eb433660f1dc6460550894c441da36cc5ae0a2de5153523f67aa0aa547928403

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 00:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5479c8828c7d11f8444159ba2f44f3e1_JaffaCakes118.html
Size

18KB
MD5

5479c8828c7d11f8444159ba2f44f3e1
SHA1

c9e4520f3a3a1f58bada57c69e0c3918ebce9b0f
SHA256

eb433660f1dc6460550894c441da36cc5ae0a2de5153523f67aa0aa547928403
SHA512

e96c624ed4af0d3c7c6fee1da701b4aa81576a4d838e15a236931045731fb673f50806a7f2603299228e3e83db76d853f2600e42b4ff73deff42184b36327847
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIi4MzUnjBh4C82qDB8:SIMd0I5nvHnsv4RxDB8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4064	msedge.exe
4064	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe
376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 4048	4064	msedge.exe	84
PID 4064 wrote to memory of 4048	4064	msedge.exe	84
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 1236	4064	msedge.exe	85
PID 4064 wrote to memory of 4692	4064	msedge.exe	86
PID 4064 wrote to memory of 4692	4064	msedge.exe	86
PID 4064 wrote to memory of 1260	4064	msedge.exe	87
PID 4064 wrote to memory of 1260	4064	msedge.exe	87
PID 4064 wrote to memory of 1260	4064	msedge.exe	87
PID 4064 wrote to memory of 1260	4064	msedge.exe	87
PID 4064 wrote to memory of 1260	4064	msedge.exe	87
PID 4064 wrote to memory of 1260	4064	msedge.exe	87
PID 4064 wrote to memory of 1260	4064	msedge.exe	87
PID 4064 wrote to memory of 1260	4064	msedge.exe	87
PID 4064 wrote to memory of 1260	4064	msedge.exe	87
PID 4064 wrote to memory of 1260	4064	msedge.exe	87
PID 4064 wrote to memory of 1260	4064	msedge.exe	87
PID 4064 wrote to memory of 1260	4064	msedge.exe	87
PID 4064 wrote to memory of 1260	4064	msedge.exe	87
PID 4064 wrote to memory of 1260	4064	msedge.exe	87
PID 4064 wrote to memory of 1260	4064	msedge.exe	87
PID 4064 wrote to memory of 1260	4064	msedge.exe	87
PID 4064 wrote to memory of 1260	4064	msedge.exe	87
PID 4064 wrote to memory of 1260	4064	msedge.exe	87
PID 4064 wrote to memory of 1260	4064	msedge.exe	87
PID 4064 wrote to memory of 1260	4064	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5479c8828c7d11f8444159ba2f44f3e1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe245046f8,0x7ffe24504708,0x7ffe24504718
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,7339849703453002767,7681597866679855477,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,7339849703453002767,7681597866679855477,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,7339849703453002767,7681597866679855477,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7339849703453002767,7681597866679855477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,7339849703453002767,7681597866679855477,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,7339849703453002767,7681597866679855477,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c6891501a006cebc83f29966f2d6aba2

SHA1
a48fb2b7caf1740c7306fe415c6d89090c4c0125

SHA256
7d96bf182551bb28b2b8b59c4b8a0fbd26a9367e21636e17788ddf2140deca2f

SHA512
c664eb7e2aa3daa6e0459573b49e402b521caaeac49f096e9d09085ddedeba28bb21c6153f0c557b0c7a1cd9bb95c41217a51656a014672dbcf77d9a66df170a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
88bbc2ad4df4cefc208bbaa49286f537

SHA1
a2565030691e828947a48ede0d9a4fc21800907f

SHA256
bcead377ebf8f4cdccb05e60e7460272f90a0bcdec5bbb28658158445140e344

SHA512
af5c74bad0a671c8f2645591669c42cd70279f5ec443330b58927d31ce580ce53da3b45a3796603cd2be3094cb7e431874eccccfc95bcd239c1802626b5f1f7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c503bae4ecfbffe1296ee042a8d87c68

SHA1
2cfe5e03df1ea6a08c8a919729e41b55a2a70b94

SHA256
6611487391935961da4361a53cc1cc099c36f1948124d49a0e8b38f5997f32b1

SHA512
c900e2a6801653fbdcd54c705416a8260172628245a2cd7caa41d3125123573fdcc7fb9afb2dfd8d2c896d1b8985acaf99b6274cbc470e2fb3879c5b11b52917

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d5e2a8dc4ecdee83e3f6e201b5566c16

SHA1
0089966b2ea98afc70d489c62ddaedafe2365b3b

SHA256
99cde34d27d69ae9fff64cbef87bf1c43dbbaeafd5604bb89d4a37d9f059737a

SHA512
5ff33271c90a8625331d94f2fe6f451868403e6e8d297172a2268ffe2b26eed78f8720e28590d8602fe28c46b79466e54eb530305e11a1fc2d1a8345f430b23f

Download Submit