25b01e37808c3c22ce763d773eb6ee7da0e221d6b2b474a4fac12e3111224d2e

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 08:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaee5096b4420ec3bcc6fc7f857c86b1_JaffaCakes118.html
Size

34KB
MD5

eaee5096b4420ec3bcc6fc7f857c86b1
SHA1

7ea5b86b82c01beb2e6779ebb81d3c9613911bbb
SHA256

25b01e37808c3c22ce763d773eb6ee7da0e221d6b2b474a4fac12e3111224d2e
SHA512

2d055f62a1168478ed25b2299bd4c4bff0330ec530896a9275cc563ab41ba52df623da9c1b6b666f6c322509957f2cf126d66bc9b86c331dfe47413556147a5b
SSDEEP

768:yhSeE85FW1Z1TNuxMwkMcL02TXOAQ9d5hJBzZf7dhM8k7zBAvgkRC1X1nzK:yhdEyFW1Z1TNuxMwkMcL0sXOLdBzB7d1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1972	msedge.exe
1972	msedge.exe
4240	msedge.exe
4240	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe
4240	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 1844	4240	msedge.exe	83
PID 4240 wrote to memory of 1844	4240	msedge.exe	83
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1660	4240	msedge.exe	84
PID 4240 wrote to memory of 1972	4240	msedge.exe	85
PID 4240 wrote to memory of 1972	4240	msedge.exe	85
PID 4240 wrote to memory of 4484	4240	msedge.exe	86
PID 4240 wrote to memory of 4484	4240	msedge.exe	86
PID 4240 wrote to memory of 4484	4240	msedge.exe	86
PID 4240 wrote to memory of 4484	4240	msedge.exe	86
PID 4240 wrote to memory of 4484	4240	msedge.exe	86
PID 4240 wrote to memory of 4484	4240	msedge.exe	86
PID 4240 wrote to memory of 4484	4240	msedge.exe	86
PID 4240 wrote to memory of 4484	4240	msedge.exe	86
PID 4240 wrote to memory of 4484	4240	msedge.exe	86
PID 4240 wrote to memory of 4484	4240	msedge.exe	86
PID 4240 wrote to memory of 4484	4240	msedge.exe	86
PID 4240 wrote to memory of 4484	4240	msedge.exe	86
PID 4240 wrote to memory of 4484	4240	msedge.exe	86
PID 4240 wrote to memory of 4484	4240	msedge.exe	86
PID 4240 wrote to memory of 4484	4240	msedge.exe	86
PID 4240 wrote to memory of 4484	4240	msedge.exe	86
PID 4240 wrote to memory of 4484	4240	msedge.exe	86
PID 4240 wrote to memory of 4484	4240	msedge.exe	86
PID 4240 wrote to memory of 4484	4240	msedge.exe	86
PID 4240 wrote to memory of 4484	4240	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eaee5096b4420ec3bcc6fc7f857c86b1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeda2046f8,0x7ffeda204708,0x7ffeda204718
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10038733804953973643,11241879501136381282,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,10038733804953973643,11241879501136381282,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,10038733804953973643,11241879501136381282,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10038733804953973643,11241879501136381282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10038733804953973643,11241879501136381282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10038733804953973643,11241879501136381282,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10038733804953973643,11241879501136381282,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
182B

MD5
4e6156be729a4f65681a10847e3fbf09

SHA1
e033f0e00b5d0dbde58a987a4383d4d99bf7a981

SHA256
a97fb78f7350d3dde3804344efb6c1af5d481ff259d8c485e8cf8c4851ef87b0

SHA512
9767982ea89f85cf77879d14e11d1baf5ea0b0da1fe499a5897f30c966f4cd94368d93bd20cb3a2dd0ffa74c8957a6fd7fffe917f33c221edacf24b0be13e0d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
22283916c2f824361d023ea25157a7b3

SHA1
7063d3b76a8c4fe1fd0438d4c87252e4a2e2853a

SHA256
c574f874ca406f474041ededfcf8e53cc79af989570f3e5fe29a822c1c10ef53

SHA512
f5798e613067f97526e6dbe86ea3a07719326e623da4761064bd7026dafdc548136310ff8f5627ddc63f7ac8fa37a950ad0126425ef532390ba247cf3fedcaba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a643e02a7931f0d6fc20587e327aa85b

SHA1
ecfd6af07ee3ccab19f2aab44093f9121b33ae32

SHA256
a133ae0f0172f87773989478256964a8a7ad8e75335661f332bc646137c25e8e

SHA512
39c5a09147d7a742bb0748d9d4d7f56b7e67bb8c3cd04586acb814df2fc439d7e47763f41944044f8077a914b7587330dbcf70ff4fc190d362c197e923bf107d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ebe52d7fedac659009099b1a34711cbc

SHA1
c96c0df6090d4100348c1c7bba33200b25dd20ce

SHA256
f0b2d9438d8f72fa1878b8a8b027167021dfdd9f1f8da79256e73c7cefd2ebd1

SHA512
07a49dedefc28b45c7b0dfc16f8fb90f35fc2cbc98b4328079b4758ca125cc54da987cffe639f1604d716fc0d1aa5540cb6b4e779903e9820f8c5fecaf828976

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f210d85d9e33a9d2bac8dee0a655bfc8

SHA1
eba6edb31754b9c0685b5fde37beeff262b62764

SHA256
709aa2105e4a99fed73f475cad57e7796e6d98ae16188f87b67be65b6f668b8e

SHA512
45a5d84ff5e3618a0333b85f9a6d9fde1961519429585d48645724b8aeb1b24530278966069e2b089b4f5f4e96f6b3321c84fb69ad40f71941c6fb2f8769a65a

Download Submit