dd8837761cfaff055437d7f2f5caa9787e20ab087dcc84ace8af06a06d1d4dc9

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2024, 03:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

45879a34394329d19b9f3e8c274be7cb_JaffaCakes118.html
Size

18KB
MD5

45879a34394329d19b9f3e8c274be7cb
SHA1

7609883b6c060c8e731da25b2c229112d2fabeb5
SHA256

dd8837761cfaff055437d7f2f5caa9787e20ab087dcc84ace8af06a06d1d4dc9
SHA512

2c99c15b7699f387cb263e40e600a35dba263583eba476a59ac211affe353519feacba7848e4ebe0e2a19fb1f3609619502ab7461f6df025f35ed53a76612368
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIj4JzUnjBhrd82qDB8:SIMd0I5nvH1svrGxDB8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
400	msedge.exe
400	msedge.exe
1872	msedge.exe
1872	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1872	msedge.exe
1872	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe
1872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2968	1872	msedge.exe	84
PID 1872 wrote to memory of 2968	1872	msedge.exe	84
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 4968	1872	msedge.exe	85
PID 1872 wrote to memory of 400	1872	msedge.exe	86
PID 1872 wrote to memory of 400	1872	msedge.exe	86
PID 1872 wrote to memory of 3688	1872	msedge.exe	87
PID 1872 wrote to memory of 3688	1872	msedge.exe	87
PID 1872 wrote to memory of 3688	1872	msedge.exe	87
PID 1872 wrote to memory of 3688	1872	msedge.exe	87
PID 1872 wrote to memory of 3688	1872	msedge.exe	87
PID 1872 wrote to memory of 3688	1872	msedge.exe	87
PID 1872 wrote to memory of 3688	1872	msedge.exe	87
PID 1872 wrote to memory of 3688	1872	msedge.exe	87
PID 1872 wrote to memory of 3688	1872	msedge.exe	87
PID 1872 wrote to memory of 3688	1872	msedge.exe	87
PID 1872 wrote to memory of 3688	1872	msedge.exe	87
PID 1872 wrote to memory of 3688	1872	msedge.exe	87
PID 1872 wrote to memory of 3688	1872	msedge.exe	87
PID 1872 wrote to memory of 3688	1872	msedge.exe	87
PID 1872 wrote to memory of 3688	1872	msedge.exe	87
PID 1872 wrote to memory of 3688	1872	msedge.exe	87
PID 1872 wrote to memory of 3688	1872	msedge.exe	87
PID 1872 wrote to memory of 3688	1872	msedge.exe	87
PID 1872 wrote to memory of 3688	1872	msedge.exe	87
PID 1872 wrote to memory of 3688	1872	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\45879a34394329d19b9f3e8c274be7cb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec7b046f8,0x7ffec7b04708,0x7ffec7b04718
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,13957137521305944926,6357439235452836205,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,13957137521305944926,6357439235452836205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,13957137521305944926,6357439235452836205,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,13957137521305944926,6357439235452836205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,13957137521305944926,6357439235452836205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,13957137521305944926,6357439235452836205,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
80e4350752ef60dee48074aff47205df

SHA1
943538d6b2937da47c4ed9e28031ec31b61b90a1

SHA256
e83f359ba8adde9c87dbf770714a92929d1f9ba76356302c25aee16a3f35293a

SHA512
b9f02d68560ebf32ff6c0b5be9985f98ef9a8aa039c454f8c8fd36f35d3cf8cff65e08ced68e3435c2f0f21d9ce3865d1506f28ca8d228b7e7f5e1ef147bce21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a03bfd3fe15aff876959c5c29a227268

SHA1
279ba2c5d073160cf1919984c98db228d15c7ae3

SHA256
6e4d083e529e139a89cc5e2e0284cdfeb02540c4898de1f8f8bafba1abb46651

SHA512
957142ccd5a565ef206df0fa3d2b86866bcb11918ec8e9bc68c404b3edfadfcf4a897e156f884222ee8e6592bc2e6ae57120790bff448cd7eeb3f31df114a060

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3e4f6b1cb0f7c846aacbd4e514db0d44

SHA1
47642c02fe212d640c01beac63e1334510bfa61b

SHA256
28e368b9c8fe0332b50be254bd25ebcc8f38f215076911f72f75a29f7d57622a

SHA512
214b8ee7b1dc0af64a8639b1f238ee69037c05669785f14b49af3a2f40fc933e43f9cdb9cade25c1936fe24e6ced4af120a3ad2ff385148cc6b940e7217101b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
787cc92779c64c069f678985d81465ab

SHA1
b0b6e091654bb12bb2cb99ce1a7e370dc16fc008

SHA256
19af89ddf5670990279068255363f5d606ce5ffb5b832e892492f5d1584d2d9d

SHA512
f7c76778793b20d7461a994c1369225c8981b0d3cbdb560903c9606d1f70b1f0984fbe38c5e862ba54bf4775f991969499fcef483e449f5a4026042fbdb4124d

Download Submit