9affc74446269213aada9d70602d8974e6c25e06582756f0d26e031c33028dbc

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 06:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be0cc5f57d3e04a40cc32c793a2898d8_JaffaCakes118.html
Size

19KB
MD5

be0cc5f57d3e04a40cc32c793a2898d8
SHA1

204975ea21fd9387e14b978c10766f541fdcff1a
SHA256

9affc74446269213aada9d70602d8974e6c25e06582756f0d26e031c33028dbc
SHA512

72cba48f6c01a37821dedb1343f2a10c227c15d569ee7056ef9a01b63154246802001bc4976c2a25dc07d959491778f9d65252c90c03eeda73fe9b8629fbf3ee
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIr4NzUnjBhXZ82qDB8:SIMd0I5nO9H9svXyxDB8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1496	msedge.exe
1496	msedge.exe
4568	msedge.exe
4568	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 4004	4568	msedge.exe	86
PID 4568 wrote to memory of 4004	4568	msedge.exe	86
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 3948	4568	msedge.exe	87
PID 4568 wrote to memory of 1496	4568	msedge.exe	88
PID 4568 wrote to memory of 1496	4568	msedge.exe	88
PID 4568 wrote to memory of 3680	4568	msedge.exe	89
PID 4568 wrote to memory of 3680	4568	msedge.exe	89
PID 4568 wrote to memory of 3680	4568	msedge.exe	89
PID 4568 wrote to memory of 3680	4568	msedge.exe	89
PID 4568 wrote to memory of 3680	4568	msedge.exe	89
PID 4568 wrote to memory of 3680	4568	msedge.exe	89
PID 4568 wrote to memory of 3680	4568	msedge.exe	89
PID 4568 wrote to memory of 3680	4568	msedge.exe	89
PID 4568 wrote to memory of 3680	4568	msedge.exe	89
PID 4568 wrote to memory of 3680	4568	msedge.exe	89
PID 4568 wrote to memory of 3680	4568	msedge.exe	89
PID 4568 wrote to memory of 3680	4568	msedge.exe	89
PID 4568 wrote to memory of 3680	4568	msedge.exe	89
PID 4568 wrote to memory of 3680	4568	msedge.exe	89
PID 4568 wrote to memory of 3680	4568	msedge.exe	89
PID 4568 wrote to memory of 3680	4568	msedge.exe	89
PID 4568 wrote to memory of 3680	4568	msedge.exe	89
PID 4568 wrote to memory of 3680	4568	msedge.exe	89
PID 4568 wrote to memory of 3680	4568	msedge.exe	89
PID 4568 wrote to memory of 3680	4568	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\be0cc5f57d3e04a40cc32c793a2898d8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd50e46f8,0x7fffd50e4708,0x7fffd50e4718
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,12959529445590193852,17101373782438467914,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,12959529445590193852,17101373782438467914,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,12959529445590193852,17101373782438467914,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12959529445590193852,17101373782438467914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,12959529445590193852,17101373782438467914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,12959529445590193852,17101373782438467914,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
33f11122c57fa13cbac887a086108530

SHA1
ffb5cedc35e72fb841a4b9bc2b37e35ea567679c

SHA256
26000312775d323ed70da9b11cea053a410b08556e395d5002a2909e74c3a855

SHA512
a6f12709c22961c1569ac88589d6b2f66b6286b142734f95749e8f24ad1cf5385dee1375fd5ae629ccb9dec30ead1d70d6ef486808cebe9250c4b428a8cbc0a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e5bde78e66b731fe475e83a6aa7442e4

SHA1
913c31bd1914ee839df8cb1f6ce18eab8e7733f8

SHA256
199fba1fca95ac64b4565435bc0d0e92db5e385da5d215c92fd1905f9e60df32

SHA512
de2e33aa9cbbe474e95cf4229754366899db03ed075c66ac5948c956341c72436107c9065fab98524b2a7bc964868fdb0a75bf7f8935988dcfed7fc4f1ae9eb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6da4873b9ec5b8081c7e8e9359da5b5f

SHA1
b3a3534e6d32587fccb899794ed002bf9547f04d

SHA256
dbdec1a6713f89648effba58357c1574b873f65f66849d7aec262dd483fe87d9

SHA512
530228e8912695552fb13c6f2a03fed16ab75f85cbf979be892e43e9394179e89817eb55c2c8c35a75818f45b3a489441acbfb014c3bd8608a91aed3b0357298

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
be68c025c0e04859bcd25d5315c3b43e

SHA1
68074603d9934846d7b44570a7b5a7759e2a8c08

SHA256
39f822e380015f6d7342ee9a4c24d5d66b69342d8ead7142909f836355009f67

SHA512
dc2b66da2169e9e7ccc74c67ba21c599128d411ba116b6c58a42879e1795f7144952bd85418aadeaad568c92799737afe4af3487e4773bc2ac38fdef8c884f40

Download Submit