e7ccf98cf3648034b60d4c42398d907c880c72a218a6a9df48b4c10d74717256

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 06:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d9c5335a0eb9ca5fbcadd26c50e1cfb0_JaffaCakes118.html
Size 14KB
Sample240911-g2rf7swfkl
SHA256 e7ccf98cf3648034b60d4c42398d907c880c72a218a6a9df48b4c10d74717256
MD5 d9c5335a0eb9ca5fbcadd26c50e1cfb0
SHA1 bfe53d11084562dce29cee94af42ac7e979b1dc1
SHA512 051e076edbda6711b7bec5f7d5502beb37df9fe55fa20efdead92998beca9a6892aaacfc63881200b0c672df94d3f9b0cebd531bd41b9ec1707663d6844f4e2b
SSDEEP 384:CyiH0bJN/6GPk4NGPkOGAi7zy1wIuM/2UfXYFPkoeuzGPk5PkAUkTdo+V:CyiHoJFbPkfPkOGAi7zIBuMPIFPkVuqm
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
2492	msedge.exe
2492	msedge.exe
4452	identity_helper.exe
4452	identity_helper.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 940	2492	msedge.exe	83
PID 2492 wrote to memory of 940	2492	msedge.exe	83
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 1464	2492	msedge.exe	84
PID 2492 wrote to memory of 5024	2492	msedge.exe	85
PID 2492 wrote to memory of 5024	2492	msedge.exe	85
PID 2492 wrote to memory of 3312	2492	msedge.exe	86
PID 2492 wrote to memory of 3312	2492	msedge.exe	86
PID 2492 wrote to memory of 3312	2492	msedge.exe	86
PID 2492 wrote to memory of 3312	2492	msedge.exe	86
PID 2492 wrote to memory of 3312	2492	msedge.exe	86
PID 2492 wrote to memory of 3312	2492	msedge.exe	86
PID 2492 wrote to memory of 3312	2492	msedge.exe	86
PID 2492 wrote to memory of 3312	2492	msedge.exe	86
PID 2492 wrote to memory of 3312	2492	msedge.exe	86
PID 2492 wrote to memory of 3312	2492	msedge.exe	86
PID 2492 wrote to memory of 3312	2492	msedge.exe	86
PID 2492 wrote to memory of 3312	2492	msedge.exe	86
PID 2492 wrote to memory of 3312	2492	msedge.exe	86
PID 2492 wrote to memory of 3312	2492	msedge.exe	86
PID 2492 wrote to memory of 3312	2492	msedge.exe	86
PID 2492 wrote to memory of 3312	2492	msedge.exe	86
PID 2492 wrote to memory of 3312	2492	msedge.exe	86
PID 2492 wrote to memory of 3312	2492	msedge.exe	86
PID 2492 wrote to memory of 3312	2492	msedge.exe	86
PID 2492 wrote to memory of 3312	2492	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d9c5335a0eb9ca5fbcadd26c50e1cfb0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82e4646f8,0x7ff82e464708,0x7ff82e464718
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,13174069300156852556,13092854407482464802,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,13174069300156852556,13092854407482464802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,13174069300156852556,13092854407482464802,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,13174069300156852556,13092854407482464802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,13174069300156852556,13092854407482464802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,13174069300156852556,13092854407482464802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,13174069300156852556,13092854407482464802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,13174069300156852556,13092854407482464802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,13174069300156852556,13092854407482464802,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,13174069300156852556,13092854407482464802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,13174069300156852556,13092854407482464802,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,13174069300156852556,13092854407482464802,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124
MD5 e4f80e7950cbd3bb11257d2000cb885e
SHA1 10ac643904d539042d8f7aa4a312b13ec2106035
SHA512 2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa
MD5 2dc1a9f2f3f8c3cfe51bb29b078166c5
SHA1 eaf3c3dad3c8dc6f18dc3e055b415da78b704402
SHA512 682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25
MD5 SHA1 SHA512

Submit Download

925b546a-71d6-4107-8077-57010ce25346.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\925b546a-71d6-4107-8077-57010ce25346.tmp
Size 5KB
SHA256 d96bf91f4e15ded354c8299048c28e5da3fa3fb810f7e89dfe7499a8ebb62b8f
MD5 37965b9fa5193b12b0605892256a0ee9
SHA1 61345d5beaa526ca4a80c2b6d8b77f1ae74ba291
SHA512 142f749282135088c596572d2b308755ba56c82fa63cfc4ee63a4ed56f0420d1e36d94265012559e2debb09173620e3827b032da8ecd716514f5779dd68714b6
SSDEEP 96:n4zkzXIE1cITtwpvWMoiVmdeHTbZzhWUWQyV+VDCziEwb:n4zkzYESWGWMX/5hWro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 49ec98a0b646112d6ec435832bda8a76400ba8ea80373081091df44a6a8e387f
MD5 093e025ea7f4789564fb16a93c7fd9fa
SHA1 7fb1f16a57eb28cf2dc58a87053254b4015de3a9
SHA512 3cb789664a78a580441f978db053e4f83706dc7ea54539cfbc7f492e63b0e0bc466e4c11536a7b92a5065c5c7b6f799f8f6fab445628f8c62fc2c8bda2ddbdba
SSDEEP 96:n4zkzOIE1cITtwpvWMoiVmdeDJ2TbZzhWUWQyV+VD7AiEwb:n4zkzzESWGWMzJ2/5hWrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 cdb0f560d529c8dd9e9c362f07fdc39dfc32a0b912317ed6a6aca50a653815be
MD5 75511025c0fbb63429e11510eee2e7d3
SHA1 dd76229b69750c5e3ad4651b593f6fafdf856fa3
SHA512 21044ec1994e78762306280b28c5065e462d08f1f6f6662b890e38c7b8d88112dbc711a203839b078cd44dfe618321dab0f70dbafe336588463cd01a2b9066ea
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup8loSWe2RU6rFkjPcdjj+gW:A9iIxuERzA83h09RZxY8lolVr8P0jC/v
MD5 SHA1 SHA512 SSDEEP

Submit Download