwIC0M:Sd2aYT//yQ4A9Q43sFttZuIC0C0icln4

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2364	msedge.exe
2364	msedge.exe
1852	msedge.exe
1852	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2232	1852	msedge.exe	82
PID 1852 wrote to memory of 2232	1852	msedge.exe	82
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 3580	1852	msedge.exe	83
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 2364	1852	msedge.exe	84
PID 1852 wrote to memory of 3156	1852	msedge.exe	85
PID 1852 wrote to memory of 3156	1852	msedge.exe	85
PID 1852 wrote to memory of 3156	1852	msedge.exe	85
PID 1852 wrote to memory of 3156	1852	msedge.exe	85
PID 1852 wrote to memory of 3156	1852	msedge.exe	85
PID 1852 wrote to memory of 3156	1852	msedge.exe	85
PID 1852 wrote to memory of 3156	1852	msedge.exe	85
PID 1852 wrote to memory of 3156	1852	msedge.exe	85
PID 1852 wrote to memory of 3156	1852	msedge.exe	85
PID 1852 wrote to memory of 3156	1852	msedge.exe	85
PID 1852 wrote to memory of 3156	1852	msedge.exe	85
PID 1852 wrote to memory of 3156	1852	msedge.exe	85
PID 1852 wrote to memory of 3156	1852	msedge.exe	85
PID 1852 wrote to memory of 3156	1852	msedge.exe	85
PID 1852 wrote to memory of 3156	1852	msedge.exe	85
PID 1852 wrote to memory of 3156	1852	msedge.exe	85
PID 1852 wrote to memory of 3156	1852	msedge.exe	85
PID 1852 wrote to memory of 3156	1852	msedge.exe	85
PID 1852 wrote to memory of 3156	1852	msedge.exe	85
PID 1852 wrote to memory of 3156	1852	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eac6a3ad80c29fb8666a5bd9b6e7588d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c68146f8,0x7ff9c6814708,0x7ff9c6814718
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2472104416209938506,15448685274652771141,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,2472104416209938506,15448685274652771141,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,2472104416209938506,15448685274652771141,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2472104416209938506,15448685274652771141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2472104416209938506,15448685274652771141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2472104416209938506,15448685274652771141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2472104416209938506,15448685274652771141,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2472104416209938506,15448685274652771141,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
771B

MD5
35afe827cda194cfb09dfcd973139eb8

SHA1
a0cbb94d4fa4de981e636b39b969cc9e065a46a6

SHA256
9219c26eb33dc9c2469618e3575fa83ac4132b4138f14ef4b4e6d4db9128e6db

SHA512
ef52ab62c611719b38c31591bd9e028445cb111fd6fc70e8defa3559935177f2eb4522e32af174bb420601e415cb23d79333ae04322d3809186d53ae97d9debb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6d2c3b08b46853bdaa1162fe8a7305fd

SHA1
e4589193b9ee6e9bbaeb58982b9fed06f481b8d0

SHA256
19bde3f02213808ba51a5b06f737e0c5024bd6f06c69e900e953aa2fcc035284

SHA512
83498ccf2f0015756cf10d44e25d32392a9f49099ac63b83596186ef38816907a634052efaf36ae1c8b1808e93e9af931fe8078c84f1b8025e36d8e02549e424

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6a42f6fc7432fad8e66899ec2895950b

SHA1
5a4ff488a1a2b3242adf5c8bb0c5bb4213856ec6

SHA256
0429896668d06f34b9c2d0f0af86ac8c42f667da5bcaab98a3802245a3a23aa7

SHA512
f65cc7282cbfee011ff3dc9bc824be2abc0c15a4e1c2410b13a3b85a5746378a324fdf4d913c8e211e02e6328fe21e11e6e0f7f0038875d87af6bd9920a2ec3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8f62cf0dbd753db5256e71b2e03e0a22

SHA1
5e16e406a96e6c223a95070f0e8548089b8ab10e

SHA256
31982efba19564bb2a082e99d4945119c7edfbb1d3527cf2f7a2d8a24621928c

SHA512
dfb40a568b20234ca459c9dedfbe0da16ff2de2771e2639c5f3d19ec42588ea157a7e2b7b3e6655aea14069aa031b51ff79a011b453abc9a2362a524433b99d3

Download Submit