bef79645d05d769bb68894168cf3baf2ffc3ff544972c9ab5016889ccc3ea161

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2024 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eee5adf8ab2218a410b9ae7e55ee349a_JaffaCakes118.html
Size

213KB
MD5

eee5adf8ab2218a410b9ae7e55ee349a
SHA1

0f82a453a154b0cc79dc21369addbda4d4b12969
SHA256

bef79645d05d769bb68894168cf3baf2ffc3ff544972c9ab5016889ccc3ea161
SHA512

e3ad464fb67c59a7f34eeb76590aca2d5c947fb66f79bcc399966ce5cb48549a0562a0236368f31a838e0262277795cec65795f4ff3848f5c4c03d4f25aa8b45
SSDEEP

3072:Stq6VO/ELcXnyfkMY+BES09JXAnyrZalI+YQ:StqRZysMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
3300	msedge.exe
3300	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3300	msedge.exe
3300	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe
3300	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 3240	3300	msedge.exe	82
PID 3300 wrote to memory of 3240	3300	msedge.exe	82
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4780	3300	msedge.exe	83
PID 3300 wrote to memory of 4984	3300	msedge.exe	84
PID 3300 wrote to memory of 4984	3300	msedge.exe	84
PID 3300 wrote to memory of 4164	3300	msedge.exe	85
PID 3300 wrote to memory of 4164	3300	msedge.exe	85
PID 3300 wrote to memory of 4164	3300	msedge.exe	85
PID 3300 wrote to memory of 4164	3300	msedge.exe	85
PID 3300 wrote to memory of 4164	3300	msedge.exe	85
PID 3300 wrote to memory of 4164	3300	msedge.exe	85
PID 3300 wrote to memory of 4164	3300	msedge.exe	85
PID 3300 wrote to memory of 4164	3300	msedge.exe	85
PID 3300 wrote to memory of 4164	3300	msedge.exe	85
PID 3300 wrote to memory of 4164	3300	msedge.exe	85
PID 3300 wrote to memory of 4164	3300	msedge.exe	85
PID 3300 wrote to memory of 4164	3300	msedge.exe	85
PID 3300 wrote to memory of 4164	3300	msedge.exe	85
PID 3300 wrote to memory of 4164	3300	msedge.exe	85
PID 3300 wrote to memory of 4164	3300	msedge.exe	85
PID 3300 wrote to memory of 4164	3300	msedge.exe	85
PID 3300 wrote to memory of 4164	3300	msedge.exe	85
PID 3300 wrote to memory of 4164	3300	msedge.exe	85
PID 3300 wrote to memory of 4164	3300	msedge.exe	85
PID 3300 wrote to memory of 4164	3300	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eee5adf8ab2218a410b9ae7e55ee349a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed10146f8,0x7ffed1014708,0x7ffed1014718
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,3873734749145411602,11339651894894483809,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,3873734749145411602,11339651894894483809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,3873734749145411602,11339651894894483809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3873734749145411602,11339651894894483809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3873734749145411602,11339651894894483809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,3873734749145411602,11339651894894483809,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
11ddd5f26232a6d850acedc3a41dd0a0

SHA1
fb0b4f527e2bbba09efd7124c8e420f7c59f8d23

SHA256
f9b8334d0ba7f8620da5c79879b5c924712d76e36b974ff8fa3e5dac350b826f

SHA512
d9c9a40ea678b79eb4a2ba83d26c811ccda3616738ac3a4821a539536b71f8a9286ccb936c5805f278bcbe117b9fcf497cb9467bec5a0a217e7d15e5da45f0fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0073ca1755dd32ee87535e42133da137

SHA1
7989a2b6cca74d8feb256bc25eef0a9af35bb0b6

SHA256
1dd8c9bff8b149f4d2e9e7ead07469ad8cacff12e158b5c23cd9424358b9328d

SHA512
8313c7e33bc39518b19be257d834917eabdd140eeaf91e135d8930a3b3c0a788358a836dc7cccf5e25d299ac14d77009c6a746560f916d5785ad2104f227db4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
91e52e1394179ecbb5f8513db1fa49a9

SHA1
c9ae31dd6000cb5b01eb81c7d0042e00431ab6fd

SHA256
d88d1510e9f9c49028809cb013551ec28ce1e607d1c8ee17dbc5578137553166

SHA512
df15b19863c0ecdbc50b5d0e6c1bd77f424217c7e8cc77e72d5d4b8ba6a0e44e97300a1aa5cd717160703c2efc95d33762ee4b4461004aed9efefc2182a91766

Download Submit