63368d9077617b0f16c13de6377840e3cb6263405e19589b894a45bddc5809c0

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2024 16:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c121ca6059a4d0939fc4c8d2c0f80231_JaffaCakes118.html
Size

154KB
MD5

c121ca6059a4d0939fc4c8d2c0f80231
SHA1

0329e95c43a57bef0b600a9c9525065a5a9bacba
SHA256

63368d9077617b0f16c13de6377840e3cb6263405e19589b894a45bddc5809c0
SHA512

e6f4f51bfc27bacce4c55348abe745e7495327f6b07ec1e96ffaf7f81a812829d867ada38c115b50c4e09382be278dfeab281474062ddf4134a4e0c971c6b163
SSDEEP

3072:PBw89k0wEJtI4tHZBJFWI6XsMxhJlldCci:2z7hz8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3156	msedge.exe
3156	msedge.exe
4900	msedge.exe
4900	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 4288	4900	msedge.exe	84
PID 4900 wrote to memory of 4288	4900	msedge.exe	84
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 2616	4900	msedge.exe	85
PID 4900 wrote to memory of 3156	4900	msedge.exe	86
PID 4900 wrote to memory of 3156	4900	msedge.exe	86
PID 4900 wrote to memory of 1152	4900	msedge.exe	87
PID 4900 wrote to memory of 1152	4900	msedge.exe	87
PID 4900 wrote to memory of 1152	4900	msedge.exe	87
PID 4900 wrote to memory of 1152	4900	msedge.exe	87
PID 4900 wrote to memory of 1152	4900	msedge.exe	87
PID 4900 wrote to memory of 1152	4900	msedge.exe	87
PID 4900 wrote to memory of 1152	4900	msedge.exe	87
PID 4900 wrote to memory of 1152	4900	msedge.exe	87
PID 4900 wrote to memory of 1152	4900	msedge.exe	87
PID 4900 wrote to memory of 1152	4900	msedge.exe	87
PID 4900 wrote to memory of 1152	4900	msedge.exe	87
PID 4900 wrote to memory of 1152	4900	msedge.exe	87
PID 4900 wrote to memory of 1152	4900	msedge.exe	87
PID 4900 wrote to memory of 1152	4900	msedge.exe	87
PID 4900 wrote to memory of 1152	4900	msedge.exe	87
PID 4900 wrote to memory of 1152	4900	msedge.exe	87
PID 4900 wrote to memory of 1152	4900	msedge.exe	87
PID 4900 wrote to memory of 1152	4900	msedge.exe	87
PID 4900 wrote to memory of 1152	4900	msedge.exe	87
PID 4900 wrote to memory of 1152	4900	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c121ca6059a4d0939fc4c8d2c0f80231_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc07546f8,0x7ffcc0754708,0x7ffcc0754718
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,18293742907381465702,9129175999348559956,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,18293742907381465702,9129175999348559956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,18293742907381465702,9129175999348559956,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18293742907381465702,9129175999348559956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18293742907381465702,9129175999348559956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,18293742907381465702,9129175999348559956,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
867B

MD5
bce359c7c7eb6b77b590d3cf3657bef1

SHA1
1b9d7ef0b75b496a6c0869b5e5a20c7b26e5bb3a

SHA256
5081f387bbf228061e7b6e69421bd75781095cd6ad65bf9da2fa5edd7d9de851

SHA512
c94d95a87d3a60a8ddfc2a0ff9a90ca8d3c866322a61806426989de7b282cc364e71e79abcc9ad21cd054da459cf8a772fb2872424c02b3ce0d99a9fec9c4dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4592cc1049db7c01bd3d7162c6d113bd

SHA1
4b3d36ff5f18eb6d0ad18916d84471ace34366ef

SHA256
aec2b2ed238fc2f90f53f69ffb5cf05b5a5fbc17f0218ed769ec492c6cf5e3eb

SHA512
c344cd7dad40c5bff40576483c948e91586f7424e7b200d7cdac0ab9fbfcfbfa11776c52d9c5aa28c573bc3ba5d95204d5ee787f17d12e2a900c8af8a8d23c9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dd967263-1b29-4946-b134-c8c7b4956af3.tmp

Filesize
5KB

MD5
db65c8bda5fcdf443d4e05452ef9e107

SHA1
4dee6fcc165473f9ea22b5cd968bff7c2e9c42e9

SHA256
a63647e12dce0b41c4db4921c1b5dc79594c122278a13652feddd9748a115ed9

SHA512
3578d3089070709b571ccd32905d97219f3cde463f6b3f70b45a22d7e47342014a0a974455e78ba48dd607952bffaef5f4dd55965a0290173205e72ab8307248

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2e78329aed1f2d43e8a42ec51a71a51b

SHA1
ce44e7945f4f8f95d6ab8b7433e772cab5b43d1b

SHA256
f41c16429c57dae42e62ea3531485e075f2c244a80352bf067063e866cbfe66f

SHA512
c071cb20f6ffd60656ecd0bc5219fd87d891cd0d0a20bd1d38f7fdc60dcf4211648e06891c3f5a797879496e8a6cea3ad351c89d5959d15ddec7ca619c4a360f

Download Submit