5544d7d901bcbc6b7f21ab58a5a6559b7930d9f300de22af2e406234e89542e2

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 23:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f70abab105cc8f4752bf5dc412f4782e_JaffaCakes118.html
Size

160KB
MD5

f70abab105cc8f4752bf5dc412f4782e
SHA1

6d0c7cd0aa3c998df36decea825da7e60ba58479
SHA256

5544d7d901bcbc6b7f21ab58a5a6559b7930d9f300de22af2e406234e89542e2
SHA512

1db51c8c27ed55c947360f049172ff949e2502e2721ef39189389d21c3fec129a0a6be712d6851023433e012a7e903fda701d41a8c9eb5470a67255a46028875
SSDEEP

1536:SnZdpxXaQ40QulIF/yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3p:SnOv0I/yfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3768	msedge.exe
3768	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe
2600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 748	5084	msedge.exe	85
PID 5084 wrote to memory of 748	5084	msedge.exe	85
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 1896	5084	msedge.exe	86
PID 5084 wrote to memory of 3768	5084	msedge.exe	87
PID 5084 wrote to memory of 3768	5084	msedge.exe	87
PID 5084 wrote to memory of 2308	5084	msedge.exe	88
PID 5084 wrote to memory of 2308	5084	msedge.exe	88
PID 5084 wrote to memory of 2308	5084	msedge.exe	88
PID 5084 wrote to memory of 2308	5084	msedge.exe	88
PID 5084 wrote to memory of 2308	5084	msedge.exe	88
PID 5084 wrote to memory of 2308	5084	msedge.exe	88
PID 5084 wrote to memory of 2308	5084	msedge.exe	88
PID 5084 wrote to memory of 2308	5084	msedge.exe	88
PID 5084 wrote to memory of 2308	5084	msedge.exe	88
PID 5084 wrote to memory of 2308	5084	msedge.exe	88
PID 5084 wrote to memory of 2308	5084	msedge.exe	88
PID 5084 wrote to memory of 2308	5084	msedge.exe	88
PID 5084 wrote to memory of 2308	5084	msedge.exe	88
PID 5084 wrote to memory of 2308	5084	msedge.exe	88
PID 5084 wrote to memory of 2308	5084	msedge.exe	88
PID 5084 wrote to memory of 2308	5084	msedge.exe	88
PID 5084 wrote to memory of 2308	5084	msedge.exe	88
PID 5084 wrote to memory of 2308	5084	msedge.exe	88
PID 5084 wrote to memory of 2308	5084	msedge.exe	88
PID 5084 wrote to memory of 2308	5084	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f70abab105cc8f4752bf5dc412f4782e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2b9046f8,0x7ffb2b904708,0x7ffb2b904718
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,456883743588854526,14384703720199086332,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,456883743588854526,14384703720199086332,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,456883743588854526,14384703720199086332,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,456883743588854526,14384703720199086332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,456883743588854526,14384703720199086332,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,456883743588854526,14384703720199086332,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1a9b8400-9369-44dc-885b-aa228e4fcb75.tmp

Filesize
10KB

MD5
263e36f499054d4962c9be30db1c3e15

SHA1
f63ff656439bec0c3bd43267b8aff5a9580355f3

SHA256
191ef6abecc4bc598a8e487a53be76c31a44fee270955db6437a8e0d62f287f8

SHA512
9d51809df6e74c514367b0cba19f76b80e4516c70ce738f5cb7983003d59f15950aa4c2bf88dd0e7f8c054e11d1d0d32c57b4acc024c3fca78b0b1535520ac0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a73a43b5cc38c6448227d57e07fdbec8

SHA1
633349b49cfe0c691da46ad3f55a443cf319b564

SHA256
1ca5f7282848cce5b9a4cb99b81f6dd0e921da76e7c11ad1e87e2dca6ea355b3

SHA512
03bb28a1b54098ca38c1baec0d49f13389c0ec5473a8d8d4855d36a6195e3a7aa18b04d8feab16107b643a3e50b9588dd314979e1a82460bb2eed9e59d338365

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0434eabb9ebc7b9fb0c0379af6a64014

SHA1
19a8c05f0400dcf383e3520cd611ce2133e17347

SHA256
23514d3b4ad119bd08e7d40ad70a4c893a49fe671294bb9b4af87f9b7ef88665

SHA512
e4f640bee010591054cb8e30fa70fea996273de6304b4e535465a644211e4f1a37b911471c82fd7a95e8b6e8d62eb63a77cfc1ca995d6bab0d455ed945a476fa

Download Submit