1691852a9e6138dbcd38e76f56de8665f278de92ef53e326ee7d01d81189b2df

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2024, 11:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94808170f5f8ccb32f2bb635d436ce15_JaffaCakes118.html
Size

125KB
MD5

94808170f5f8ccb32f2bb635d436ce15
SHA1

283b5081b5945a2c600033c0270431da0c5dc74c
SHA256

1691852a9e6138dbcd38e76f56de8665f278de92ef53e326ee7d01d81189b2df
SHA512

8d63e78d026dbb14ec9afa76cfb12796fea9e51fcda0b5f271236caf78f1dfb94ac6e090d41983f8fbc89ffa913da62e6c7499b3ec865860263e0cb2b7dbb5ab
SSDEEP

1536:pPLfyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCW:pjfyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
2784	msedge.exe
2784	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2312	2784	msedge.exe	83
PID 2784 wrote to memory of 2312	2784	msedge.exe	83
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 456	2784	msedge.exe	84
PID 2784 wrote to memory of 5000	2784	msedge.exe	85
PID 2784 wrote to memory of 5000	2784	msedge.exe	85
PID 2784 wrote to memory of 4828	2784	msedge.exe	86
PID 2784 wrote to memory of 4828	2784	msedge.exe	86
PID 2784 wrote to memory of 4828	2784	msedge.exe	86
PID 2784 wrote to memory of 4828	2784	msedge.exe	86
PID 2784 wrote to memory of 4828	2784	msedge.exe	86
PID 2784 wrote to memory of 4828	2784	msedge.exe	86
PID 2784 wrote to memory of 4828	2784	msedge.exe	86
PID 2784 wrote to memory of 4828	2784	msedge.exe	86
PID 2784 wrote to memory of 4828	2784	msedge.exe	86
PID 2784 wrote to memory of 4828	2784	msedge.exe	86
PID 2784 wrote to memory of 4828	2784	msedge.exe	86
PID 2784 wrote to memory of 4828	2784	msedge.exe	86
PID 2784 wrote to memory of 4828	2784	msedge.exe	86
PID 2784 wrote to memory of 4828	2784	msedge.exe	86
PID 2784 wrote to memory of 4828	2784	msedge.exe	86
PID 2784 wrote to memory of 4828	2784	msedge.exe	86
PID 2784 wrote to memory of 4828	2784	msedge.exe	86
PID 2784 wrote to memory of 4828	2784	msedge.exe	86
PID 2784 wrote to memory of 4828	2784	msedge.exe	86
PID 2784 wrote to memory of 4828	2784	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\94808170f5f8ccb32f2bb635d436ce15_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc5fa846f8,0x7ffc5fa84708,0x7ffc5fa84718
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,13683107487933126738,6990830937047901753,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,13683107487933126738,6990830937047901753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,13683107487933126738,6990830937047901753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,13683107487933126738,6990830937047901753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,13683107487933126738,6990830937047901753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,13683107487933126738,6990830937047901753,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,13683107487933126738,6990830937047901753,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
140ae1507ea05301020afad3eeecf6a5

SHA1
708db244f8ee5f3d01deae27d707896629d29f7c

SHA256
cbe602a417d9fd94307e2037a1e4f23c763a7b051cd3edeabc2f8aaa4a54bb76

SHA512
7cb185eab4540cf9784e3a26a0670af8facec0f34b6870aaf8331ec941786933502fa706624a431328fe1d6437aa92bc3122cca1cb0cbb39e74852da6c8487e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
466aaf5efe7dff3fe30c0efd865160e9

SHA1
39741d97913802330e03dd6b9415e7ace5edefdd

SHA256
981d3ef4d0a6826a1ea8633b7d3c7730abcc7057a40141bd5dc171ea3b078941

SHA512
ba8be194e806efb4d707a20080d9fd173af33ae6a0c86982654a5c03913df0079017b5b215bee7e63c2458ebb0a7ecca476a831c61f7476a334f6ba0b2bc12dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6627d1b02ef0ee90ac259d68ea5c8a5c

SHA1
a16ee612fcdbd0536a27062be103d4fd81cabcca

SHA256
fa1b07e42987572cabdfab6ce09c433b4d41b497f3e2b8bd376ff52d37cf6cec

SHA512
ae1ed67237e047df2eebb3e0f4aee131d7f296a2a182167acc65cc2838d9c4124fd14ef61253a92ba6524abc931011560c2037e4d844e73e5a07705b3cba2b1d

Download Submit