36a02a15e3157c1034cb21be662d9526b678cdd7b83d9ba822aa50b4ec155217

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2024 20:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c18f4c8b34eeb3e2d429fec365c13289_JaffaCakes118.html
Size

233KB
MD5

c18f4c8b34eeb3e2d429fec365c13289
SHA1

363ab7e2fef3c71aff0cd65c5ea26326a860640d
SHA256

36a02a15e3157c1034cb21be662d9526b678cdd7b83d9ba822aa50b4ec155217
SHA512

f7ceb48317c79dacdede56085b54be87c288855b35bfdacf6a3abe2e11293a00d19cdc7b90d27e7593fa5c9ef8334ceedf65a02ac88c832d1122cd685372b9ac
SSDEEP

6144:S4yBGBFBQBeB2BBFqJjxBIa5IVz7ESXXDyJuC/9P:vyBGBFBQBeB2Br+mzlyNt

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
716	msedge.exe
716	msedge.exe
4372	msedge.exe
4372	msedge.exe
4864	identity_helper.exe
4864	identity_helper.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 4204	4372	msedge.exe	86
PID 4372 wrote to memory of 4204	4372	msedge.exe	86
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 4820	4372	msedge.exe	87
PID 4372 wrote to memory of 716	4372	msedge.exe	88
PID 4372 wrote to memory of 716	4372	msedge.exe	88
PID 4372 wrote to memory of 3236	4372	msedge.exe	89
PID 4372 wrote to memory of 3236	4372	msedge.exe	89
PID 4372 wrote to memory of 3236	4372	msedge.exe	89
PID 4372 wrote to memory of 3236	4372	msedge.exe	89
PID 4372 wrote to memory of 3236	4372	msedge.exe	89
PID 4372 wrote to memory of 3236	4372	msedge.exe	89
PID 4372 wrote to memory of 3236	4372	msedge.exe	89
PID 4372 wrote to memory of 3236	4372	msedge.exe	89
PID 4372 wrote to memory of 3236	4372	msedge.exe	89
PID 4372 wrote to memory of 3236	4372	msedge.exe	89
PID 4372 wrote to memory of 3236	4372	msedge.exe	89
PID 4372 wrote to memory of 3236	4372	msedge.exe	89
PID 4372 wrote to memory of 3236	4372	msedge.exe	89
PID 4372 wrote to memory of 3236	4372	msedge.exe	89
PID 4372 wrote to memory of 3236	4372	msedge.exe	89
PID 4372 wrote to memory of 3236	4372	msedge.exe	89
PID 4372 wrote to memory of 3236	4372	msedge.exe	89
PID 4372 wrote to memory of 3236	4372	msedge.exe	89
PID 4372 wrote to memory of 3236	4372	msedge.exe	89
PID 4372 wrote to memory of 3236	4372	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c18f4c8b34eeb3e2d429fec365c13289_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82b2d46f8,0x7ff82b2d4708,0x7ff82b2d4718
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,4186602146236673435,12516974108066889214,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2256,4186602146236673435,12516974108066889214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2256,4186602146236673435,12516974108066889214,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,4186602146236673435,12516974108066889214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,4186602146236673435,12516974108066889214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,4186602146236673435,12516974108066889214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,4186602146236673435,12516974108066889214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2256,4186602146236673435,12516974108066889214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2256,4186602146236673435,12516974108066889214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,4186602146236673435,12516974108066889214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,4186602146236673435,12516974108066889214,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,4186602146236673435,12516974108066889214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,4186602146236673435,12516974108066889214,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,4186602146236673435,12516974108066889214,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
741B

MD5
b53ee6db78d646c5c5485fa98e417ff2

SHA1
7530d0a23d811b278effa5e435e536ebda076866

SHA256
483c19324fbbd64a48839a52012332d8668a77dbb452ad72041f760a686cdf44

SHA512
1e4b15dab99fcab10fa6bd0316cebf54abbd59e210789e0d319b9b9ae2dc52fd12018d3b3539887e6adcd71668282c714594467addf2f7e36154f0a54aa803d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c2082afd82163407a6db92c85db1609b

SHA1
de2c872f79a5afd3d36ea88215c19eab4abe77d4

SHA256
06a78e711d07e48e5cbdb6e433dc99e69ecf6e4866be3cea2d85edacdb31e565

SHA512
a0dc3ecff9e3ddfe717bbf65c0e776f1f744c744aa54315f19a2bc3b762526306013d0d6392190173e51fe95405216ad6820b8ade87e6a8c9634e3a150b1cbc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
298b415bc7800f8ed23c23d8cf135693

SHA1
e042f20d153fbe500be89a3e008d9fae8c33dc34

SHA256
a20bce910e2633640a7bfa3d80596645a1a91b20b4a15f161354d10352876074

SHA512
f6b5987311b2bb9d0a10e65244a73297adc796a92406c0abbdfe7e3e0c60c19161a4373805deb570affa11f68066d275bb8a11936e790c61c84c9c6ae2e9354a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3258824e8d4de15e53b18a847fc66768

SHA1
c42417e3f32a1f860e45a459083f449e60b0e1f7

SHA256
ae81dc0e8682a4ec760922c55861bb54210ab92d7a10fa98ae61ab45858b57c2

SHA512
3b8f5c4ff80a9fc77f513781b9ce4af0c38f0431e7608e114cf42d4e197b180432469a676b2741fe71afa2ffd58a73e1a9b07616ffb308b5797d7a6bba7e7458

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f8fee0430ffbf54ed68b8564e7b37911

SHA1
d83011eea7465153be461bdf44e7b1f48bb138c5

SHA256
42606d888961cfae751852ffad1e96db8d32af026b13dfd71c31a6e28814a175

SHA512
f13fa9255655b1f8213a5c6f09fa475cc8449880800006e223ddc8669fcb3f83b5bbace85525052c85111702bf360efaa693784fd1e069c63cda7fe2f81bd813

Download Submit