586d64fdcabc78c5318aece0566134b158429e0ea9ad79e110f27f32b385acdd

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bee91dd7a13597a95e2b67feaffb5edb_JaffaCakes118.html
Size

54KB
MD5

bee91dd7a13597a95e2b67feaffb5edb
SHA1

959a0861783e067325e0de7dcdd39c53907e9060
SHA256

586d64fdcabc78c5318aece0566134b158429e0ea9ad79e110f27f32b385acdd
SHA512

0f03dcf3cf58bf0ba6f70f2a66c52d4bb7da166decf9c60b2d765e0c1c193bf368f2f9a76207247481706921700bd3b33699d2fa1c2d890da03d587f4a3a2cb4
SSDEEP

1536:JjIFyMp1jTnX1h5VuFEOE7yDeSZm6jy69vy:JCRTTX1h5YFELypZ1y

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1812	msedge.exe
1812	msedge.exe
1388	msedge.exe
1388	msedge.exe
1080	identity_helper.exe
1080	identity_helper.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 3948	1388	msedge.exe	84
PID 1388 wrote to memory of 3948	1388	msedge.exe	84
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 3944	1388	msedge.exe	85
PID 1388 wrote to memory of 1812	1388	msedge.exe	86
PID 1388 wrote to memory of 1812	1388	msedge.exe	86
PID 1388 wrote to memory of 1416	1388	msedge.exe	87
PID 1388 wrote to memory of 1416	1388	msedge.exe	87
PID 1388 wrote to memory of 1416	1388	msedge.exe	87
PID 1388 wrote to memory of 1416	1388	msedge.exe	87
PID 1388 wrote to memory of 1416	1388	msedge.exe	87
PID 1388 wrote to memory of 1416	1388	msedge.exe	87
PID 1388 wrote to memory of 1416	1388	msedge.exe	87
PID 1388 wrote to memory of 1416	1388	msedge.exe	87
PID 1388 wrote to memory of 1416	1388	msedge.exe	87
PID 1388 wrote to memory of 1416	1388	msedge.exe	87
PID 1388 wrote to memory of 1416	1388	msedge.exe	87
PID 1388 wrote to memory of 1416	1388	msedge.exe	87
PID 1388 wrote to memory of 1416	1388	msedge.exe	87
PID 1388 wrote to memory of 1416	1388	msedge.exe	87
PID 1388 wrote to memory of 1416	1388	msedge.exe	87
PID 1388 wrote to memory of 1416	1388	msedge.exe	87
PID 1388 wrote to memory of 1416	1388	msedge.exe	87
PID 1388 wrote to memory of 1416	1388	msedge.exe	87
PID 1388 wrote to memory of 1416	1388	msedge.exe	87
PID 1388 wrote to memory of 1416	1388	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bee91dd7a13597a95e2b67feaffb5edb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd2e0146f8,0x7ffd2e014708,0x7ffd2e014718
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14156176225562849483,16331119903450664712,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,14156176225562849483,16331119903450664712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,14156176225562849483,16331119903450664712,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14156176225562849483,16331119903450664712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14156176225562849483,16331119903450664712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14156176225562849483,16331119903450664712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,14156176225562849483,16331119903450664712,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14156176225562849483,16331119903450664712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14156176225562849483,16331119903450664712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14156176225562849483,16331119903450664712,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14156176225562849483,16331119903450664712,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14156176225562849483,16331119903450664712,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
797B

MD5
de496d3dd5d0f579ba1a23328656b346

SHA1
6911396ae0502b60da8288402c762a09c552e908

SHA256
fc7c2f45d1e72a76eb6c3f48ea09bbb44f642af0c12d90a7cd439c3fff8603c6

SHA512
e6ce9d7f207ff8bc0a3dffaefbd3083de37a19b522dc9782fc5ed76acbc15ed4dcfd2b361621e4dd91d364a8d9f7f628a2891bbecc99dd0c17cc09d92abab8f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
45c244fae0646b52c1ff8af32acb2254

SHA1
60886c010ddc5bd1a64fc01faf66ce23104b065e

SHA256
cc83305ee11fa017f6e38e7b7156e702d631e86e358d9603d3f304428f6ce6a2

SHA512
36cc69d83689dfe8a1554f4065e7f91c5709ff908d081d50f8aa62f6fc6709223ddb8ffd1f90b36d1595da6e0b6b623f2ca2fc7165a8460680d938d2116a80e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9b2a033686c5639947e6f92d86e49545

SHA1
77e7f6c78100db7a405c2c58100a77c727a6a8dc

SHA256
ad3022ce9466f8287d1dcc0fcf0dc21a70c0b4c0a88b5b69b28d3b5209dd55e1

SHA512
f18c9b8192a2bd1ec443a3a3dc65e63eb0eff23aa5a2259ac29e4938c59d16775c21de509e040dcc74f5c6f6c283852a4f04ddc31da83d6ec5cae91bf669150e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
29945eb93a673dcb6c26ec8d3227b163

SHA1
f403535da45a2764939049f98bb10d839c93adfd

SHA256
8eed8302fdaf8c2ea47719afee5a98af88587bc3c257bbd45da2ea4be8e71702

SHA512
a873c640b0c66a9e64d8c91a4c9433a22f174eb3c88bf9e18226f04072de3da4ab14b6094ec8307231697c65466d91d9e0eea0707a2eaea0dff78df7840ba6f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
86c147060e3b7a7e77cff58e867c7700

SHA1
ecfd3ae1818e0a6639a0c0145062f9ecb279da83

SHA256
eb251aa6c728a5f21d0e91092e7c554f3dee355935ed6f57080c85e1b19d50b7

SHA512
99e7fc156103e813a4050b79c44788853bf1a917e15850fe6d5209870f8e748b49bd64d96759f4033b74015e8fd2f5dd64ba79321ace8f40ecc76b05b4675772

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585a8f.TMP

Filesize
203B

MD5
545523aee8de00a01299197ba6194511

SHA1
d8ebdbf7541c3edcd947b8065fe0a06bab03275f

SHA256
2918420083f55aa45b8adaafeb691e23bacb1dfc57311a1797c51cf4eac224a7

SHA512
22e5b79fee869f5f5a5a4998f4e48fdbbe4d50685df108edbd7c99ddffe51474ff36ba9eafb5de5031749c05d57f59ce6177823039487bce3b12879b3220d09b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c74d0f190610fec9de8fe333b34f4e21

SHA1
7fd0e5deaa5a6c0ae57766cc38e5271ddfecb94a

SHA256
68d6ecbcf4d2f9f367e6dc3bbb51b23114aede3b4e4626b0a987e601af2e6df3

SHA512
e9a556d5ed29b8791f6da85706f36bdc4415dd1f1b992cc42f2a113b633a90179727683acc82a07fe8ab747e48a1ac4aeb794a3ec8e1310c43abb7e2ae4ef173

Download Submit