3d9a74c773a31aae34bbd7437681b86dc4e204281d69d4523b51434d11869ce4

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 07:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dfbb0d8a6d578ad7eb33136519e90a7a_JaffaCakes118.html
Size 46KB
Sample240914-h7m7easgrg
SHA256 3d9a74c773a31aae34bbd7437681b86dc4e204281d69d4523b51434d11869ce4
MD5 dfbb0d8a6d578ad7eb33136519e90a7a
SHA1 f69608add672b1f172ae526f7921a6147112e0f8
SHA512 29805f6cf437054d6a7a6312aabe498ee9fec2b79a4349f09d1010c4470c61849c6e75de60f365fe398d8c14e0d892cb7a98d5a1b857d146c1b596bb483484bf
SSDEEP 768:2Gb/E+1exVCprXN4sZdpu80Qo8wIglSSG7OpAm3dcIrRAqF3J:2Gb/diCprXNvP0T8wH5zpAmtlAg5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1984	msedge.exe
1984	msedge.exe
936	msedge.exe
936	msedge.exe
3748	identity_helper.exe
3748	identity_helper.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe
936	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 4872	936	msedge.exe	83
PID 936 wrote to memory of 4872	936	msedge.exe	83
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 3196	936	msedge.exe	86
PID 936 wrote to memory of 1984	936	msedge.exe	87
PID 936 wrote to memory of 1984	936	msedge.exe	87
PID 936 wrote to memory of 2752	936	msedge.exe	88
PID 936 wrote to memory of 2752	936	msedge.exe	88
PID 936 wrote to memory of 2752	936	msedge.exe	88
PID 936 wrote to memory of 2752	936	msedge.exe	88
PID 936 wrote to memory of 2752	936	msedge.exe	88
PID 936 wrote to memory of 2752	936	msedge.exe	88
PID 936 wrote to memory of 2752	936	msedge.exe	88
PID 936 wrote to memory of 2752	936	msedge.exe	88
PID 936 wrote to memory of 2752	936	msedge.exe	88
PID 936 wrote to memory of 2752	936	msedge.exe	88
PID 936 wrote to memory of 2752	936	msedge.exe	88
PID 936 wrote to memory of 2752	936	msedge.exe	88
PID 936 wrote to memory of 2752	936	msedge.exe	88
PID 936 wrote to memory of 2752	936	msedge.exe	88
PID 936 wrote to memory of 2752	936	msedge.exe	88
PID 936 wrote to memory of 2752	936	msedge.exe	88
PID 936 wrote to memory of 2752	936	msedge.exe	88
PID 936 wrote to memory of 2752	936	msedge.exe	88
PID 936 wrote to memory of 2752	936	msedge.exe	88
PID 936 wrote to memory of 2752	936	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dfbb0d8a6d578ad7eb33136519e90a7a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd3eb46f8,0x7ffcd3eb4708,0x7ffcd3eb4718
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2499971579494900163,14703617905231706868,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,2499971579494900163,14703617905231706868,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,2499971579494900163,14703617905231706868,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2499971579494900163,14703617905231706868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2499971579494900163,14703617905231706868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,2499971579494900163,14703617905231706868,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,2499971579494900163,14703617905231706868,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2499971579494900163,14703617905231706868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2499971579494900163,14703617905231706868,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2499971579494900163,14703617905231706868,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,2499971579494900163,14703617905231706868,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2916 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2499971579494900163,14703617905231706868,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
MD5 ecf7ca53c80b5245e35839009d12f866
SHA1 a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA512 706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
MD5 4dd2754d1bea40445984d65abee82b21
SHA1 4b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA512 92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 2ba2a0882835b38a9d7eec65ea54f53daeea5f2bc701b042b59de7cbbd9c1757
MD5 f37904607b943e87e02d5486f3c292e6
SHA1 ac264ca1e8c55096a1a553f3d7daf4973f472edb
SHA512 16ab932085f1fb400e5257a5ac9db0fd04f3bff6daac3e42ccfe44266fb83dc9a6a4650c275d86c358e5cb432c7598df28f3ba57f5231c511f1db13a13fd5aca
SSDEEP 96:nxkR0P19nTNwpvWMoiVmdeH44YAhUWQyV+VDCziEwb:nxkROPZGWMX40ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b5e84610c6901c2617ec737cc137feb28a472f40e69064a7b0c625c08a750ec8
MD5 7633b75923eb1af6e3b589ab5563f859
SHA1 7174f8870a4f87c1d2f83ea29be5e72fa969a13b
SHA512 788eac8ac1e9040492c967fa1aa55d6eff4ff6d622a01b7c8b7b0412cbfce0cb41ddc24348146ea94b70239912db393fcb10b29fcc1ece94850c3ce31712c475
SSDEEP 96:nxkReP19/TNwpvWMoiVmdeJ244YAhUWQyV+VDCAiEwb:nxkR8PxGWMZ240rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ca1de0f1c5a79fe0adb565d5ec8b5258ebeeafd7bc92f218e327c702641a21aa
MD5 1a60f6e98122b7bfbeb4f08384e9642a
SHA1 4b0d5ac8d8007b0c5ab1f6af3ab38b1bfcc318a4
SHA512 a44162b26029ad9ea5b3f6bc59cd2a6be4293e29e1a8b6632319a933f7729d5980ddaa463a04fe3ab05349d1982674f849439e193f7d0a7bc69aa70f7b33d8d4
SSDEEP 96:nxkReP19nTNwpvWMoiVmdeJ244YAhUWQyV+VDCAiEwb:nxkR8PZGWMZ240rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 f4a2c202a26de8b99fe7347b575a46fa284991b5da355e18e821541c076fc529
MD5 ea027a4014d4f3e233aa6386a9561412
SHA1 a41fe634041300f5796a81a27ac670bd28897a50
SHA512 e90539ba0174bc96891f5b18867cd62de7a443b381cdcf39fbbea7f7162e657c394e258ee9680f66fae810894b90da40cc92b24717e2681ff7477f4c0ae896d5
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupyOe2RUrOkLTeuLJ5cme:A9iIxuERzA83h09RZxY1gL7JCL
MD5 SHA1 SHA512 SSDEEP

Submit Download