656ebabd469bf5a2afa72bc1f44ab48cdfd9824e848494316053a4b61c8378e6

Analysis

max time kernel
145s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ebaf6f9dab7b28cb8be0535a1858e38c_JaffaCakes118.html
Size 343KB
Sample240919-te919axeqm
SHA256 656ebabd469bf5a2afa72bc1f44ab48cdfd9824e848494316053a4b61c8378e6
MD5 ebaf6f9dab7b28cb8be0535a1858e38c
SHA1 335bccf1b913bc35ac4e1d1c6673b7b58f55e1bc
SHA512 0aa24f40f7ecc75b2955b41d62a4ed5559e7b31bce620bd35e59759dce144b7f661c59b2a7f4b926ae1bdc1a249e55f4ae7f57439da7468e38c893f67838d063
SSDEEP 6144:SwsMYod+X3oI+Y0RsMYod+X3oI+YWsMYod+X3oI+YQ:h5d+X385d+X3y5d+X3+
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
812	msedge.exe
812	msedge.exe
1124	msedge.exe
1124	msedge.exe
4224	identity_helper.exe
4224	identity_helper.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe
1124	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 436	1124	msedge.exe	82
PID 1124 wrote to memory of 436	1124	msedge.exe	82
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 3512	1124	msedge.exe	83
PID 1124 wrote to memory of 812	1124	msedge.exe	84
PID 1124 wrote to memory of 812	1124	msedge.exe	84
PID 1124 wrote to memory of 4428	1124	msedge.exe	85
PID 1124 wrote to memory of 4428	1124	msedge.exe	85
PID 1124 wrote to memory of 4428	1124	msedge.exe	85
PID 1124 wrote to memory of 4428	1124	msedge.exe	85
PID 1124 wrote to memory of 4428	1124	msedge.exe	85
PID 1124 wrote to memory of 4428	1124	msedge.exe	85
PID 1124 wrote to memory of 4428	1124	msedge.exe	85
PID 1124 wrote to memory of 4428	1124	msedge.exe	85
PID 1124 wrote to memory of 4428	1124	msedge.exe	85
PID 1124 wrote to memory of 4428	1124	msedge.exe	85
PID 1124 wrote to memory of 4428	1124	msedge.exe	85
PID 1124 wrote to memory of 4428	1124	msedge.exe	85
PID 1124 wrote to memory of 4428	1124	msedge.exe	85
PID 1124 wrote to memory of 4428	1124	msedge.exe	85
PID 1124 wrote to memory of 4428	1124	msedge.exe	85
PID 1124 wrote to memory of 4428	1124	msedge.exe	85
PID 1124 wrote to memory of 4428	1124	msedge.exe	85
PID 1124 wrote to memory of 4428	1124	msedge.exe	85
PID 1124 wrote to memory of 4428	1124	msedge.exe	85
PID 1124 wrote to memory of 4428	1124	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ebaf6f9dab7b28cb8be0535a1858e38c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd171146f8,0x7ffd17114708,0x7ffd17114718
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,7088115141143016430,8942232885711517542,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,7088115141143016430,8942232885711517542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,7088115141143016430,8942232885711517542,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7088115141143016430,8942232885711517542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7088115141143016430,8942232885711517542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,7088115141143016430,8942232885711517542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4140 /prefetch:8
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,7088115141143016430,8942232885711517542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7088115141143016430,8942232885711517542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7088115141143016430,8942232885711517542,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7088115141143016430,8942232885711517542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7088115141143016430,8942232885711517542,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,7088115141143016430,8942232885711517542,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
MD5 f9664c896e19205022c094d725f820b6
SHA1 f8f1baf648df755ba64b412d512446baf88c0184
SHA512 3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
MD5 847d47008dbea51cb1732d54861ba9c9
SHA1 f2099242027dccb88d6f05760b57f7c89d926c0d
SHA512 bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
MD5 SHA1 SHA512

Submit Download

65e0b4e6-165f-45bc-b422-781aef1156be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\65e0b4e6-165f-45bc-b422-781aef1156be.tmp
Size 5KB
SHA256 36b3cdb4068edbe885b4149c672d5da99c8386dfb01f7ff07ede32a3539bf9ff
MD5 53df732e2437b1df84a4dbf8d5a08f36
SHA1 91e4f29c194631336635756b74c5b283feeca3dd
SHA512 4b324668350bcc5e8520270d9a2f4be8d179af4bf6f0b4d604bfe857a8033c39ffa94502ac94d8eaad6eefbca721df945409366f2518643a0fa53407af9e0608
SSDEEP 96:n4kxhi13gLOrwpvWMoiVmdeH4s5TPUWQyV+VDCziEwb:n4kxgCGGWMXTPro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9b94b2bf07656b29b6dd39ec0a73f0da2a176ab42ee2cfdcb7d909a4c29a3e4c
MD5 8408d8db664c3aac893c5a53806a666c
SHA1 129ee6fea6a0cbb9c334db44a3175b88b5b8a3ca
SHA512 048084f0d20b5bd1f8e7ecc2ab031fb58ca5c23fac22a8081cf0b2c8143c41d8ff9713318893d05d51b80ea82cba9543f0ecdb88ce129487add0ad9f597acf93
SSDEEP 96:n4kxMoi13guOrwpvWMoiVmdeH4s5TPUWQyV+VD7AiEwb:n4kxIC/GWMXTPrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 9cbbeefe172fec76c202a9b9d16bb2f87cd5a7e15f755de2108044d4d99735cd
MD5 760022d75571b39e8f600fc632ae2553
SHA1 21d0e1f336a58076964cdb9639f1d6d39cb26101
SHA512 bfda42674e5e705f56bdb1f591d36ee7d18000a03eb44689544291fd37ebf7211b7ded7ae89b8de824d4c9dc0d2960f27fb90b90357dbe83409584b6516883e5
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupoe2RUVi6SIcM/bo5Zxn:A9iIxuERzA83h09RZxYGK7qZxn
MD5 SHA1 SHA512 SSDEEP

Submit Download