78808e7f8d41c9d44aa7d69669fef69677634939edb9e2a34e69c23b44db6eae

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c82c5f2222a215e0447d5d497e95218f_JaffaCakes118.html
Size

143KB
MD5

c82c5f2222a215e0447d5d497e95218f
SHA1

9dbddfd7bf5d380e3bb53d11a9dd03cc6f8a940b
SHA256

78808e7f8d41c9d44aa7d69669fef69677634939edb9e2a34e69c23b44db6eae
SHA512

646956e084de6b2d3f3abb295237c66ecfa45ccc271c2b37bf84b9f04c60df0949017cb755d5bbeb966bb906ca695927c416d6fc5842b6189cf6acd01d29ede2
SSDEEP

1536:SfsdcrUHHBxfmx76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXAZ:SWHBAx7dyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3716	msedge.exe
3716	msedge.exe
4136	msedge.exe
4136	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4708	4136	msedge.exe	84
PID 4136 wrote to memory of 4708	4136	msedge.exe	84
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 4124	4136	msedge.exe	85
PID 4136 wrote to memory of 3716	4136	msedge.exe	86
PID 4136 wrote to memory of 3716	4136	msedge.exe	86
PID 4136 wrote to memory of 2424	4136	msedge.exe	87
PID 4136 wrote to memory of 2424	4136	msedge.exe	87
PID 4136 wrote to memory of 2424	4136	msedge.exe	87
PID 4136 wrote to memory of 2424	4136	msedge.exe	87
PID 4136 wrote to memory of 2424	4136	msedge.exe	87
PID 4136 wrote to memory of 2424	4136	msedge.exe	87
PID 4136 wrote to memory of 2424	4136	msedge.exe	87
PID 4136 wrote to memory of 2424	4136	msedge.exe	87
PID 4136 wrote to memory of 2424	4136	msedge.exe	87
PID 4136 wrote to memory of 2424	4136	msedge.exe	87
PID 4136 wrote to memory of 2424	4136	msedge.exe	87
PID 4136 wrote to memory of 2424	4136	msedge.exe	87
PID 4136 wrote to memory of 2424	4136	msedge.exe	87
PID 4136 wrote to memory of 2424	4136	msedge.exe	87
PID 4136 wrote to memory of 2424	4136	msedge.exe	87
PID 4136 wrote to memory of 2424	4136	msedge.exe	87
PID 4136 wrote to memory of 2424	4136	msedge.exe	87
PID 4136 wrote to memory of 2424	4136	msedge.exe	87
PID 4136 wrote to memory of 2424	4136	msedge.exe	87
PID 4136 wrote to memory of 2424	4136	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c82c5f2222a215e0447d5d497e95218f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdeaaf46f8,0x7ffdeaaf4708,0x7ffdeaaf4718
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,6088016554748675427,17267930995043807166,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1900 /prefetch:2
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,6088016554748675427,17267930995043807166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,6088016554748675427,17267930995043807166,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6088016554748675427,17267930995043807166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,6088016554748675427,17267930995043807166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,6088016554748675427,17267930995043807166,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4888 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ece6f2b5e18ebb727fba38abf3874764

SHA1
43b3a7242e7be043fc972470b9d641473704fa71

SHA256
ad9318989d8c3b61038d0c918db41a8482ab1cf7710daec9c30bfc5018dbc774

SHA512
b3829cd4128a6ca8d97e13119f1a3f6d2b3a80b5074cfd2935544ac8cd84ac9d3c3298b78519ef04fbfef384728ca64a936ecc83332e099c84cfccd28f781209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c7389757623191d55b7713ba0fe10fb7

SHA1
e2cedc3bd0d0c890426878dd7258b1fd155dbe0b

SHA256
cd24ae712b5ebb292cc622450dc68632211afd248c6ae0c37ae3ad3c71777123

SHA512
4db76776baf40bc7348d5b28856ee3da523ef708f0ced167ecfe5f72d468e7e2225226be3cff4fe48e8ae06453be039b3dc502816b8593a139e8c500635eaf03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e1adcc14a0bb023b213a3ab745954ce8

SHA1
dbbacb3f64aec043affd9f75b89f1e14cd10400d

SHA256
3142a3574f6d2f4b9b5b655ab2739331040020a2a0d694d99c549359e9a12501

SHA512
7ea94eff0e709a9b294ef4d58d9a2f925a4364ae89dcf4e9d079e2c673a51bd168b354d64c8b2f9a70312eafb5e61998aa5cf2174c5143bd53f84f829dd11db3

Download Submit