4f198dcdf437ba55ec6e7afd365320bad876a24598d2496a79fca35e96260578

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 10:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aaa8c54db790e29b1a8219c536fe1cf5_JaffaCakes118.html
Size

121KB
MD5

aaa8c54db790e29b1a8219c536fe1cf5
SHA1

32ce22a98d8b8aa7dd357486dc1bd1c230281822
SHA256

4f198dcdf437ba55ec6e7afd365320bad876a24598d2496a79fca35e96260578
SHA512

932830f0b3ae58c4a5159fa1caf30a8f69bfc32775411f9fe7149357bcef4d7f599ff7e25bc3e89af8692d58be3eea3ffbff8da50690a9f89f05c1988f98568d
SSDEEP

1536:cjJd3vFMYeWX2+8L/HsHVgEH4aEo+/wjT6W:wlvFMYeWX2dHsHVgXHU6W

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4344	msedge.exe
4344	msedge.exe
988	msedge.exe
988	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 3156	988	msedge.exe	84
PID 988 wrote to memory of 3156	988	msedge.exe	84
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4608	988	msedge.exe	85
PID 988 wrote to memory of 4344	988	msedge.exe	86
PID 988 wrote to memory of 4344	988	msedge.exe	86
PID 988 wrote to memory of 4028	988	msedge.exe	87
PID 988 wrote to memory of 4028	988	msedge.exe	87
PID 988 wrote to memory of 4028	988	msedge.exe	87
PID 988 wrote to memory of 4028	988	msedge.exe	87
PID 988 wrote to memory of 4028	988	msedge.exe	87
PID 988 wrote to memory of 4028	988	msedge.exe	87
PID 988 wrote to memory of 4028	988	msedge.exe	87
PID 988 wrote to memory of 4028	988	msedge.exe	87
PID 988 wrote to memory of 4028	988	msedge.exe	87
PID 988 wrote to memory of 4028	988	msedge.exe	87
PID 988 wrote to memory of 4028	988	msedge.exe	87
PID 988 wrote to memory of 4028	988	msedge.exe	87
PID 988 wrote to memory of 4028	988	msedge.exe	87
PID 988 wrote to memory of 4028	988	msedge.exe	87
PID 988 wrote to memory of 4028	988	msedge.exe	87
PID 988 wrote to memory of 4028	988	msedge.exe	87
PID 988 wrote to memory of 4028	988	msedge.exe	87
PID 988 wrote to memory of 4028	988	msedge.exe	87
PID 988 wrote to memory of 4028	988	msedge.exe	87
PID 988 wrote to memory of 4028	988	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\aaa8c54db790e29b1a8219c536fe1cf5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8540646f8,0x7ff854064708,0x7ff854064718
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,2070588330596833666,3787594770313765082,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,2070588330596833666,3787594770313765082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,2070588330596833666,3787594770313765082,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2070588330596833666,3787594770313765082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2070588330596833666,3787594770313765082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2070588330596833666,3787594770313765082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2070588330596833666,3787594770313765082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,2070588330596833666,3787594770313765082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2096 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,2070588330596833666,3787594770313765082,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4820 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a98a042a1ea58671bcff67f248f3aa2a

SHA1
aad66d46cdeabc8c50cf59427d1a6dfb1cc09e80

SHA256
d3cc7b39ac4f3a17c79266bee104b457c0251fb19f677d70eee4dc2bfa395dc6

SHA512
92c230a474de2400b9a759a2bb4770c71124bc6264e72b9212455912b836f7935dfe1efa8a2ba782adbfa0dabbc8f57df3e1cc35b69e237a9bacde7ac4eb537b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f843bf31a39972fda0d48ec671a5ca94

SHA1
6bca2dae86b4661e2056f8a2b29ddb3df4c4da5f

SHA256
7738aa4abf7a55353842bfcf858237727d35ff6207bdbe1cfe82af0b8f570f87

SHA512
599e44866fbb6d2ee56b13a76d44332cfb07657bd45b0f81505aa3e0452df34101f6de10597b013d4b370abc5b498d9e9c4fbd92d31e5a07fe8557a69f429ae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d2374833-3041-4727-a381-c034f3e1ab04.tmp

Filesize
6KB

MD5
27ea00963d54e630f1bc03d140f3b637

SHA1
b5fa2226b6aa464f928648352906d67b59ef08ee

SHA256
61172481da44c7e57ab00218fd74781175948fb10209627e67b712c37e9fd775

SHA512
b23255c192cfe943b080c22fea0975779c2fa9a3780f6717c854c967140b8c057f9cc446c3f463be1af673f7cc53ffd1eb22dd1e6ad39cfdef266ef7170ce0d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b6de2b53fdac5827d4fcb9c1ee018fac

SHA1
27a329eb7873a21777349048a9516bb2e725ef09

SHA256
e7dd5ea2095dfe0fb6a0b03bd783a83235b0c956453a02b7dc3c1db33b52cac9

SHA512
655b02c9bfd6910b8c874620d7f30dbb9953d2d68278611f68b8dcdd76d0201bd81014bce8a683effb09440d0a2d5aef5ec8e8a222c0100de7a075c980ad3a7b

Download Submit