ba2ca184478d3874645b0862b68acabc0ce86b1ad0324451bbeb05bdeeddd4f6

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 01:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

28659c1fb6cc242079d849f76e632373_JaffaCakes118.html
Size

139KB
MD5

28659c1fb6cc242079d849f76e632373
SHA1

4b4d7d230326e81ce34ebee0512f7c6fe794d63e
SHA256

ba2ca184478d3874645b0862b68acabc0ce86b1ad0324451bbeb05bdeeddd4f6
SHA512

ad0a31ae2884941755e170c545bff6a6dd32cb4613c45a6d0b0b5a3a863c6da3f61144afd184f060102213e434409b7e12caecaef541632314a74525ce9c0e12
SSDEEP

1536:SINZovJUlAtyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:SIyHyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3556	msedge.exe
3556	msedge.exe
3476	msedge.exe
3476	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3476	msedge.exe
3476	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe
3476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 4652	3476	msedge.exe	83
PID 3476 wrote to memory of 4652	3476	msedge.exe	83
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 2644	3476	msedge.exe	84
PID 3476 wrote to memory of 3556	3476	msedge.exe	85
PID 3476 wrote to memory of 3556	3476	msedge.exe	85
PID 3476 wrote to memory of 1960	3476	msedge.exe	86
PID 3476 wrote to memory of 1960	3476	msedge.exe	86
PID 3476 wrote to memory of 1960	3476	msedge.exe	86
PID 3476 wrote to memory of 1960	3476	msedge.exe	86
PID 3476 wrote to memory of 1960	3476	msedge.exe	86
PID 3476 wrote to memory of 1960	3476	msedge.exe	86
PID 3476 wrote to memory of 1960	3476	msedge.exe	86
PID 3476 wrote to memory of 1960	3476	msedge.exe	86
PID 3476 wrote to memory of 1960	3476	msedge.exe	86
PID 3476 wrote to memory of 1960	3476	msedge.exe	86
PID 3476 wrote to memory of 1960	3476	msedge.exe	86
PID 3476 wrote to memory of 1960	3476	msedge.exe	86
PID 3476 wrote to memory of 1960	3476	msedge.exe	86
PID 3476 wrote to memory of 1960	3476	msedge.exe	86
PID 3476 wrote to memory of 1960	3476	msedge.exe	86
PID 3476 wrote to memory of 1960	3476	msedge.exe	86
PID 3476 wrote to memory of 1960	3476	msedge.exe	86
PID 3476 wrote to memory of 1960	3476	msedge.exe	86
PID 3476 wrote to memory of 1960	3476	msedge.exe	86
PID 3476 wrote to memory of 1960	3476	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\28659c1fb6cc242079d849f76e632373_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff93b0346f8,0x7ff93b034708,0x7ff93b034718
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,7138462824873973607,15624750493884338350,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,7138462824873973607,15624750493884338350,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,7138462824873973607,15624750493884338350,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,7138462824873973607,15624750493884338350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,7138462824873973607,15624750493884338350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,7138462824873973607,15624750493884338350,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5084 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
418a617a0b1d2143cb63a301c9fb9f1c

SHA1
9209a45cdc3aeed7e9704f38b2256dcb90b04c92

SHA256
f6edc3f520f99495ec05f059664c03e121117e8d9e1e332f4d215fef928ecf83

SHA512
8995dad8ca9041c877957c76bc2db260a518a2aaea17420fe0d8f39dfbe1b7a4e4a91059cc49bd7f744e5dd3bd3894775f3b53866d265072b59bd2a64357b668

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
34a30d9c7c4f9c6aadd68c67bc2976e6

SHA1
bde99a902b8bbcdf2b8c68283b97d2c9b6562585

SHA256
9e057fd6cbb1e4dccb47c85e218ec56283448ed3b2f9e0929ec624f5251e23d9

SHA512
d3e70fc5be7251e24a25e033d0b2c7698a332565a4c2bf132526bc1191299976458b823f3434af75d252509aa004b3768130faa3d3183fc661458809d4ea844c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
20b9f3350f852cc4bbde0896628e3725

SHA1
bb4cce755d8eff4cf61e1a5d5b9e620323804262

SHA256
dc6f53c48f87b0f8d7372a62e712356a48336100c1482e57cc10a0fe8d32caa1

SHA512
685e2aeb5e381b79b959b998d48450c694f437d5ee81c0993f02685eee7eeab690cdaa4ae0a52eed393d2bb870ab04bed293dca90372ebc866045daec89da557

Download Submit