ae5618ac201585131ea645d927567e71a4b688d76dd5f855623b75f02977595d

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
27e5b6662abdb7e727a35b85c8317699_JaffaCakes118.html
Size 214KB
Sample241009-a2gtfayepd
SHA256 ae5618ac201585131ea645d927567e71a4b688d76dd5f855623b75f02977595d
MD5 27e5b6662abdb7e727a35b85c8317699
SHA1 a8745f68c05f6fa84b1778b002ae468494a2e769
SHA512 e44dd40a8274e51d59636b285dca8807e46818388d8889fe7f1946aeb88cb640c9a68ea2fc518b4727635fcbcd32436f0e69d980ad3345b39ed8c19018b8a04c
SSDEEP 3072:OrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJL8:2z9VxLY7iAVLTBQJlL8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3116	msedge.exe
3116	msedge.exe
4640	msedge.exe
4640	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 3620	4640	msedge.exe	83
PID 4640 wrote to memory of 3620	4640	msedge.exe	83
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 840	4640	msedge.exe	85
PID 4640 wrote to memory of 3116	4640	msedge.exe	86
PID 4640 wrote to memory of 3116	4640	msedge.exe	86
PID 4640 wrote to memory of 2644	4640	msedge.exe	87
PID 4640 wrote to memory of 2644	4640	msedge.exe	87
PID 4640 wrote to memory of 2644	4640	msedge.exe	87
PID 4640 wrote to memory of 2644	4640	msedge.exe	87
PID 4640 wrote to memory of 2644	4640	msedge.exe	87
PID 4640 wrote to memory of 2644	4640	msedge.exe	87
PID 4640 wrote to memory of 2644	4640	msedge.exe	87
PID 4640 wrote to memory of 2644	4640	msedge.exe	87
PID 4640 wrote to memory of 2644	4640	msedge.exe	87
PID 4640 wrote to memory of 2644	4640	msedge.exe	87
PID 4640 wrote to memory of 2644	4640	msedge.exe	87
PID 4640 wrote to memory of 2644	4640	msedge.exe	87
PID 4640 wrote to memory of 2644	4640	msedge.exe	87
PID 4640 wrote to memory of 2644	4640	msedge.exe	87
PID 4640 wrote to memory of 2644	4640	msedge.exe	87
PID 4640 wrote to memory of 2644	4640	msedge.exe	87
PID 4640 wrote to memory of 2644	4640	msedge.exe	87
PID 4640 wrote to memory of 2644	4640	msedge.exe	87
PID 4640 wrote to memory of 2644	4640	msedge.exe	87
PID 4640 wrote to memory of 2644	4640	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\27e5b6662abdb7e727a35b85c8317699_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc27df46f8,0x7ffc27df4708,0x7ffc27df4718
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,9258636721569981312,7613266635034660698,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,9258636721569981312,7613266635034660698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,9258636721569981312,7613266635034660698,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9258636721569981312,7613266635034660698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,9258636721569981312,7613266635034660698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,9258636721569981312,7613266635034660698,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4976 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
MD5 d7cb450b1315c63b1d5d89d98ba22da5
SHA1 694005cd9e1a4c54e0b83d0598a8a0c089df1556
SHA512 df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
MD5 37f660dd4b6ddf23bc37f5c823d1c33a
SHA1 1c35538aa307a3e09d15519df6ace99674ae428b
SHA512 807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 62d0f4a0fb2d9c9d23c7add4e1f875a632d73a441bb2605fe8b26f914ae1b459
MD5 1fb76682f348fd07c5d3e659baf9f2e0
SHA1 968cc44f0c017bb943150f8386bd7ec784540518
SHA512 0b56531d7bb6a948fcfa33498d45548d747b6c79884e08d60a8e14de7d97ca192be058ba27dd2bc4d27b7fdda5a03168fa9f7330d9cba2296c0da6b34ee23c45
SSDEEP 96:npkV041M5ThwpvWMoiVmdeHqZjOS+UWQyV+VDCziEwb:npkvGJhGWMXEOS+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 84ebb6b65a04884f2741fa18d47f69a83a695c511be8bcb6150daef01e56e0f5
MD5 2b483684664ca90aef4e7ee97376cb6d
SHA1 fe3aa2c71f18652feca2e984c488f3a7f5a181c5
SHA512 5616f8bbf15dac52816703f62249e93dc534ff6376b35481cfeae710303f35a324dc38731e6de7f9760d63b4f24105e0a370111b60e62760f18ad2b70186acd2
SSDEEP 96:npkw041M5TowpvWMoiVmdeumqqZjOS+UWQyV+VDCAiEwb:npk8GJoGWMemqEOS+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5c8ff2855afd6cfc30de1f42fa956db219446812e4a544f977d816d2547046fe
MD5 e97e59a2df5fc4f296c1ddbe010c7d82
SHA1 598dac343bc84c65bcf1efcb2cbfe3203b501400
SHA512 c382e938f6474f05fc607cdbb60c2a776075813134b404a7745a12c8389c693bf767d5dfcb717315ec0e576327f53b2358f9fcb1eaec4fc076e4c15549c9d78b
SSDEEP 96:npkw041M5ThwpvWMoiVmdeumqqZjOS+UWQyV+VDCAiEwb:npk8GJhGWMemqEOS+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 d3d46fd80a2787abe11f3c60c2c6a9b1f5fadac22de292849f48019ba0d89dbd
MD5 9f56990454be93bada28ecf07bbab20f
SHA1 61740d9ee5e3fad00201def05289412c7602677d
SHA512 282fc1783ca6a1f4fd1b687eaa6660c58859c3db330c0cfaae2093cd5d5dffcaf0f678a030239bebab7fe8c54e78585fbdc03ef7fca17d4da2cbd8a6deaa283f
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuphWWdNe2RU1emSF6+B1E8Ja:A9iIxuERzA83h09RZxYhWeVp3bEUzu
MD5 SHA1 SHA512 SSDEEP

Submit Download