cf6639e0c48b645fd7c2ffc588d64a9e184340dfb2a645c8aa530485b1a7228b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 08:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8789264cfebf9c401e7c25abaed964f_JaffaCakes118.html
Size

56KB
MD5

c8789264cfebf9c401e7c25abaed964f
SHA1

07451dae5c2425dc0c38fe518dccf609440f90c8
SHA256

cf6639e0c48b645fd7c2ffc588d64a9e184340dfb2a645c8aa530485b1a7228b
SHA512

6038faa9c02100255d84e946b8b12619e52515469bb2faac8979db57def0c0b9ed33dd659a35b69f542549e5f6ca0c8742694f272dc0d98eb8db082f70fc321d
SSDEEP

768:SK5OhnwX3HELRRh4/XNv+f6VicAXVjSpLJv2ZOY:SWsnAWRh4/XNy6Vic6Sppkz

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1000	msedge.exe
1000	msedge.exe
3084	msedge.exe
3084	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe
3176	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe
3084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 2872	3084	msedge.exe	86
PID 3084 wrote to memory of 2872	3084	msedge.exe	86
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1044	3084	msedge.exe	87
PID 3084 wrote to memory of 1000	3084	msedge.exe	88
PID 3084 wrote to memory of 1000	3084	msedge.exe	88
PID 3084 wrote to memory of 1216	3084	msedge.exe	89
PID 3084 wrote to memory of 1216	3084	msedge.exe	89
PID 3084 wrote to memory of 1216	3084	msedge.exe	89
PID 3084 wrote to memory of 1216	3084	msedge.exe	89
PID 3084 wrote to memory of 1216	3084	msedge.exe	89
PID 3084 wrote to memory of 1216	3084	msedge.exe	89
PID 3084 wrote to memory of 1216	3084	msedge.exe	89
PID 3084 wrote to memory of 1216	3084	msedge.exe	89
PID 3084 wrote to memory of 1216	3084	msedge.exe	89
PID 3084 wrote to memory of 1216	3084	msedge.exe	89
PID 3084 wrote to memory of 1216	3084	msedge.exe	89
PID 3084 wrote to memory of 1216	3084	msedge.exe	89
PID 3084 wrote to memory of 1216	3084	msedge.exe	89
PID 3084 wrote to memory of 1216	3084	msedge.exe	89
PID 3084 wrote to memory of 1216	3084	msedge.exe	89
PID 3084 wrote to memory of 1216	3084	msedge.exe	89
PID 3084 wrote to memory of 1216	3084	msedge.exe	89
PID 3084 wrote to memory of 1216	3084	msedge.exe	89
PID 3084 wrote to memory of 1216	3084	msedge.exe	89
PID 3084 wrote to memory of 1216	3084	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c8789264cfebf9c401e7c25abaed964f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeebe946f8,0x7ffeebe94708,0x7ffeebe94718
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,4757307156061593803,6819408453431483986,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,4757307156061593803,6819408453431483986,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,4757307156061593803,6819408453431483986,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,4757307156061593803,6819408453431483986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,4757307156061593803,6819408453431483986,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,4757307156061593803,6819408453431483986,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a8c9e738373c1b10b1d19aff6293095b

SHA1
4d6c01f8a27cd692db3e9a555d26cd8265203a15

SHA256
a7be3fa0700b0fef9a7bfd82dd5f6b54b28ecd819ffe0a8704c48dd1f6d40dd8

SHA512
6e9e6817513b4c5cda160cb6ab5bfdb4d35834c87c4af4347202630ce211d7a6ffcf8a668d9b6f0d9c3f55f3741f208d4bab055c7e9b40763a93ee5f0da51c8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6be476ee65c54a688ba38bc69ab15f98

SHA1
195db1490b0e10f35f7d9a8772867636e93fdef3

SHA256
34c014c4a9e69749fa76834dbfe206bc65f0cc261c0f9be8d8f31e28aac52af3

SHA512
232bcaf753974057c5d1193f77954d1fe420103a93232c22a85cad1cf0d164ac248bf3f14bdc83fc044dcd7f878740c97ee297e30b5964ec8d52994ea3a32db3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1199612c00472417b278a7f7dfade7af

SHA1
d3d18015b25f715efdac89d12aa2a325700ded4c

SHA256
0b6ce92c3402c9c47470b7684401cfc74c7ba39d833b9b037d3f7bed0cd4bf7e

SHA512
4f5882f1a19c827d392fda657abf036e7137d03fd0b596098293d7a8cc73a8661193f8c8e2f01a329e749d4c908c109d80c346f521fe78a6bb6c11b293ef99a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bac4d6ed13e3e305c1a9293ab2948a16

SHA1
35ff7305696fc456d98b403ebf89f95635b94a81

SHA256
7b8108264bc752aa660e7e62e94bebf6906b01245ef85f19d423c9f87564c8a8

SHA512
4c2d38ebb66fb7cb8df8b0a7c005f526ad11875ea9753ef9daf00c2f7e6807d7aa714da0955262a49f6a5e952ee57ffb1bf1bc6f0e5828175dedb831421dd25e

Download Submit