3eb8e459123cd5aa89903a4d7da466c38c4455a34b025f71bea59d1d8757534b

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bee44cfa778a81246a80856d58ea1aa5_JaffaCakes118.html
Size

299KB
MD5

bee44cfa778a81246a80856d58ea1aa5
SHA1

d6b843423fe2b4875ff487c6e38a69e19f1815ae
SHA256

3eb8e459123cd5aa89903a4d7da466c38c4455a34b025f71bea59d1d8757534b
SHA512

7370d9d4f451c34b79fb9407f206a8d1164254c6a2e489575100434fd49c746a77a901cbe2f06777027d68129b7b227aee85b941ad7eee9f97ddf8e57a5e5530
SSDEEP

3072:aVEdK7B9f81d0UxuzJVGfvWZwle8TXVxStE:t87kuzJVGXPlRz

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
652	msedge.exe
652	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
652	msedge.exe
652	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 2224	652	msedge.exe	84
PID 652 wrote to memory of 2224	652	msedge.exe	84
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 3832	652	msedge.exe	85
PID 652 wrote to memory of 4248	652	msedge.exe	86
PID 652 wrote to memory of 4248	652	msedge.exe	86
PID 652 wrote to memory of 4268	652	msedge.exe	87
PID 652 wrote to memory of 4268	652	msedge.exe	87
PID 652 wrote to memory of 4268	652	msedge.exe	87
PID 652 wrote to memory of 4268	652	msedge.exe	87
PID 652 wrote to memory of 4268	652	msedge.exe	87
PID 652 wrote to memory of 4268	652	msedge.exe	87
PID 652 wrote to memory of 4268	652	msedge.exe	87
PID 652 wrote to memory of 4268	652	msedge.exe	87
PID 652 wrote to memory of 4268	652	msedge.exe	87
PID 652 wrote to memory of 4268	652	msedge.exe	87
PID 652 wrote to memory of 4268	652	msedge.exe	87
PID 652 wrote to memory of 4268	652	msedge.exe	87
PID 652 wrote to memory of 4268	652	msedge.exe	87
PID 652 wrote to memory of 4268	652	msedge.exe	87
PID 652 wrote to memory of 4268	652	msedge.exe	87
PID 652 wrote to memory of 4268	652	msedge.exe	87
PID 652 wrote to memory of 4268	652	msedge.exe	87
PID 652 wrote to memory of 4268	652	msedge.exe	87
PID 652 wrote to memory of 4268	652	msedge.exe	87
PID 652 wrote to memory of 4268	652	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bee44cfa778a81246a80856d58ea1aa5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8996946f8,0x7ff899694708,0x7ff899694718
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,6711224185410986962,14959804808734248329,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,6711224185410986962,14959804808734248329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,6711224185410986962,14959804808734248329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6711224185410986962,14959804808734248329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6711224185410986962,14959804808734248329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,6711224185410986962,14959804808734248329,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1020B

MD5
1e5f87d3678060143e8ef5adcc447874

SHA1
3b1ec9931841b24c500f3122561a936c78e4330c

SHA256
d2f39f2b23f3abe64e2aa691e96bc354190e958b340c6919c7d31589e7f2752c

SHA512
482c16df09dc73e9f742423b27b3a13f05ecb032dbdaa60092841cdc694b3d65646c2f2a13d5e4947428012a78b4f9c0c7ea3b86a53ff3619905924c71646a64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b16e474b0900d5ce6e7ffaccac648221

SHA1
205c7c8edc1cb6db8850ad597984d07b0c8b63e4

SHA256
c9d2b25f86b29cfa200d3eb9904ba65535c9b384cdae046ca79973b88a851c3b

SHA512
d7738be85dee916acd8082f906f7fa9e4287fa31fa71ad3ad886ba3b71f64968405800c8b40095156f59da5374979a7e684627b1041846a75e0ed9c5cfa89c0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a9edf65ce539e0fdfe3a999e82320bf0

SHA1
b27bec0efe108575cabf15724b3f48fd8effb744

SHA256
b14bcac6e2ad9681f52745f88270f23755cf5eb980d3bffcccfb271f983da7be

SHA512
3fd30f979ae879700bbeb115812eea32916db5e72f3ddd22cc35bae3135e600412b9f7411e4c4156ccbc5e7ffc327a27196dee181b25a86ba0fb50e41a376f98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cecbc70caa85b135a59d8915442f0283

SHA1
681e1463837e1f2cbacd1510ec49396505fc7607

SHA256
289168b496d9486e766df783c1bfae0e2e5a17cf4025fdcbb01c0114aacad47d

SHA512
a72dfc7bf4dea3030c3d9ff90086273f6a6719b39c8f3cd9770607d5c7e99ef96ea97af8db10cf3da7f54ab70931ccd5da2cad56440eb2dd569ffbe678fbe93f

Download Submit