d04956321001d0a1cbb4dc006512416d59fa084b3f9b6adb8964f772bb7d6abd

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c20a1a435386f1d9b4386acd4ea39b2a_JaffaCakes118.html
Size

26KB
MD5

c20a1a435386f1d9b4386acd4ea39b2a
SHA1

8ced67f8e98b2ef1251cb9596d5d92fe60737547
SHA256

d04956321001d0a1cbb4dc006512416d59fa084b3f9b6adb8964f772bb7d6abd
SHA512

5a45610bdb1bb8836d29f5ce960fd79ac876d2c88622691abfc17365b5e1797d38b57e527eb56c97e1b8241b692def7df86a3803c923372e5656045ea9ae04c4
SSDEEP

192:uqVXf1b5nTGnQjxn5Q/KnQiehNn6nQOkEntSQnQTbnZnQhCJVevo7NtYFo+NzQ4T:nlQ/cygc37Li

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
1984	msedge.exe
1984	msedge.exe
1848	identity_helper.exe
1848	identity_helper.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe
312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 3532	1984	msedge.exe	84
PID 1984 wrote to memory of 3532	1984	msedge.exe	84
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 2676	1984	msedge.exe	85
PID 1984 wrote to memory of 3516	1984	msedge.exe	86
PID 1984 wrote to memory of 3516	1984	msedge.exe	86
PID 1984 wrote to memory of 3216	1984	msedge.exe	87
PID 1984 wrote to memory of 3216	1984	msedge.exe	87
PID 1984 wrote to memory of 3216	1984	msedge.exe	87
PID 1984 wrote to memory of 3216	1984	msedge.exe	87
PID 1984 wrote to memory of 3216	1984	msedge.exe	87
PID 1984 wrote to memory of 3216	1984	msedge.exe	87
PID 1984 wrote to memory of 3216	1984	msedge.exe	87
PID 1984 wrote to memory of 3216	1984	msedge.exe	87
PID 1984 wrote to memory of 3216	1984	msedge.exe	87
PID 1984 wrote to memory of 3216	1984	msedge.exe	87
PID 1984 wrote to memory of 3216	1984	msedge.exe	87
PID 1984 wrote to memory of 3216	1984	msedge.exe	87
PID 1984 wrote to memory of 3216	1984	msedge.exe	87
PID 1984 wrote to memory of 3216	1984	msedge.exe	87
PID 1984 wrote to memory of 3216	1984	msedge.exe	87
PID 1984 wrote to memory of 3216	1984	msedge.exe	87
PID 1984 wrote to memory of 3216	1984	msedge.exe	87
PID 1984 wrote to memory of 3216	1984	msedge.exe	87
PID 1984 wrote to memory of 3216	1984	msedge.exe	87
PID 1984 wrote to memory of 3216	1984	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c20a1a435386f1d9b4386acd4ea39b2a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcde2346f8,0x7ffcde234708,0x7ffcde234718
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6200635147467792721,255079771511131003,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,6200635147467792721,255079771511131003,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,6200635147467792721,255079771511131003,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6200635147467792721,255079771511131003,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6200635147467792721,255079771511131003,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,6200635147467792721,255079771511131003,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,6200635147467792721,255079771511131003,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6200635147467792721,255079771511131003,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2572 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6200635147467792721,255079771511131003,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:68
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6200635147467792721,255079771511131003,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6200635147467792721,255079771511131003,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6200635147467792721,255079771511131003,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3540 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
56f9e7f8be024430e7b6440d3b9b2847

SHA1
09a06ed87bcb62fdd5a80ea0d797f81b75a3ac4d

SHA256
9b32267e0820f3f789568d52a5133da6611e89a3e3b5a0db4ef03057739f51f4

SHA512
e37d042aca442bc3d96ad7618290a34e3f730cc71c9cedb22de3e1343698d2b0c31d69e97ea60d6cb98d760f8d84920daf7afe76b76f89821205691fc108a2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5063d661f5d8cf831ec6edf526f4c2f3

SHA1
2f9875a5d4eb8b09744ca3b8c95ae79859b36e34

SHA256
daad7a5fca0e72ae38db5e9cfa5fe18b260954acdf747753530bcd69e0902423

SHA512
e4a6c583d9d9590f44fc4a08bfcfec9164168db71ef40a5a1cbf3544abc8b62941937830ddf55b8e837b8bd61e41b943faccf7fec62c839dd34f9b7b856f39d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4bfcef4be6bbe410c06ba745b4cd88dd

SHA1
a0b8a2143c3a36bef6d2b7d04fb6bba4ba96892c

SHA256
24eead45d807ce71d69f5f7eb7eeccb031153c089bcbf05b2f536adc8187f608

SHA512
fa67d1d7b4fac74a2ce92cfaae9ff35b6648937bd63e56c04550643ed312fa80b6fc7a091d2407b363b68308bb34ecfe84c2b1e8a2c18c9f1bb343010a8b4ae7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f04b7ca4-d235-47f8-976c-28cbc881c99a.tmp

Filesize
10KB

MD5
5bb1ea5b6ef292f5337121838e281203

SHA1
c646102fe3a2ee78ac53f9d76abd36b28daf2b70

SHA256
7d0a8b5d15de7d559b430d9c3743a45471acaf8bb0a55324cb8a323bcdaa5e63

SHA512
db4285fe24d3095c4507609511ac58656627ba3c8d8281ff23e6fb3dfbed308d8c21abc71027f7e72caa1ff5ec0c224db3cedda5d744743c794ee05514c5c9f4

Download Submit