59512f22bc01f9aeafaf7371dfa29e2aee34eef84c311946d0e0dc6a03b48082

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 01:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

288e3018ddb6374cd1db81bafceca6ca_JaffaCakes118.html
Size

142KB
MD5

288e3018ddb6374cd1db81bafceca6ca
SHA1

3fe62db69658c0e510be62de240985a7585f8317
SHA256

59512f22bc01f9aeafaf7371dfa29e2aee34eef84c311946d0e0dc6a03b48082
SHA512

858533d4e54c7c70f5bc754a7b92a674e8e8028cc9e315b65e1c9a3124b729b962097d56d7838add4317315cc0db33e2d3b288c0feda20560046f5e8fff6df94
SSDEEP

1536:SGEOKtJN1cxiEx76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXAZ:SxJNYx7dyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2236	msedge.exe
2236	msedge.exe
4476	msedge.exe
4476	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe
2360	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 228	4476	msedge.exe	83
PID 4476 wrote to memory of 228	4476	msedge.exe	83
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 548	4476	msedge.exe	84
PID 4476 wrote to memory of 2236	4476	msedge.exe	85
PID 4476 wrote to memory of 2236	4476	msedge.exe	85
PID 4476 wrote to memory of 4348	4476	msedge.exe	86
PID 4476 wrote to memory of 4348	4476	msedge.exe	86
PID 4476 wrote to memory of 4348	4476	msedge.exe	86
PID 4476 wrote to memory of 4348	4476	msedge.exe	86
PID 4476 wrote to memory of 4348	4476	msedge.exe	86
PID 4476 wrote to memory of 4348	4476	msedge.exe	86
PID 4476 wrote to memory of 4348	4476	msedge.exe	86
PID 4476 wrote to memory of 4348	4476	msedge.exe	86
PID 4476 wrote to memory of 4348	4476	msedge.exe	86
PID 4476 wrote to memory of 4348	4476	msedge.exe	86
PID 4476 wrote to memory of 4348	4476	msedge.exe	86
PID 4476 wrote to memory of 4348	4476	msedge.exe	86
PID 4476 wrote to memory of 4348	4476	msedge.exe	86
PID 4476 wrote to memory of 4348	4476	msedge.exe	86
PID 4476 wrote to memory of 4348	4476	msedge.exe	86
PID 4476 wrote to memory of 4348	4476	msedge.exe	86
PID 4476 wrote to memory of 4348	4476	msedge.exe	86
PID 4476 wrote to memory of 4348	4476	msedge.exe	86
PID 4476 wrote to memory of 4348	4476	msedge.exe	86
PID 4476 wrote to memory of 4348	4476	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\288e3018ddb6374cd1db81bafceca6ca_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc27df46f8,0x7ffc27df4708,0x7ffc27df4718
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,8772168258073159673,15484368892566030403,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,8772168258073159673,15484368892566030403,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,8772168258073159673,15484368892566030403,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8772168258073159673,15484368892566030403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8772168258073159673,15484368892566030403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,8772168258073159673,15484368892566030403,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3084 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
da49e3fadbde3790f2fa7af362d1344d

SHA1
9bef24c5e583f0b17cb6ea38740f9459866ad2df

SHA256
09fa7ec5941e31adc63448e7c5c046c3c57d01e69b05be559b8df8283b952ad6

SHA512
e1e12dfe8d929ac53b263adc9c3ceefb98b04d28a75f9637cbd2fb1a65e7ffdda5cd87595f758cee746cd19f77ea2611ae91d2be568b3f58e4b8ccca502374d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
76cc28b78d95890711785e16918a537f

SHA1
806da295342c00d59c5aa19dce2ca00f98ba12dd

SHA256
4c03649ab8b7150302ce0d4ea990f22ba8e77278fc934d721c37d1867fba45a0

SHA512
cb6a1114985a71d0aa7e18c5e9ac635d2d60e378d643ffcbd3175f533faae4bf7e029ca4b32c02480ce1846c428b435c3ec65c92deec67898652af2b0a00be79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4ff0a2e76cf1be5e359532dc73cb8ddd

SHA1
76354ecbccf9146582e7999b287c371444b30c96

SHA256
bdac39072166f2234711cc9f4d7aa3716f50c7223f9adde7ce056c45d2133527

SHA512
5fc816629abc1ac0513da6c54504eba44064e99b23294c607362d9dc66347c2b9c34650962d7736d46528ce539bba27973713cad7b39e0535ecf7b4b19308e28

Download Submit