1702467fb2a4944434e568dd567630bd171e0be2fb6c1dda032372bbbe3b194f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 00:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ff923c49675984d1a57c749805b2ac05_JaffaCakes118.html
Size

139KB
MD5

ff923c49675984d1a57c749805b2ac05
SHA1

9fe5676dfca080dfe82531a641e57b7a9332310c
SHA256

1702467fb2a4944434e568dd567630bd171e0be2fb6c1dda032372bbbe3b194f
SHA512

d9a1e02f2fd997b69cabd95b5bd8f175a210d4fc4e52499d275396a3b685bbd33969b6ef934da23451beade112028bcc044f22b16d3dd12a835c656fef9f0a20
SSDEEP

1536:SeN1bpllh5yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTs:SePp55yfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3476	msedge.exe
3476	msedge.exe
4700	msedge.exe
4700	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 1476	4700	msedge.exe	82
PID 4700 wrote to memory of 1476	4700	msedge.exe	82
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 1104	4700	msedge.exe	83
PID 4700 wrote to memory of 3476	4700	msedge.exe	84
PID 4700 wrote to memory of 3476	4700	msedge.exe	84
PID 4700 wrote to memory of 2284	4700	msedge.exe	85
PID 4700 wrote to memory of 2284	4700	msedge.exe	85
PID 4700 wrote to memory of 2284	4700	msedge.exe	85
PID 4700 wrote to memory of 2284	4700	msedge.exe	85
PID 4700 wrote to memory of 2284	4700	msedge.exe	85
PID 4700 wrote to memory of 2284	4700	msedge.exe	85
PID 4700 wrote to memory of 2284	4700	msedge.exe	85
PID 4700 wrote to memory of 2284	4700	msedge.exe	85
PID 4700 wrote to memory of 2284	4700	msedge.exe	85
PID 4700 wrote to memory of 2284	4700	msedge.exe	85
PID 4700 wrote to memory of 2284	4700	msedge.exe	85
PID 4700 wrote to memory of 2284	4700	msedge.exe	85
PID 4700 wrote to memory of 2284	4700	msedge.exe	85
PID 4700 wrote to memory of 2284	4700	msedge.exe	85
PID 4700 wrote to memory of 2284	4700	msedge.exe	85
PID 4700 wrote to memory of 2284	4700	msedge.exe	85
PID 4700 wrote to memory of 2284	4700	msedge.exe	85
PID 4700 wrote to memory of 2284	4700	msedge.exe	85
PID 4700 wrote to memory of 2284	4700	msedge.exe	85
PID 4700 wrote to memory of 2284	4700	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ff923c49675984d1a57c749805b2ac05_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff40046f8,0x7ffff4004708,0x7ffff4004718
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,4128387203651274544,14193329377947608576,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,4128387203651274544,14193329377947608576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,4128387203651274544,14193329377947608576,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4128387203651274544,14193329377947608576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,4128387203651274544,14193329377947608576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,4128387203651274544,14193329377947608576,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d905eec0c5f4947941bd2b6d16090dca

SHA1
3b6ee57ad30cd0c84dec3188d3982c6a036b8692

SHA256
30d6a3bec2bdce1f8c3ae3a5f6704b0f0cf87c1e7fad45c92a321c979fe3a075

SHA512
b237651929106f58f7a3a068712fa98af7cf0236f09877982de679cf3a86bf48ca4eaa4289f64ca17debb9d65b71fa7d99c9dc35af1948562b98338b520dcbf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
15cd77b5d7a4b6b415c420acad9ff5d3

SHA1
9a5785a144bbf80bfe59a921e4f316d1c177f0e1

SHA256
24180af4bb1bb525dd8ce6a792b5bcd0d5eadfb0b7aca14183c79a8d60dba5a2

SHA512
701a5b6394d9028a246ed7d22970955917afeaff982e64fa6be9eaf557d3b2cbeec37e0992b073bb52c7a50b0a8aa1f977a25ae92f4b7bf84b2c41ee98f3b8b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
738cbddd7e201712f9216ba67a8015fc

SHA1
bf0d4abfc2b62e0f470ce35b89aace53e75ea54e

SHA256
16c97a2f052b1b626fdda1a4092a17c380dc6acaa40e7b6bc70cdd6f10c94b1c

SHA512
0e15bdb71a23f6a71e1b903d2bc9e530b3994de5ab94a845ed892076c91f17294ff3ee4eaca63f5cf83ebf535289b999eebced5e29d9c3a7d09e23d40c700e3b

Download Submit