c9ad58faa089564e724633d2186bc817c5742facd4579ac7f16f701b7f507478

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 18:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0c77a4078a6d7a7bcba7bbe7f255e9e_JaffaCakes118.html
Size

105KB
MD5

e0c77a4078a6d7a7bcba7bbe7f255e9e
SHA1

f50c29591182db2f0aef3176c61f8d1d2e2d0807
SHA256

c9ad58faa089564e724633d2186bc817c5742facd4579ac7f16f701b7f507478
SHA512

1de14a16072d13fcccb290e216f280b0c34a7fa41dd58a5b6e70200ca5f3ff6d57efba0852c292d90e30f7b325190043934a1aa8dc85da137682c0470a89b216
SSDEEP

1536:/ggwqpp0jBVdUVVVVVVzzSSOOyyy66IIKKGG8B8BxxxxxxxGGddttGaa22hhjjZ/:/ggBpz6Vxo

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
1472	msedge.exe
1472	msedge.exe
4908	identity_helper.exe
4908	identity_helper.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe
1472	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 4056	1472	msedge.exe	83
PID 1472 wrote to memory of 4056	1472	msedge.exe	83
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 2424	1472	msedge.exe	84
PID 1472 wrote to memory of 3620	1472	msedge.exe	85
PID 1472 wrote to memory of 3620	1472	msedge.exe	85
PID 1472 wrote to memory of 3784	1472	msedge.exe	86
PID 1472 wrote to memory of 3784	1472	msedge.exe	86
PID 1472 wrote to memory of 3784	1472	msedge.exe	86
PID 1472 wrote to memory of 3784	1472	msedge.exe	86
PID 1472 wrote to memory of 3784	1472	msedge.exe	86
PID 1472 wrote to memory of 3784	1472	msedge.exe	86
PID 1472 wrote to memory of 3784	1472	msedge.exe	86
PID 1472 wrote to memory of 3784	1472	msedge.exe	86
PID 1472 wrote to memory of 3784	1472	msedge.exe	86
PID 1472 wrote to memory of 3784	1472	msedge.exe	86
PID 1472 wrote to memory of 3784	1472	msedge.exe	86
PID 1472 wrote to memory of 3784	1472	msedge.exe	86
PID 1472 wrote to memory of 3784	1472	msedge.exe	86
PID 1472 wrote to memory of 3784	1472	msedge.exe	86
PID 1472 wrote to memory of 3784	1472	msedge.exe	86
PID 1472 wrote to memory of 3784	1472	msedge.exe	86
PID 1472 wrote to memory of 3784	1472	msedge.exe	86
PID 1472 wrote to memory of 3784	1472	msedge.exe	86
PID 1472 wrote to memory of 3784	1472	msedge.exe	86
PID 1472 wrote to memory of 3784	1472	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e0c77a4078a6d7a7bcba7bbe7f255e9e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b2b846f8,0x7ff9b2b84708,0x7ff9b2b84718
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,14625379283877832606,5783166253556177429,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,14625379283877832606,5783166253556177429,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,14625379283877832606,5783166253556177429,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14625379283877832606,5783166253556177429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14625379283877832606,5783166253556177429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14625379283877832606,5783166253556177429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2452 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14625379283877832606,5783166253556177429,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,14625379283877832606,5783166253556177429,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,14625379283877832606,5783166253556177429,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14625379283877832606,5783166253556177429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,14625379283877832606,5783166253556177429,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,14625379283877832606,5783166253556177429,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9527a4140125d142faa3d227b2ab7f44

SHA1
36d89b5a63856884d8a836001a1628059397dd62

SHA256
4ead559556af9f2db1b4031423fa63506413a35bf85f461e2a9d9b071f8c7b14

SHA512
06a625d5f7035f9d9c9c8f12a5d399d603d5c20e1e63733919b75a86227f615dbc8f90a1f90ad074e854184fa48fd165f0df58ee31cd031ee78ac0ddd160774a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
62cc2661a967541c6a3d540477240bab

SHA1
7d60051463d7d806ba4cba6f6a83c68ad68a610d

SHA256
327c9629796851ff1120021b90ffbf9a6677d31e57376101896040acbe3a1e68

SHA512
407736d9ed8d81335b8f9d41059b9a7b0ad37adb810ed48f974fc02e4f07d919e892793ca84bc4948ce32b102d3b8bed18f7876434d16aab1bd7570474728b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d1747ec2c47d28abd876ad6398d01f49

SHA1
bcc7d80a85c559e1d19ebe7151dd3c7b091d36cd

SHA256
fd4052e36db87f8a3cfbb7677a9e7995cce5d51c06fe5a51e449b1de48b9d0db

SHA512
4c62d20e64b5cca023229668330aa5a51a59d60c438f58b77b8d2d6fd9ad26094e846d460806e3a8ec9b7a11198f79639036197ede75ea573a28e4eb438f6c81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9ac6257fe5deb69bfd6efbe9e66449e9

SHA1
3b5333d7d98fd417eb22299eaa256945ce21b154

SHA256
84562ab14123f8ea50732613cd2b1eaa4616d5c235f4eae6aab5b4ac62eac876

SHA512
26297e5bc99e1b446e200242043fb597ba2d251575a76291525b17e42a5c2c38158b905a7f563199ba73ba024ecd5025055ed3ad0fb84ad68e0cfe9218c28267

Download Submit