4aa9e6b3f0772a3a73c15b7d9ae7f3a757a7704b8436dce9578972b816fac1ff

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 17:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6d3f1aaec5129c2b15430b4ef4fe9e2_JaffaCakes118.html
Size

78KB
MD5

d6d3f1aaec5129c2b15430b4ef4fe9e2
SHA1

14bc5682ece3d3b3438544fa0f0f3f53c57a4067
SHA256

4aa9e6b3f0772a3a73c15b7d9ae7f3a757a7704b8436dce9578972b816fac1ff
SHA512

eaa218f862ecb77f918ffa07665a9c3fead6518d77e388ae74133d18ab404c1bca997eca3a8c21922468b0005d6e248d9fb149b6aa91e7339ad566f4ca058ed4
SSDEEP

768:C3h7ye2sH/MXgyjCKoBfuS/7FxIuKzNyGsaMWxS+uOI+V:C3hxbFCIa

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2540	msedge.exe
2540	msedge.exe
2252	msedge.exe
2252	msedge.exe
2832	identity_helper.exe
2832	identity_helper.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 612	2252	msedge.exe	83
PID 2252 wrote to memory of 612	2252	msedge.exe	83
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 3944	2252	msedge.exe	84
PID 2252 wrote to memory of 2540	2252	msedge.exe	85
PID 2252 wrote to memory of 2540	2252	msedge.exe	85
PID 2252 wrote to memory of 1016	2252	msedge.exe	86
PID 2252 wrote to memory of 1016	2252	msedge.exe	86
PID 2252 wrote to memory of 1016	2252	msedge.exe	86
PID 2252 wrote to memory of 1016	2252	msedge.exe	86
PID 2252 wrote to memory of 1016	2252	msedge.exe	86
PID 2252 wrote to memory of 1016	2252	msedge.exe	86
PID 2252 wrote to memory of 1016	2252	msedge.exe	86
PID 2252 wrote to memory of 1016	2252	msedge.exe	86
PID 2252 wrote to memory of 1016	2252	msedge.exe	86
PID 2252 wrote to memory of 1016	2252	msedge.exe	86
PID 2252 wrote to memory of 1016	2252	msedge.exe	86
PID 2252 wrote to memory of 1016	2252	msedge.exe	86
PID 2252 wrote to memory of 1016	2252	msedge.exe	86
PID 2252 wrote to memory of 1016	2252	msedge.exe	86
PID 2252 wrote to memory of 1016	2252	msedge.exe	86
PID 2252 wrote to memory of 1016	2252	msedge.exe	86
PID 2252 wrote to memory of 1016	2252	msedge.exe	86
PID 2252 wrote to memory of 1016	2252	msedge.exe	86
PID 2252 wrote to memory of 1016	2252	msedge.exe	86
PID 2252 wrote to memory of 1016	2252	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d6d3f1aaec5129c2b15430b4ef4fe9e2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbe2f46f8,0x7ffdbe2f4708,0x7ffdbe2f4718
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,12787210422025263051,10176792761235539489,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,12787210422025263051,10176792761235539489,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,12787210422025263051,10176792761235539489,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12787210422025263051,10176792761235539489,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12787210422025263051,10176792761235539489,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12787210422025263051,10176792761235539489,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,12787210422025263051,10176792761235539489,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,12787210422025263051,10176792761235539489,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12787210422025263051,10176792761235539489,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12787210422025263051,10176792761235539489,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12787210422025263051,10176792761235539489,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,12787210422025263051,10176792761235539489,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,12787210422025263051,10176792761235539489,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
192B

MD5
0b7181a0c3a32055898b296a0eecbcba

SHA1
d6da6b05720dfc6bcd19dc595a7743558ad81f64

SHA256
f5c1971241b869140ecc6d339b92b861e4efcf3d32e041b583d3683a08ff2112

SHA512
691d613b292b9886783f48e5b8cc7a78678df2e7f09928132ff8126e57b9a1e315a3f2bceaf2d737212630b089c99e25848b0a4e4fc1d6db510bfa387cd5044e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6c6effecfc4ada7441cc547295c15dbd

SHA1
15c8525ada28b2e066a81e4f5e81dd2377ac0bf7

SHA256
e4435801bba492bcc3513f6802decd6eb38ce3698fab0cc17d94e4556396a69f

SHA512
b56fbf7be8a2b6d659d07cc6e08653b8fc3297a9ddd28fddadc351e97ab028c55da34fc602db78039cbeacd45f25a329a3fe8d140fd162cfc50954aa4f6de31d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dda7e7a4b50d5e36b290852d8a4e83e5

SHA1
ed81696f4c2d12dd51d1dad32e1e72d8f3520c8b

SHA256
b989a05f57d7504384f26f9b9a4257f994befdf380c1d6da9821a63b5baa1eee

SHA512
79804ec5e06d3a5699addd53f9138a43afaef983788370ff250a4471fc88a4ab7d1216b30ef14722aadfdca18432c78b31b1cd468d0e81b32365fce810e5bace

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f16c736f6d3ce17ed134b05c751fe106

SHA1
6af724b199af062f34031a71eb5570d31472f5e1

SHA256
93692d9c6a184cba8cfedc60c92fc82dd9792f83a5e8d6c84e5e09caae9c66c7

SHA512
a25ff6d7705e7e2800cd3ecb2e625ba9de164c70fbcd39356702f7fe21e7489ea3025e5c3e7031f144b8177f6eca9b48e562f1f80d43f174adbd5554b80bb0c3

Download Submit