60a69af28843750ffdd1f6fb8ce8f4b3ca1252d04ffad5c8e4f7c7928fa4dbb6

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 18:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ebeed265c60248570e1eeadd628079af_JaffaCakes118.html
Size

229KB
MD5

ebeed265c60248570e1eeadd628079af
SHA1

05bd3bc36e8ff4ace8f486cee53b95a193090e61
SHA256

60a69af28843750ffdd1f6fb8ce8f4b3ca1252d04ffad5c8e4f7c7928fa4dbb6
SHA512

bfd0462da73a1880cbe2ffd94cf8f4ff1fd0ba5c0eacafc751402ee40127c5b7bb693ad1e85c8d696790c859fa4cb727f5d03cec6fcd52102c16844cc44f408d
SSDEEP

1536:dAoV4ZsXaQVuxZqUl08pYxm/8JpVxvwp4Z04n3CqxZFl4Lk9nMWf5KFHbh3rm2fQ:t9gcDI+PJ9nMWf5KFHbh3rm2fQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4056	msedge.exe
4056	msedge.exe
3436	msedge.exe
3436	msedge.exe
3524	identity_helper.exe
3524	identity_helper.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe
2964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 428	3436	msedge.exe	82
PID 3436 wrote to memory of 428	3436	msedge.exe	82
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4320	3436	msedge.exe	83
PID 3436 wrote to memory of 4056	3436	msedge.exe	84
PID 3436 wrote to memory of 4056	3436	msedge.exe	84
PID 3436 wrote to memory of 1768	3436	msedge.exe	85
PID 3436 wrote to memory of 1768	3436	msedge.exe	85
PID 3436 wrote to memory of 1768	3436	msedge.exe	85
PID 3436 wrote to memory of 1768	3436	msedge.exe	85
PID 3436 wrote to memory of 1768	3436	msedge.exe	85
PID 3436 wrote to memory of 1768	3436	msedge.exe	85
PID 3436 wrote to memory of 1768	3436	msedge.exe	85
PID 3436 wrote to memory of 1768	3436	msedge.exe	85
PID 3436 wrote to memory of 1768	3436	msedge.exe	85
PID 3436 wrote to memory of 1768	3436	msedge.exe	85
PID 3436 wrote to memory of 1768	3436	msedge.exe	85
PID 3436 wrote to memory of 1768	3436	msedge.exe	85
PID 3436 wrote to memory of 1768	3436	msedge.exe	85
PID 3436 wrote to memory of 1768	3436	msedge.exe	85
PID 3436 wrote to memory of 1768	3436	msedge.exe	85
PID 3436 wrote to memory of 1768	3436	msedge.exe	85
PID 3436 wrote to memory of 1768	3436	msedge.exe	85
PID 3436 wrote to memory of 1768	3436	msedge.exe	85
PID 3436 wrote to memory of 1768	3436	msedge.exe	85
PID 3436 wrote to memory of 1768	3436	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ebeed265c60248570e1eeadd628079af_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc28c346f8,0x7ffc28c34708,0x7ffc28c34718
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,15475983478359247280,351351851994771444,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,15475983478359247280,351351851994771444,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,15475983478359247280,351351851994771444,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15475983478359247280,351351851994771444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15475983478359247280,351351851994771444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,15475983478359247280,351351851994771444,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4064 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,15475983478359247280,351351851994771444,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15475983478359247280,351351851994771444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15475983478359247280,351351851994771444,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15475983478359247280,351351851994771444,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15475983478359247280,351351851994771444,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,15475983478359247280,351351851994771444,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
745a3604468e14281fcb2b2f37b7df98

SHA1
2c991318f5207a1fac474a6a177452eb7430e0ff

SHA256
c59166155eef58906533ed8f127c87070f7a3ecce1d9669524a4bcbaa433f542

SHA512
354291eb95872ce9c2810a9a6a1a5cd2d454c477ac8bb0c1058435654d4d4fa53f859701c51e64d12e2829ee652dce612b04b49016665a78770b11fdc710e601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
292fd5947aa880697118bb12605210ad

SHA1
b5b59d2c7c7e012cdd375ef57db99ad80412dd2b

SHA256
c998bbbcba6418d842292104294300b1f2da9f77533dc8aef466f4812c063a18

SHA512
6499c6c7c31f4536c6392c50f31622ec8e113d08c4beb152636684587411100b1e91a8b5e23244e5c7e4277dc5da9474e78c457590361ea83e8f24ffd5f487c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6adaf8e8f750bc5e0f1f8c80edd9ec2f

SHA1
68335c6c9c1785bce0e93f494a873631f15535c4

SHA256
425fc479af38851122f4aeab0b87e413e340d115c01c4e133bf7fdea47e354de

SHA512
234e7e0bd0a92ba2fc43258e6fddc4f5a04796b7f637053bf25d7bc79194706e1a27d107e565b3b0a2503c96b7dbb937947bd9c5f63898c5036f8ea1e94f3b07

Download Submit