99aefbacfb57eac786c286d81649bb69d4936e53bf07483303528bd6ce58b71a

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2024 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9e74bf9d36865c9976e974e75c6bc2a_JaffaCakes118.html
Size

62KB
MD5

e9e74bf9d36865c9976e974e75c6bc2a
SHA1

dd3084b063678b3ab1f8fe34cce2a1141b5bbd53
SHA256

99aefbacfb57eac786c286d81649bb69d4936e53bf07483303528bd6ce58b71a
SHA512

6a06a3c4b021e31c98b6088d1cb9db52caec0b261de15a9139beadac2f26cb8655161636398e8746d5f1042ccb25e87f6fe30840eec8966027c8710cd32af3c2
SSDEEP

384:gSARcqYivcCRkzVS+Gug64vaiq8pHY+wlnVdL55m2OY+wlRVdL1t8O4ggRRNANFM:RA/Yivc6a3iwmwZbTKutJAaJbqDvmu

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
384	msedge.exe
384	msedge.exe
4900	msedge.exe
4900	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 4868	4900	msedge.exe	82
PID 4900 wrote to memory of 4868	4900	msedge.exe	82
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 1092	4900	msedge.exe	83
PID 4900 wrote to memory of 384	4900	msedge.exe	84
PID 4900 wrote to memory of 384	4900	msedge.exe	84
PID 4900 wrote to memory of 4524	4900	msedge.exe	85
PID 4900 wrote to memory of 4524	4900	msedge.exe	85
PID 4900 wrote to memory of 4524	4900	msedge.exe	85
PID 4900 wrote to memory of 4524	4900	msedge.exe	85
PID 4900 wrote to memory of 4524	4900	msedge.exe	85
PID 4900 wrote to memory of 4524	4900	msedge.exe	85
PID 4900 wrote to memory of 4524	4900	msedge.exe	85
PID 4900 wrote to memory of 4524	4900	msedge.exe	85
PID 4900 wrote to memory of 4524	4900	msedge.exe	85
PID 4900 wrote to memory of 4524	4900	msedge.exe	85
PID 4900 wrote to memory of 4524	4900	msedge.exe	85
PID 4900 wrote to memory of 4524	4900	msedge.exe	85
PID 4900 wrote to memory of 4524	4900	msedge.exe	85
PID 4900 wrote to memory of 4524	4900	msedge.exe	85
PID 4900 wrote to memory of 4524	4900	msedge.exe	85
PID 4900 wrote to memory of 4524	4900	msedge.exe	85
PID 4900 wrote to memory of 4524	4900	msedge.exe	85
PID 4900 wrote to memory of 4524	4900	msedge.exe	85
PID 4900 wrote to memory of 4524	4900	msedge.exe	85
PID 4900 wrote to memory of 4524	4900	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e9e74bf9d36865c9976e974e75c6bc2a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8af5e46f8,0x7ff8af5e4708,0x7ff8af5e4718
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16955035128163841434,8290593503197447532,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,16955035128163841434,8290593503197447532,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,16955035128163841434,8290593503197447532,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16955035128163841434,8290593503197447532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16955035128163841434,8290593503197447532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16955035128163841434,8290593503197447532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1720 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16955035128163841434,8290593503197447532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16955035128163841434,8290593503197447532,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3036 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
b76d7cd52ed6cbbea553bd51a0e802f8

SHA1
db278e7a9133e6b7068f0e49984ce76f8a8a7b2e

SHA256
06131e2f79c8069dea974db00705c27aa6ce8768a1a9db82e9c211eb887b1c1d

SHA512
c53c96cea8245e2fafb3ec12b57897068d10243162b97659f5668800a01312f074ef933de31989e5e4b1c04a1f009c1e57767acbd4676f369f6f8f2c76f9c400

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3946f7021a53498c7e42e7003ea2020a

SHA1
4b05190da34b2c2f5ecfb5b60330c20f826cc9c2

SHA256
e372d3741adfd87ea23534629efdf3aba75d20245edb8910256627cb5b873fd9

SHA512
4064617c17d7e3a1c8965011b619af775bf070a2ce37413be14f7196732fdc820fd9a6bcf3f1158fe5b9334a13388089bd27b301c201ab22d15564acfcdff1e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e3f539c480aa17dc9344da7187f2e664

SHA1
a892f8ace3a440b213f389a2cffefda078c5f127

SHA256
2572bfb22d02060f25e9e43b723939ef9d9f514f1979e8af8d9f675779f71087

SHA512
f0639296055492f3545bec8a371f82bc969b9210745535817c2f257fde4a9ff6ba76ba3c8c1d38713447d8d4c18c36027a6086c3a2ac9de93dc71e8570743975

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8fc67f5e360d0aef2a7e38afd44b37fc

SHA1
26302e0ca6a8178c1f9542ea364745e933f9b4a9

SHA256
58a946814b7a5ec48a7cbdc9e3809d8188ff3b68220f29920d96989a8c7c3a5f

SHA512
c25268f080fcf40d068f938986e4a8421297b2fe34bc9a49ed9cb80c147ebc9c7707a17c250c057fe93c5d10dce025c4ec97d9c5bb558fe736def96b5ddcc333

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
918143ec85de4baee18b9b25fb53d228

SHA1
31298f5c1c3c1620d44894c0bea02e189f399c8f

SHA256
f5b1b8c2a0bbe1457a9aae63b2c029ec5c13a3ac82aef759051d3ed8640c44fd

SHA512
49347014a5c8b6ee1ec12e8d1b1d88c624cbcf16aee2283161a70a3d05f367a69507d98a30dbc7fb42ca3eeccb81f7e84d9d72fdf93398f208ae4531b784d603

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9519870f38b6f5586e0112473d5a01c8

SHA1
63ae0763e51204b64031f4a23336e2767223c1c4

SHA256
ef615dad81d4ad3377a1dfe008faaaa28189e2aea767f362a8ecfe8e77ebc210

SHA512
c7a2ff364331ead2de1bb38979783348c46752f01d5013a891997e85c0617a36ae222fd599d8eadfe1c1882e2b015c832375fff3724a0303fcac6f3e4c83fae8

Download Submit