ee55b551de59a3809a6b2af88ec3927b523d43b1ae5fa3f30e9564f57d925bcd

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27-09-2024 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

faee5fa701a8650910e95a9ae7dec15f_JaffaCakes118.html
Size

20KB
MD5

faee5fa701a8650910e95a9ae7dec15f
SHA1

4f3d0899be9d19a5d8433eb70228a41d7bc012b1
SHA256

ee55b551de59a3809a6b2af88ec3927b523d43b1ae5fa3f30e9564f57d925bcd
SHA512

35db6694c079c029c51c600d53280d4eb0eeabde0e39eeda57b1256fed2b5f696c6a6a6a3a305edf379d1246ee07e49e97000b0dce0b7426dd3465cd96b8cbdc
SSDEEP

192:u60KEVIG+UEJz7qAqyUp+/Ir+6yKQIP/yMCoV3oqPtYbNBkPvKaNAnK+wPZmyLlh:jU+UMzE4/4h3NPvYlWoN8Cya21Yq

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1416	msedge.exe
1416	msedge.exe
3512	msedge.exe
3512	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 1668	3512	msedge.exe	82
PID 3512 wrote to memory of 1668	3512	msedge.exe	82
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 4956	3512	msedge.exe	83
PID 3512 wrote to memory of 1416	3512	msedge.exe	84
PID 3512 wrote to memory of 1416	3512	msedge.exe	84
PID 3512 wrote to memory of 4668	3512	msedge.exe	85
PID 3512 wrote to memory of 4668	3512	msedge.exe	85
PID 3512 wrote to memory of 4668	3512	msedge.exe	85
PID 3512 wrote to memory of 4668	3512	msedge.exe	85
PID 3512 wrote to memory of 4668	3512	msedge.exe	85
PID 3512 wrote to memory of 4668	3512	msedge.exe	85
PID 3512 wrote to memory of 4668	3512	msedge.exe	85
PID 3512 wrote to memory of 4668	3512	msedge.exe	85
PID 3512 wrote to memory of 4668	3512	msedge.exe	85
PID 3512 wrote to memory of 4668	3512	msedge.exe	85
PID 3512 wrote to memory of 4668	3512	msedge.exe	85
PID 3512 wrote to memory of 4668	3512	msedge.exe	85
PID 3512 wrote to memory of 4668	3512	msedge.exe	85
PID 3512 wrote to memory of 4668	3512	msedge.exe	85
PID 3512 wrote to memory of 4668	3512	msedge.exe	85
PID 3512 wrote to memory of 4668	3512	msedge.exe	85
PID 3512 wrote to memory of 4668	3512	msedge.exe	85
PID 3512 wrote to memory of 4668	3512	msedge.exe	85
PID 3512 wrote to memory of 4668	3512	msedge.exe	85
PID 3512 wrote to memory of 4668	3512	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\faee5fa701a8650910e95a9ae7dec15f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff6d0846f8,0x7fff6d084708,0x7fff6d084718
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,8407960770911959706,13367027278813213549,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,8407960770911959706,13367027278813213549,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,8407960770911959706,13367027278813213549,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8407960770911959706,13367027278813213549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8407960770911959706,13367027278813213549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,8407960770911959706,13367027278813213549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1692 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,8407960770911959706,13367027278813213549,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4920 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
182B

MD5
9142b251885531ea20ad790f115ee80f

SHA1
bb6c5b9641a2c59b86e2cd01febbcde2357fb68a

SHA256
2fdd7ce8cc41a618d93ccbb41ddfaae5c629e970f35faa4dc5c1f2161c27d28d

SHA512
23899fb4fc810ea72300ad7b817bddac1b7a8d931e7097ceea6a342d12ef70065138812c8324b3aedffe8dffda4eb64f347e989840ed227a7f5fcad84130bedf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
44df7281070884e9d0946a4ba0353faa

SHA1
c5a960ecace91ef64a5352b31a548440dc38f2a0

SHA256
4f5f4b2b1e74a10c0a409ef3a7a2c064e6e83e1947c0a12c4cb5e304d780fe76

SHA512
97a8eb22906b9ab748e5a780f3fa7f246f20d0fddaac62e0a096e66f95fac9f4ac8b4d52ae3937b82bf8c28e9430b86a9255b43f449b283203dfc39d4c7d261f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b1d9c87f94d7542fa74f6126fcb7b919

SHA1
bc1b3b2aeaa1b320697f555999940f6ff7f0d4b0

SHA256
084b5113bac22dedc3677b3e074d72ded2d1016759131208906010a0de66a0a3

SHA512
dbcc3006df7ff7ce33dc6ee36df7795033c375cea3118cae6fba95e97b8c0aab842ab7f120e65fabf4044bb03d7ef134129af5025703dd84bd02e4fed402f2a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2822dcd5d9835adeed58879dc15a4eef

SHA1
ea2e0f32fd2425c9f011deae0f58a32a2a88b41b

SHA256
a792b25d64b2c58e6b429cfa09d29b4b4ebb50dd5b4c4f007883c2b0dfb1d456

SHA512
449fef2878a7c2c23063acd57eaa84a9a455347900a1900f5ba796ba6c712d35faabb85db16677912705c19f690c50850daa6fe45fc6ae010838bb4c1a0b10bc

Download Submit
\??\pipe\LOCAL\crashpad_3512_EORRWZJVBYMLFDSN

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit