6d60529549444a31f94467593cf72e3442a7b3014f84109e1ebb2f3eac1a899b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-08-2024 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7997480702a3fe191265dc3fef822c8_JaffaCakes118.html
Size

19KB
MD5

c7997480702a3fe191265dc3fef822c8
SHA1

527d2016264313b4d021eacf7245ded6aa569b7a
SHA256

6d60529549444a31f94467593cf72e3442a7b3014f84109e1ebb2f3eac1a899b
SHA512

aa3d01ed22766222658abed5d228cb526b3c632fe333e5fd104435ddc9aff1824428773b42530feebe020236eb5865aa4387c6a182857310076fe32da321c3fa
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIb4ZzUnjBhb982qDB8:SIMd0I5nvHFsvbmxDB8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
4556	msedge.exe
4556	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 4600	4556	msedge.exe	85
PID 4556 wrote to memory of 4600	4556	msedge.exe	85
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 5112	4556	msedge.exe	86
PID 4556 wrote to memory of 3096	4556	msedge.exe	87
PID 4556 wrote to memory of 3096	4556	msedge.exe	87
PID 4556 wrote to memory of 2160	4556	msedge.exe	88
PID 4556 wrote to memory of 2160	4556	msedge.exe	88
PID 4556 wrote to memory of 2160	4556	msedge.exe	88
PID 4556 wrote to memory of 2160	4556	msedge.exe	88
PID 4556 wrote to memory of 2160	4556	msedge.exe	88
PID 4556 wrote to memory of 2160	4556	msedge.exe	88
PID 4556 wrote to memory of 2160	4556	msedge.exe	88
PID 4556 wrote to memory of 2160	4556	msedge.exe	88
PID 4556 wrote to memory of 2160	4556	msedge.exe	88
PID 4556 wrote to memory of 2160	4556	msedge.exe	88
PID 4556 wrote to memory of 2160	4556	msedge.exe	88
PID 4556 wrote to memory of 2160	4556	msedge.exe	88
PID 4556 wrote to memory of 2160	4556	msedge.exe	88
PID 4556 wrote to memory of 2160	4556	msedge.exe	88
PID 4556 wrote to memory of 2160	4556	msedge.exe	88
PID 4556 wrote to memory of 2160	4556	msedge.exe	88
PID 4556 wrote to memory of 2160	4556	msedge.exe	88
PID 4556 wrote to memory of 2160	4556	msedge.exe	88
PID 4556 wrote to memory of 2160	4556	msedge.exe	88
PID 4556 wrote to memory of 2160	4556	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c7997480702a3fe191265dc3fef822c8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd73946f8,0x7ffcd7394708,0x7ffcd7394718
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,5410928251065503848,3627143633827783827,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,5410928251065503848,3627143633827783827,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,5410928251065503848,3627143633827783827,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,5410928251065503848,3627143633827783827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,5410928251065503848,3627143633827783827,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,5410928251065503848,3627143633827783827,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4688 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5c528d72051d444aca0bc5abab9cc3f6

SHA1
26f2d9a173eb7efad2f2a117f0b45a2aa6a301f4

SHA256
21bbdda0a55c67fefc3759935d3fb5de6f839e34aa8ad487d594721faca4f69b

SHA512
f8544f1b4cffe07e3acd7290e038b8f584be8eeb12784b8e43d12806d2775fe4af7449278bc720b4fd1a6dfdfedc332629d359fa9e493cfeaa99e9843f04b2f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
555f0c8460db1059fbd1958b943b1238

SHA1
bd3532059729f839c99727e63cd6ab21e8997f6b

SHA256
e7e95a881b82ee85ff5c9b48444bc1717a6e3aac3c1853088ed7355cc42782e3

SHA512
8565d429333f0075e93105f4d2aeab1266f9cd9db52bf590c1af71055d57ff95b7aca58444007abfb68d2aa58782ab74aec31038a3539f63765f7b9e64feb5e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
17dbd37ece23371cc3cfb001a7bcd21b

SHA1
83cc85b6b41f114e2b01f27f6550167197104cab

SHA256
02dcc6e6df2da1b8e9b4c67015d215b2bcbadf1b0ebd36f57def144c9d905319

SHA512
acb74676c7ff994a9d0ac25364e68ddfba561b52bf80fce0611e3ce46c1b45cfa3f32760750ba307dbb755778aa157f2d212dcdd9632961ab0d82896da1a8211

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
360d4fc3454b9c802e0de8c81859d100

SHA1
6a251d6cd07de912d2133e3a6fc814fe015f1799

SHA256
9a75d765a2bcb4061cb2cebcf5254cecb20045cc2cb0b0312ce5d3c2b1dad724

SHA512
b2f3c81fd8c5ee094a1973fd8f07ef5ee13a781888647239a8f720705823c34dec39fcb084733b8c340fabaf0f8a7a30c8a63c613f5733e9669a13349b97ff14

Download Submit