12e74704dcddcb43fbc0671ab3c8eea55c19b6ecf8932802cd3bc5371932a284

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29ceb6e865f2e1207093491fefd8a5fc_JaffaCakes118.html
Size

138KB
MD5

29ceb6e865f2e1207093491fefd8a5fc
SHA1

6b8176df996684ef8cd1e3d0ea7c2764b05cad1e
SHA256

12e74704dcddcb43fbc0671ab3c8eea55c19b6ecf8932802cd3bc5371932a284
SHA512

367423aad6e25aea25515d8a0f034ba3cf29f18d833613e0ec6f6e176735d3aff307c62142d14e92ec2ed2a93bf6c6efb93d774ff78e84730a47335c26e4ae6c
SSDEEP

1536:SgDfsRZf8qGhrqArLCl9NyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09wd:SguNyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5068	msedge.exe
5068	msedge.exe
4664	msedge.exe
4664	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe
2188	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 2444	4664	msedge.exe	83
PID 4664 wrote to memory of 2444	4664	msedge.exe	83
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 3712	4664	msedge.exe	85
PID 4664 wrote to memory of 5068	4664	msedge.exe	86
PID 4664 wrote to memory of 5068	4664	msedge.exe	86
PID 4664 wrote to memory of 2456	4664	msedge.exe	87
PID 4664 wrote to memory of 2456	4664	msedge.exe	87
PID 4664 wrote to memory of 2456	4664	msedge.exe	87
PID 4664 wrote to memory of 2456	4664	msedge.exe	87
PID 4664 wrote to memory of 2456	4664	msedge.exe	87
PID 4664 wrote to memory of 2456	4664	msedge.exe	87
PID 4664 wrote to memory of 2456	4664	msedge.exe	87
PID 4664 wrote to memory of 2456	4664	msedge.exe	87
PID 4664 wrote to memory of 2456	4664	msedge.exe	87
PID 4664 wrote to memory of 2456	4664	msedge.exe	87
PID 4664 wrote to memory of 2456	4664	msedge.exe	87
PID 4664 wrote to memory of 2456	4664	msedge.exe	87
PID 4664 wrote to memory of 2456	4664	msedge.exe	87
PID 4664 wrote to memory of 2456	4664	msedge.exe	87
PID 4664 wrote to memory of 2456	4664	msedge.exe	87
PID 4664 wrote to memory of 2456	4664	msedge.exe	87
PID 4664 wrote to memory of 2456	4664	msedge.exe	87
PID 4664 wrote to memory of 2456	4664	msedge.exe	87
PID 4664 wrote to memory of 2456	4664	msedge.exe	87
PID 4664 wrote to memory of 2456	4664	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\29ceb6e865f2e1207093491fefd8a5fc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd4f9746f8,0x7ffd4f974708,0x7ffd4f974718
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2818191371475846940,17388834139873721293,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,2818191371475846940,17388834139873721293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,2818191371475846940,17388834139873721293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2818191371475846940,17388834139873721293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2818191371475846940,17388834139873721293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2818191371475846940,17388834139873721293,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dd76d8ac5da7b1cca3fbb2ab534e202a

SHA1
56612d75447deb8debe0c396ce92fbc1b7fb6187

SHA256
df97718e52af5975f5c76bb5c84b38ecc5912a730d1a32e6646a45ec0aac2981

SHA512
b8d2d0b084686e67ac68214f2131df6392f22da48e936f28f8f3da79d55ba0ad092ac158bad32175f75b65e88667d0bc78fd374fee9c16da734506e0763524c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5a33f1d33736807a57fa2f1c7ee7a1da

SHA1
a35444093de8dcaec191996ffc5b799312069ba9

SHA256
83ed99b43c5afc0e2b51870ceba3739f1f83c74cde89e1c4feb4f4791c2f3b29

SHA512
ac1e95b6caa25bd331a74ba516225b8c756ba7a230308d9489697eeab9cb2f409b92e094db01c2bdc1f714591a7686c1b750afbccd25e3bdca3ea220107a0d54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
eb437210ee07e3d917d39678631918a6

SHA1
f19b6aa847c77bb1df21ad01ffb8a2c288b577d0

SHA256
57ba5f79a50e3536001aa98d53f245c779b57f783727855149f3b014600c1cb4

SHA512
479bc2e116cf458bc7bffa30ac60d92f158fccc32a9a595ef5293b1557e541cb86a749ed62176704a73eb884fe8aced115354090c9c2570796ea4f4ba49b8f1b

Download Submit