e1d7e15bb285ab4cc8dd4d7b59cfe9ef168ec0f738056ebad78d14f0e9bbd2d3

Analysis

max time kernel
145s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c0aaed1bd6757e13ca0add183f40084b_JaffaCakes118.html
Size 461KB
Sample240825-ntaxtathjr
SHA256 e1d7e15bb285ab4cc8dd4d7b59cfe9ef168ec0f738056ebad78d14f0e9bbd2d3
MD5 c0aaed1bd6757e13ca0add183f40084b
SHA1 b3f7b99cff198c51e1b21806beaf7bdc6656a0bc
SHA512 9c37c27c8905363b6b98ae189bb02dd9ec56f81709a0560ba9662cff98b13ddd0be9e57ed8e31ad2182ab6006960e74a327031ed916ff24c26e060d431e647e1
SSDEEP 6144:SusMYod+X3oI+YgsMYod+X3oI+YqsMYod+X3oI+YLsMYod+X3oI+YQ:X5d+X3c5d+X365d+X315d+X3+
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe
4064	msedge.exe
4064	msedge.exe
3716	identity_helper.exe
3716	identity_helper.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe
4064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 1824	4064	msedge.exe	84
PID 4064 wrote to memory of 1824	4064	msedge.exe	84
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 988	4064	msedge.exe	85
PID 4064 wrote to memory of 4284	4064	msedge.exe	86
PID 4064 wrote to memory of 4284	4064	msedge.exe	86
PID 4064 wrote to memory of 2384	4064	msedge.exe	87
PID 4064 wrote to memory of 2384	4064	msedge.exe	87
PID 4064 wrote to memory of 2384	4064	msedge.exe	87
PID 4064 wrote to memory of 2384	4064	msedge.exe	87
PID 4064 wrote to memory of 2384	4064	msedge.exe	87
PID 4064 wrote to memory of 2384	4064	msedge.exe	87
PID 4064 wrote to memory of 2384	4064	msedge.exe	87
PID 4064 wrote to memory of 2384	4064	msedge.exe	87
PID 4064 wrote to memory of 2384	4064	msedge.exe	87
PID 4064 wrote to memory of 2384	4064	msedge.exe	87
PID 4064 wrote to memory of 2384	4064	msedge.exe	87
PID 4064 wrote to memory of 2384	4064	msedge.exe	87
PID 4064 wrote to memory of 2384	4064	msedge.exe	87
PID 4064 wrote to memory of 2384	4064	msedge.exe	87
PID 4064 wrote to memory of 2384	4064	msedge.exe	87
PID 4064 wrote to memory of 2384	4064	msedge.exe	87
PID 4064 wrote to memory of 2384	4064	msedge.exe	87
PID 4064 wrote to memory of 2384	4064	msedge.exe	87
PID 4064 wrote to memory of 2384	4064	msedge.exe	87
PID 4064 wrote to memory of 2384	4064	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c0aaed1bd6757e13ca0add183f40084b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe94a546f8,0x7ffe94a54708,0x7ffe94a54718
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1520,10327024615879887423,5177424366001796946,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1520,10327024615879887423,5177424366001796946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1520,10327024615879887423,5177424366001796946,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1520,10327024615879887423,5177424366001796946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1520,10327024615879887423,5177424366001796946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1520,10327024615879887423,5177424366001796946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1520,10327024615879887423,5177424366001796946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1520,10327024615879887423,5177424366001796946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1520,10327024615879887423,5177424366001796946,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1520,10327024615879887423,5177424366001796946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1520,10327024615879887423,5177424366001796946,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1520,10327024615879887423,5177424366001796946,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
MD5 ff63763eedb406987ced076e36ec9acf
SHA1 16365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA512 ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
MD5 2783c40400a8912a79cfd383da731086
SHA1 001a131fe399c30973089e18358818090ca81789
SHA512 b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 a507013e5df6e72e372d2482468d5aedd209832fd56bc4319034c94e69069df3
MD5 20f31d291fe0103e4beb31564874a751
SHA1 ba3bf9dc5ddc75c928ac9ac3687eb28ea58d34c5
SHA512 04f67113171e6ee54c4ae9f8a35c4da3627f4966f35e0693eba8d3a6b2f75908d24453ef4668ba65787e2ef245e4af661fbb09056c93173a6911714e711446be
SSDEEP 96:n8kzFcm1+004wpvWMoiVmdeHa00ziUWQyV+VDCziEwb:n8kzumEr4GWMXV/ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a9a58d81153dbdf627fb077f9370b2cacc9a2e9b4f30b06a406882bf4353c29a
MD5 55cf738d6963c421889d9b7d97a083e7
SHA1 5a3aceb2dfbe99d299334f24ba96df18ac88eb9b
SHA512 a28baa295a12eceacfdad566ad583ba38cf2330857a31e3c49412d6f2967b4ef8fdf0ceccbf427ae88c1227360fad92744f490c3ea9c60d0d06e7c87ec94721d
SSDEEP 96:n8kzFcm1+h04wpvWMoiVmdeHa00ziUWQyV+VD7AiEwb:n8kzumEy4GWMXV/rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 42ecb167d5041cdc94b984e025a5f83bca891811542de92f8815589561eca914
MD5 d1919dab5de015cfdd79bc18d01a2dab
SHA1 0dbe84be95fb450889f4088d73d5f984b1857588
SHA512 4c66711c4cfe328481f88ffbf5ed199d4fbed804f6bd081593f08900405c550dbde2e7f648a3dee550c73e5268e33fb8905c9242e144fc4f040bfaac880a04c3
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupMTMe2RUh9ATRw5Ytj9ZklR:A9iIxuERzA83h09RZxYXl0kLs1IQ
MD5 SHA1 SHA512 SSDEEP

Submit Download