8ac78d118206846ceec7b73a665b7419c3de63d8c3afb4943f6d14c0998a10bd

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d42cc2ee0929a0a97639b12ac5a784a5_JaffaCakes118.html
Size 19KB
Sample240908-mscjkstglf
SHA256 8ac78d118206846ceec7b73a665b7419c3de63d8c3afb4943f6d14c0998a10bd
MD5 d42cc2ee0929a0a97639b12ac5a784a5
SHA1 41d8b8e9bfb0aad997d727af1291522d5126bbb6
SHA512 ee08b9de242a4ccfd77251c530780ffbbaf242d736b3f4a1e6e6e5ccfb9acf298c176514d942a1d0fa5d22fb30f38f03a50b0af88c996e49fa1cf9049df5de47
SSDEEP 192:9K/y7UhrmiqEWrLTgE9d3udUMhDjQZ6IhfaMlUx9V6cxjb79DXSIiFDiC:4/yWrmi8LXftsQZ5kp55iIitiC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4144	msedge.exe
4144	msedge.exe
2060	msedge.exe
2060	msedge.exe
4312	identity_helper.exe
4312	identity_helper.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 4928	2060	msedge.exe	83
PID 2060 wrote to memory of 4928	2060	msedge.exe	83
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 1448	2060	msedge.exe	84
PID 2060 wrote to memory of 4144	2060	msedge.exe	85
PID 2060 wrote to memory of 4144	2060	msedge.exe	85
PID 2060 wrote to memory of 1572	2060	msedge.exe	86
PID 2060 wrote to memory of 1572	2060	msedge.exe	86
PID 2060 wrote to memory of 1572	2060	msedge.exe	86
PID 2060 wrote to memory of 1572	2060	msedge.exe	86
PID 2060 wrote to memory of 1572	2060	msedge.exe	86
PID 2060 wrote to memory of 1572	2060	msedge.exe	86
PID 2060 wrote to memory of 1572	2060	msedge.exe	86
PID 2060 wrote to memory of 1572	2060	msedge.exe	86
PID 2060 wrote to memory of 1572	2060	msedge.exe	86
PID 2060 wrote to memory of 1572	2060	msedge.exe	86
PID 2060 wrote to memory of 1572	2060	msedge.exe	86
PID 2060 wrote to memory of 1572	2060	msedge.exe	86
PID 2060 wrote to memory of 1572	2060	msedge.exe	86
PID 2060 wrote to memory of 1572	2060	msedge.exe	86
PID 2060 wrote to memory of 1572	2060	msedge.exe	86
PID 2060 wrote to memory of 1572	2060	msedge.exe	86
PID 2060 wrote to memory of 1572	2060	msedge.exe	86
PID 2060 wrote to memory of 1572	2060	msedge.exe	86
PID 2060 wrote to memory of 1572	2060	msedge.exe	86
PID 2060 wrote to memory of 1572	2060	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d42cc2ee0929a0a97639b12ac5a784a5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf8ae46f8,0x7ffbf8ae4708,0x7ffbf8ae4718
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,4666501162036166473,5654169422248119511,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,4666501162036166473,5654169422248119511,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,4666501162036166473,5654169422248119511,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4666501162036166473,5654169422248119511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4666501162036166473,5654169422248119511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4666501162036166473,5654169422248119511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,4666501162036166473,5654169422248119511,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,4666501162036166473,5654169422248119511,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4666501162036166473,5654169422248119511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4666501162036166473,5654169422248119511,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4666501162036166473,5654169422248119511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4666501162036166473,5654169422248119511,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,4666501162036166473,5654169422248119511,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
MD5 ecf7ca53c80b5245e35839009d12f866
SHA1 a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA512 706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
MD5 4dd2754d1bea40445984d65abee82b21
SHA1 4b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA512 92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 c663e93a257c2dfd053af97afda4c6913cd782934c87c6e3bd93dc17bb05ca86
MD5 e9b023560e47ebe9caf4d411bf152c1c
SHA1 87741adec82324491495f45fbb18e185cca835ec
SHA512 9dfe378c9bd38c65263102f349e3e95015fe1685f827ad114b304c6f7dfd8f4a01d40010d556f3b16c0a026b9f43262ea58ecfeb4221a5172d3ee0ae42606b4e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 76e85f6124aea290d06ee34196a8ccef89a038caede4973b0fb2f9ad8f840f5b
MD5 abd971ae89a56e463171d5fc06797923
SHA1 83ffe753934d5944bf10ef8eea393ad4985cd545
SHA512 f2bb3d2f05effbf3b3acd4a30def9bb6555451233689e6cb87c185f22d9eca2d6dc2611b864db1ebd4e4dae6a6d291facdd42e42992a2468dc7fa5c2c9e31079
SSDEEP 96:ngk/XR1FfTNwpvWMoiVmdeH44YA8UWQyV+VDCziEwb:ngk/BPRGWMX41ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 149e32a50be94c9e294a8c1909d29c21c9cc54725aa52931d1bfc48b4a2c28ed
MD5 1773f4b0b0fb3621e63d88dec5475a42
SHA1 1d41cac4b779932a801062c1b88bd820f685b1eb
SHA512 a198960f4afcb5d90cb9f062a24deccf77c6ad19c0220ba563decf61977ba18559c79cff5662818440f8f09a270e9137abc99341009c1dbf029f654de704e9eb
SSDEEP 96:ngk/XR1F3TNwpvWMoiVmdea5244YA8UWQyV+VD7AiEwb:ngk/BPpGWMq5241rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 684d2e194b6cb16ee81f0fa0d62b13500343f7af250445e70dc7a15e6bc40366
MD5 a9302125ceec449a8eb9315f3e30465e
SHA1 84bf68541af6cb8a61fe6f8fa2847b2b38275455
SHA512 139b7d778332ae526502d378156c4461b8c6e708a98d01d3bb34e5b67ae48d34f2d88dc57c80ab7916e75ff2a546ea6c83ed4da6aee5c17976f622a057daab3e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuphe2RULOkj6:A9iIxuERzA83h09RZxY1Sj6
MD5 SHA1 SHA512 SSDEEP

Submit Download