97e74046b642df7b700ac1a6c960fa59728182c2e222f74be92f82fa53147c5e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 19:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
14bad8780fc8b7e4e7aa91c6e34717e0_JaffaCakes118.html
Size 159KB
Sample241004-ynrngstapp
SHA256 97e74046b642df7b700ac1a6c960fa59728182c2e222f74be92f82fa53147c5e
MD5 14bad8780fc8b7e4e7aa91c6e34717e0
SHA1 2e76c707394a18a78217e14e833052426ff715ba
SHA512 6c87a386b3e0c4a9fa5af60f21cb83a6c560c888a1fef31626b37ccca02d6c032187721467217a62d625fea8ecf28da92f0e72017a302f44c24d035ccf488ebe
SSDEEP 1536:imRTlme8iI06fjLhfhB+yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09wee:iMYrXhfmyfkMY+BES09JXAnyrZalI+YQ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
2296	msedge.exe
2296	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4052	msedge.exe
4324	identity_helper.exe
4324	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 3020	2296	msedge.exe	82
PID 2296 wrote to memory of 3020	2296	msedge.exe	82
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 5048	2296	msedge.exe	83
PID 2296 wrote to memory of 4528	2296	msedge.exe	84
PID 2296 wrote to memory of 4528	2296	msedge.exe	84
PID 2296 wrote to memory of 2952	2296	msedge.exe	85
PID 2296 wrote to memory of 2952	2296	msedge.exe	85
PID 2296 wrote to memory of 2952	2296	msedge.exe	85
PID 2296 wrote to memory of 2952	2296	msedge.exe	85
PID 2296 wrote to memory of 2952	2296	msedge.exe	85
PID 2296 wrote to memory of 2952	2296	msedge.exe	85
PID 2296 wrote to memory of 2952	2296	msedge.exe	85
PID 2296 wrote to memory of 2952	2296	msedge.exe	85
PID 2296 wrote to memory of 2952	2296	msedge.exe	85
PID 2296 wrote to memory of 2952	2296	msedge.exe	85
PID 2296 wrote to memory of 2952	2296	msedge.exe	85
PID 2296 wrote to memory of 2952	2296	msedge.exe	85
PID 2296 wrote to memory of 2952	2296	msedge.exe	85
PID 2296 wrote to memory of 2952	2296	msedge.exe	85
PID 2296 wrote to memory of 2952	2296	msedge.exe	85
PID 2296 wrote to memory of 2952	2296	msedge.exe	85
PID 2296 wrote to memory of 2952	2296	msedge.exe	85
PID 2296 wrote to memory of 2952	2296	msedge.exe	85
PID 2296 wrote to memory of 2952	2296	msedge.exe	85
PID 2296 wrote to memory of 2952	2296	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\14bad8780fc8b7e4e7aa91c6e34717e0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7b6546f8,0x7ffa7b654708,0x7ffa7b654718
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,17979559233557918281,7282692105451757418,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,17979559233557918281,7282692105451757418,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,17979559233557918281,7282692105451757418,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,17979559233557918281,7282692105451757418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,17979559233557918281,7282692105451757418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,17979559233557918281,7282692105451757418,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,17979559233557918281,7282692105451757418,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,17979559233557918281,7282692105451757418,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,17979559233557918281,7282692105451757418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,17979559233557918281,7282692105451757418,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,17979559233557918281,7282692105451757418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,17979559233557918281,7282692105451757418,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:3356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4
MD5 9e3fc58a8fb86c93d19e1500b873ef6f
SHA1 c6aae5f4e26f5570db5e14bba8d5061867a33b56
SHA512 e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de
MD5 27304926d60324abe74d7a4b571c35ea
SHA1 78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1
SHA512 f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd
MD5 SHA1 SHA512

Submit Download

33506f3c-7602-46ec-9a5c-41548acb14db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\33506f3c-7602-46ec-9a5c-41548acb14db.tmp
Size 6KB
SHA256 e0b22ebc9220840e54a677030ad5d7ee7ba85890a2d6789c151b3e2e723d951b
MD5 0a0a5ad55eb0b9e22f171c69ff745ca0
SHA1 def1e39b1aaab9bfc31d070690cf88148b50d2e6
SHA512 f873dd18284c26179c576344cd6d7e2ff0cf99957a7e757535eef615c97f53c8f64a5358615beb5b8ef49052ee6acdcb8a0e804bae5f7338bd303a8d038948df
SSDEEP 96:ndk/Tn1ZowpvWMoiVmdeH4piNZiUWQyV+VDCAiEwb:ndk/TnoGWMX4k3irV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 1614fb6274a2570ed29fd3eb878506cd715918b78c661f47b90a2cd79d412de5
MD5 834668db0f13b903279e7b0593b7b256
SHA1 0ebeac7c40fa4a0fc6d708ee38a62fd13589d464
SHA512 90580898ab05d23dfc783bf52225f9a2ba8b0f475a9d36439c869ba29be7bf20bb1ad38818da208bddd2c6dd1f5f1c1733b79ed083b092e9dc7145606f23392b
SSDEEP 96:ndk/zn1ZpwpvWMoiVmdeH4piNZiUWQyV+VDCziEwb:ndk/znpGWMX4k3iro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 56c24947bbfe41507123ef86bc9a470f42a8bf170124700116e7b367a0c99002
MD5 c74c4504950e784de80137a8ef4cdb8b
SHA1 b34d79173a2ecc55c75b90db1b313ac14b10040a
SHA512 a86696d2b19b6626806fd2ff2bef9dd8105993474fa88dc1bc2771725a2d752befb761a54094e78a0047d6e0fbd8fe005da4e90a462ba3cdab8fc95bf3b0edf8
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupzTe2RUXc8pKIcM/bo5Zxx:A9iIxuERzA83h09RZxYzDApjqZxx
MD5 SHA1 SHA512 SSDEEP

Submit Download