9e704e96b8f39b90fa1c7f378c2b665b46e564557d159cb02db158256da36895

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d1cc40e8977994e5822e8833eb3aa4a3_JaffaCakes118.html
Size

90KB
MD5

d1cc40e8977994e5822e8833eb3aa4a3
SHA1

9799e33b05fa8c7cedf732decdb092eb8f35e9f3
SHA256

9e704e96b8f39b90fa1c7f378c2b665b46e564557d159cb02db158256da36895
SHA512

0a53761cc568f5ab887d3a8998ec40602a5256d71f96431b0235e3e7dd907a25d31c25faf42bb2c77e39ce91d45be79163ac5f4a4a101fb295620e88ba6e0410
SSDEEP

1536:87HhlQJMDgP+Dbdh4yrJEy8Mjf1Qe+SJPl7f4hahANXbxOjh5dsdJkGqOs1Uchx+:IhlQJMDgWDbdh4yrJEy8Mjf1Qe+SJPOB

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3052	msedge.exe
3052	msedge.exe
1744	msedge.exe
1744	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1948	1744	msedge.exe	83
PID 1744 wrote to memory of 1948	1744	msedge.exe	83
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 4768	1744	msedge.exe	84
PID 1744 wrote to memory of 3052	1744	msedge.exe	85
PID 1744 wrote to memory of 3052	1744	msedge.exe	85
PID 1744 wrote to memory of 2312	1744	msedge.exe	86
PID 1744 wrote to memory of 2312	1744	msedge.exe	86
PID 1744 wrote to memory of 2312	1744	msedge.exe	86
PID 1744 wrote to memory of 2312	1744	msedge.exe	86
PID 1744 wrote to memory of 2312	1744	msedge.exe	86
PID 1744 wrote to memory of 2312	1744	msedge.exe	86
PID 1744 wrote to memory of 2312	1744	msedge.exe	86
PID 1744 wrote to memory of 2312	1744	msedge.exe	86
PID 1744 wrote to memory of 2312	1744	msedge.exe	86
PID 1744 wrote to memory of 2312	1744	msedge.exe	86
PID 1744 wrote to memory of 2312	1744	msedge.exe	86
PID 1744 wrote to memory of 2312	1744	msedge.exe	86
PID 1744 wrote to memory of 2312	1744	msedge.exe	86
PID 1744 wrote to memory of 2312	1744	msedge.exe	86
PID 1744 wrote to memory of 2312	1744	msedge.exe	86
PID 1744 wrote to memory of 2312	1744	msedge.exe	86
PID 1744 wrote to memory of 2312	1744	msedge.exe	86
PID 1744 wrote to memory of 2312	1744	msedge.exe	86
PID 1744 wrote to memory of 2312	1744	msedge.exe	86
PID 1744 wrote to memory of 2312	1744	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d1cc40e8977994e5822e8833eb3aa4a3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbc5046f8,0x7fffbc504708,0x7fffbc504718
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,4869625223761938387,3365697855198237430,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,4869625223761938387,3365697855198237430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,4869625223761938387,3365697855198237430,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4869625223761938387,3365697855198237430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,4869625223761938387,3365697855198237430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,4869625223761938387,3365697855198237430,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1120 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
190B

MD5
2240fbe2f8dfed05eba4bb41ff549913

SHA1
58d36bb06193dd0929c22e356a6391f3c86b8b20

SHA256
d4f09a29a351044358d06edcb94d6cd44555e37827b896b283a822dfcf46cee8

SHA512
1664c3d87893703091f7d990a1a5d5f72ec028a3f002eef4f8552364fce52e2054ec1552dd88e515a91f2030116fa6f355844a8aca3e84f9438de9f74045cec7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9e553664bb4925c70a65d7853119a40b

SHA1
ef4ac8d2c1045e776e0b51beaf0d04b4bc71515f

SHA256
b2bbf75f3ea5a921bd01e22554105da9c4fc76affa9a51679353dbd8c3c2f534

SHA512
1d3fa8a26a8188fea6ddddb1f1b6330daff7f1030e3f5cb9abf0bd387c24d3e0b1b26f699abdba29a0d7df7233519a6db16772eafcee8f93f5571bfc5fc329de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9be5c84abdf932da0ef406d90904ae4f

SHA1
6f677ee23bfa959daf960a78fe0d951efe822c31

SHA256
a3ef8dbe5401483194c72d99ca073cbcd7222fb39dd9c352c0bde4cc8a4fc90b

SHA512
9cc938a0e8a3ca46e1fcc761e5f5f0b5f2f28b8ca38c872c2d592415cd92d2eecab447f135c4206f351aa135ed9f2d37b2c8e279a3cd7b88e6034e92d43a9546

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f67523d2b531b0dfab6db97d2b378fa3

SHA1
473d82c43c4442f7f51ac3b3cc5ef9ff4ad37ce9

SHA256
7fd4b2cfbe752092f23216b08f87eb8b4e003dc14415f57d7d76d9ea62725624

SHA512
6ad26b2d9a0b2c7ef10c183d030e59b0528bc4672af63e983eda0fcb32f808abfe247906404d8d5278e925d3b294f17e52a78867a21b93be494196b917f95943

Download Submit