16c5d7031971990c10874f40a8efc5d556cd959f2da3d1759f02737b394c317a

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8a4e6feda9d7e5b88cb59373938d0de3_JaffaCakes118.html
Size

127KB
MD5

8a4e6feda9d7e5b88cb59373938d0de3
SHA1

8bf6aa075f4d229c07526f4049b185f0a22ff51b
SHA256

16c5d7031971990c10874f40a8efc5d556cd959f2da3d1759f02737b394c317a
SHA512

cffed1256ed0abdfcfa81812adfd9104077e1da6dad9b653b799de41958b9b890eaab17c102e675f727e3f09ac93cc3cafb8f2a7ef80944f5686fff959abf067
SSDEEP

3072:Q/uhCZNcit4bdLDI93oO8a3T8GxDy+IXlpOi7x5WOZxI:5XO8JxI

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
1084	msedge.exe
1084	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1084	msedge.exe
1084	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 4080	1084	msedge.exe	83
PID 1084 wrote to memory of 4080	1084	msedge.exe	83
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 1716	1084	msedge.exe	84
PID 1084 wrote to memory of 4628	1084	msedge.exe	85
PID 1084 wrote to memory of 4628	1084	msedge.exe	85
PID 1084 wrote to memory of 2096	1084	msedge.exe	86
PID 1084 wrote to memory of 2096	1084	msedge.exe	86
PID 1084 wrote to memory of 2096	1084	msedge.exe	86
PID 1084 wrote to memory of 2096	1084	msedge.exe	86
PID 1084 wrote to memory of 2096	1084	msedge.exe	86
PID 1084 wrote to memory of 2096	1084	msedge.exe	86
PID 1084 wrote to memory of 2096	1084	msedge.exe	86
PID 1084 wrote to memory of 2096	1084	msedge.exe	86
PID 1084 wrote to memory of 2096	1084	msedge.exe	86
PID 1084 wrote to memory of 2096	1084	msedge.exe	86
PID 1084 wrote to memory of 2096	1084	msedge.exe	86
PID 1084 wrote to memory of 2096	1084	msedge.exe	86
PID 1084 wrote to memory of 2096	1084	msedge.exe	86
PID 1084 wrote to memory of 2096	1084	msedge.exe	86
PID 1084 wrote to memory of 2096	1084	msedge.exe	86
PID 1084 wrote to memory of 2096	1084	msedge.exe	86
PID 1084 wrote to memory of 2096	1084	msedge.exe	86
PID 1084 wrote to memory of 2096	1084	msedge.exe	86
PID 1084 wrote to memory of 2096	1084	msedge.exe	86
PID 1084 wrote to memory of 2096	1084	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8a4e6feda9d7e5b88cb59373938d0de3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd65d46f8,0x7ffbd65d4708,0x7ffbd65d4718
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,16131692854232523481,11080331061764348803,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,16131692854232523481,11080331061764348803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,16131692854232523481,11080331061764348803,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16131692854232523481,11080331061764348803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16131692854232523481,11080331061764348803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,16131692854232523481,11080331061764348803,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
473B

MD5
1d2b7324cdfdf0b38fbb5414f0d4b25a

SHA1
f9232eb42a68a9e059e1077d90ff969b775e2eb5

SHA256
04f3970a4d90a4a3b53ba33a66d56f390d5d9a101c9eb0dff9d071ccd12d7033

SHA512
c5e727c245003e61e15f145a86f3e32669d5d02f155f8ff56a3ccf4ff92b021fd42c217fd066d5b3d579cd980ed117ed5956830aadaffd7a6c1d423843fdef7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
66ba8d87c149d1b6ecde22199d3a7b60

SHA1
fe5f6c07c1a9a3b99fd31a7f6e10b130efdc7215

SHA256
4068f78bc589b37a750af6f7755bf2adfd3a259e191788c67b444fe8e26a85e5

SHA512
61749e807e387510aefcbb75bfea1fcdc63fe55d0efcfdd62e25e0670f7556b18330279359e0a1457a96def63a1ba05774794a6af81703c812d03f7bc06b98c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8a92a482333913f9fc3f570bf7f862af

SHA1
e7e1a40a227f5b448511ec6a2f004c0468af12a0

SHA256
2b0393f5aa1aa3a4d1ecc0714c1d40f53caf5ea265ae0922a6a125555822a272

SHA512
dd11f2c8a649f8aad234a436acf28ea6850382b1c153347047a73a0d70358496898a6877a84e970c25f7b1a042c6a25df48c3272e73ed1f28eb6ba4f8cfb8fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a393f233-97e9-4ff2-b7df-1286b66e919c.tmp

Filesize
10KB

MD5
dcac79fb1e6687d7636b94ebbd7b5778

SHA1
05aab4df244dc923009c6048bbe154eebe89d1d2

SHA256
90acecb654e278cf150cc4b5cb9d246c63a34c7d8a4753471fd22624218ddd4c

SHA512
ae46d7e681d6f70ece3c7c177ae6b5eb3282d7026afbd2fe36b970333e0c9416e4cb04d60f90a98f10c3b7ee6db1ab8bcd0da368b1ab8590aa27e3b94a6f22d1

Download Submit