4f415ae666565f0d261c9c76d46ef25622d4762b0dd07abcbdad42d17eb5ed54

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c01dc003c1d552f614eb35f5c4e76ace_JaffaCakes118.html
Size

59KB
MD5

c01dc003c1d552f614eb35f5c4e76ace
SHA1

bf82efb403cca7b47482f4547881e5dee55fa9df
SHA256

4f415ae666565f0d261c9c76d46ef25622d4762b0dd07abcbdad42d17eb5ed54
SHA512

60092bb320459297c589c156f70f2cbc749bd712099e1207674ab1b554ecf81f571ea9c8e49dda607a7778a101ba6ae9c5eeb5e9f016af6f2cbef95732bfe003
SSDEEP

1536:CTPM0XwI6wusTeL7CCYAlv58WL2SMga4V1lcFPT:QwI6wuXLH8WL2SMga4V1OFPT

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3956	msedge.exe
3956	msedge.exe
1004	msedge.exe
1004	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe
1004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 4248	1004	msedge.exe	84
PID 1004 wrote to memory of 4248	1004	msedge.exe	84
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 1420	1004	msedge.exe	85
PID 1004 wrote to memory of 3956	1004	msedge.exe	86
PID 1004 wrote to memory of 3956	1004	msedge.exe	86
PID 1004 wrote to memory of 4036	1004	msedge.exe	87
PID 1004 wrote to memory of 4036	1004	msedge.exe	87
PID 1004 wrote to memory of 4036	1004	msedge.exe	87
PID 1004 wrote to memory of 4036	1004	msedge.exe	87
PID 1004 wrote to memory of 4036	1004	msedge.exe	87
PID 1004 wrote to memory of 4036	1004	msedge.exe	87
PID 1004 wrote to memory of 4036	1004	msedge.exe	87
PID 1004 wrote to memory of 4036	1004	msedge.exe	87
PID 1004 wrote to memory of 4036	1004	msedge.exe	87
PID 1004 wrote to memory of 4036	1004	msedge.exe	87
PID 1004 wrote to memory of 4036	1004	msedge.exe	87
PID 1004 wrote to memory of 4036	1004	msedge.exe	87
PID 1004 wrote to memory of 4036	1004	msedge.exe	87
PID 1004 wrote to memory of 4036	1004	msedge.exe	87
PID 1004 wrote to memory of 4036	1004	msedge.exe	87
PID 1004 wrote to memory of 4036	1004	msedge.exe	87
PID 1004 wrote to memory of 4036	1004	msedge.exe	87
PID 1004 wrote to memory of 4036	1004	msedge.exe	87
PID 1004 wrote to memory of 4036	1004	msedge.exe	87
PID 1004 wrote to memory of 4036	1004	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c01dc003c1d552f614eb35f5c4e76ace_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff992e646f8,0x7ff992e64708,0x7ff992e64718
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,16847020429929892306,10668767314499731976,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,16847020429929892306,10668767314499731976,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,16847020429929892306,10668767314499731976,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16847020429929892306,10668767314499731976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,16847020429929892306,10668767314499731976,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,16847020429929892306,10668767314499731976,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\13483e97-c54a-4a88-9575-11e7cc347a6c.tmp

Filesize
6KB

MD5
7e491a229fa49017b0daee3ec594345e

SHA1
2c7b49909574051c5435f65db392de7430f8b4f1

SHA256
de671b9d9d76694d109498912fb913447dae6e2382b50420f65a341d29fb3f17

SHA512
06997397a320e6aa1ccf8200a3f9cf5db1d42275af63101e5f62e14db15fd6efbea2249b7e573b8c50b86f59841cf0da08c7b251d13d2c7969a07a883dd4e12b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
48192bab6cd2cbde650485c735676f7b

SHA1
958f4b17d1085bfb60dcb8fb0b8e0ed99ba746c4

SHA256
c0b74429b3e18a792fc85aab9a4c38132656c53a1da2227948db35ae75286c08

SHA512
31fe451f514cf4f696b2a394ffae0cba15119c90ca04cf713fe6e47e3d37d19e2c2b4e747d29b3be39ecddd533ec418e7161719c4e6b871e6c8d2eef08fceb02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aeff8182484dd90fe4eb2b702414b276

SHA1
91b5552e0ca7ec43e23175105f9a3ba13f76f32f

SHA256
2c01f39653c6dfdb1750ba0973671a53d2da9854d041634c88e00102d25c4111

SHA512
92f387ee32539c1613bb88a6d9db0007f79188726c48859a34eefad5a9dc8584877c2f4f2a9d31048fdbbbae0feddd2d6f51663377425cc890883d20bf95baae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0867833eb5e828c6d764bbf167fc43d9

SHA1
90d1ef60ec80330ecbe700cafadaeb392ae52ea2

SHA256
bf6d69e1d71218479376c0d13a488a9154ac51afda4e94c048775d222932786f

SHA512
fbc637572736a637875effa7cfee2ee1e40451f30fbe85735d80f9dc8a45e3cbc6005f970ba146e682ae7fd053b89ede6f4c4e4d15237ab267fcf3949cf53434

Download Submit