3d0ae4146f85151020c6085dee49741c03c642b5364b3496a8dab1ccf961deba

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2024 05:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdf56164d3ec2fc94774a60c6ca2c761_JaffaCakes118.html
Size

137KB
MD5

bdf56164d3ec2fc94774a60c6ca2c761
SHA1

068bebc1df6025573fa82bee5c19316c95140250
SHA256

3d0ae4146f85151020c6085dee49741c03c642b5364b3496a8dab1ccf961deba
SHA512

fb8d0a5a50c2c33d50e3d0fbce6a41448a3080727e100668b74272b01faff83a97e4abf6d1e6e41878cc678614bad4751fdf82d65ec73b979528ea5a12020522
SSDEEP

3072:SuRwlTNX8mYpTyrbD5ObZvLrIpLz4cf+u:SIw9crRcmu

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
2136	msedge.exe
2136	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe
4796	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2136	msedge.exe
2136	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe
2136	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 1684	2136	msedge.exe	84
PID 2136 wrote to memory of 1684	2136	msedge.exe	84
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 1500	2136	msedge.exe	85
PID 2136 wrote to memory of 3524	2136	msedge.exe	86
PID 2136 wrote to memory of 3524	2136	msedge.exe	86
PID 2136 wrote to memory of 2956	2136	msedge.exe	87
PID 2136 wrote to memory of 2956	2136	msedge.exe	87
PID 2136 wrote to memory of 2956	2136	msedge.exe	87
PID 2136 wrote to memory of 2956	2136	msedge.exe	87
PID 2136 wrote to memory of 2956	2136	msedge.exe	87
PID 2136 wrote to memory of 2956	2136	msedge.exe	87
PID 2136 wrote to memory of 2956	2136	msedge.exe	87
PID 2136 wrote to memory of 2956	2136	msedge.exe	87
PID 2136 wrote to memory of 2956	2136	msedge.exe	87
PID 2136 wrote to memory of 2956	2136	msedge.exe	87
PID 2136 wrote to memory of 2956	2136	msedge.exe	87
PID 2136 wrote to memory of 2956	2136	msedge.exe	87
PID 2136 wrote to memory of 2956	2136	msedge.exe	87
PID 2136 wrote to memory of 2956	2136	msedge.exe	87
PID 2136 wrote to memory of 2956	2136	msedge.exe	87
PID 2136 wrote to memory of 2956	2136	msedge.exe	87
PID 2136 wrote to memory of 2956	2136	msedge.exe	87
PID 2136 wrote to memory of 2956	2136	msedge.exe	87
PID 2136 wrote to memory of 2956	2136	msedge.exe	87
PID 2136 wrote to memory of 2956	2136	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bdf56164d3ec2fc94774a60c6ca2c761_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd76d846f8,0x7ffd76d84708,0x7ffd76d84718
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,16153676384666941909,13389204025030313177,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,16153676384666941909,13389204025030313177,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,16153676384666941909,13389204025030313177,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16153676384666941909,13389204025030313177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16153676384666941909,13389204025030313177,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,16153676384666941909,13389204025030313177,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
266B

MD5
d9b1f04bc5db503ae45aa524b454f4ba

SHA1
703fc30acbfd6a795029c2a85c1323c688445bcc

SHA256
c7935c2e71e9ad736655c8d83a9a19b76ee3e3c38873b9b2b58f85e51519ad29

SHA512
8ef02d590aa5fee3767567ae0326cfcd37e97056ab736889b2486428b0dd806c984ec121147130889cb3533eba60219e0afb0e762d7556c0a5e16252d25fc901

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5b22eba8df4bea427e6acd63b2824b32

SHA1
cbb0d98bf49bccb30e80c5f0a2a38b490fa0451c

SHA256
e0430353f3a93c920752c58063206f6112bbecc3f0dcff4c5cf5c035a1df780e

SHA512
fe62a05bf28a6455b87f2e113d42f2823af17fe9bbb086b970590aa930cbe23a8c6463356ec10cf99b0a1d746969fd65c71ddc63c84c40bb7c3bc19af7f8c922

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cafd77aefd4b303ec050bfa8c3c1c5a3

SHA1
f7f809e3ac8a26d6fb1c36b6ec0e91cf152b4558

SHA256
70d8cc22b74cda1e6a2bf13b8fcc427609cf151d4c6836d746ba3ca4b940d9c8

SHA512
ca9511b938f4b2c127857f35a2600cad4cf161944bdfac93d38b8d8a95979c7ef82e8f9a4d469432e2dc6a1c9915bf103f38459951f0d863a097d66efe384fce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8282996b62cc20370d8419f0048a9505

SHA1
2f2b23b03b015fd4102f85fe360013221ade2e14

SHA256
b82d1cf978aec603c0f12af71f93635b0b4682a94b0452df075473102f54cd1a

SHA512
9465224fc84b2ab782590c34935b4f8f92f442d206dced10842b8ae51a1cf36c790c97136bb0416339c0eda6ccb7dc71982bb70b24ceceb0587195eb3acd89ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9931a4f44a49cd9edfa57619e31e708e

SHA1
b0b6b35c2fc34c8cec1f26ddd9c9d3419190af70

SHA256
aba29a32712581619e4d9c96fb25ebfc56129771ad945b6c02bbca6075cbdcb4

SHA512
370b47da2676950a2937c9bb1676d9a7968087c3b01710456cb9b86d7a219493b06735407faf34660878e4b39f1e739502a412d4741bac88a469563b65d62dcc

Download Submit