c65790908ba5bed0a9ffc83979f6c4cf517c706fbb48541e5e916e384db27d08

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 09:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c886d61f4370fc2c90dd4cba9eac3a58_JaffaCakes118.html
Size

36KB
MD5

c886d61f4370fc2c90dd4cba9eac3a58
SHA1

5352e9d940dd56d2b6bcb49f5f73483075a33a50
SHA256

c65790908ba5bed0a9ffc83979f6c4cf517c706fbb48541e5e916e384db27d08
SHA512

ea2ba52ef47893c388b2b4100b770afbfc1d6ffa40d803e516c5675492e6a8ed7f0be7127ccacaf2b6b8b06ac8a5c64e7f1206c34e50fa80bb1598652f1bf6c1
SSDEEP

768:zwx/MDTHsW88hARtZPXIE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TUZOD6lrw6lLRcP:Q/DbJxNVru0S9/S8qK

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
964	msedge.exe
964	msedge.exe
3092	msedge.exe
3092	msedge.exe
4800	identity_helper.exe
4800	identity_helper.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 2444	3092	msedge.exe	84
PID 3092 wrote to memory of 2444	3092	msedge.exe	84
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 4992	3092	msedge.exe	85
PID 3092 wrote to memory of 964	3092	msedge.exe	86
PID 3092 wrote to memory of 964	3092	msedge.exe	86
PID 3092 wrote to memory of 5100	3092	msedge.exe	87
PID 3092 wrote to memory of 5100	3092	msedge.exe	87
PID 3092 wrote to memory of 5100	3092	msedge.exe	87
PID 3092 wrote to memory of 5100	3092	msedge.exe	87
PID 3092 wrote to memory of 5100	3092	msedge.exe	87
PID 3092 wrote to memory of 5100	3092	msedge.exe	87
PID 3092 wrote to memory of 5100	3092	msedge.exe	87
PID 3092 wrote to memory of 5100	3092	msedge.exe	87
PID 3092 wrote to memory of 5100	3092	msedge.exe	87
PID 3092 wrote to memory of 5100	3092	msedge.exe	87
PID 3092 wrote to memory of 5100	3092	msedge.exe	87
PID 3092 wrote to memory of 5100	3092	msedge.exe	87
PID 3092 wrote to memory of 5100	3092	msedge.exe	87
PID 3092 wrote to memory of 5100	3092	msedge.exe	87
PID 3092 wrote to memory of 5100	3092	msedge.exe	87
PID 3092 wrote to memory of 5100	3092	msedge.exe	87
PID 3092 wrote to memory of 5100	3092	msedge.exe	87
PID 3092 wrote to memory of 5100	3092	msedge.exe	87
PID 3092 wrote to memory of 5100	3092	msedge.exe	87
PID 3092 wrote to memory of 5100	3092	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c886d61f4370fc2c90dd4cba9eac3a58_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x7c,0x108,0x7ffa62ab46f8,0x7ffa62ab4708,0x7ffa62ab4718
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14475275402113264024,1133696008253237681,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,14475275402113264024,1133696008253237681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,14475275402113264024,1133696008253237681,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14475275402113264024,1133696008253237681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14475275402113264024,1133696008253237681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,14475275402113264024,1133696008253237681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,14475275402113264024,1133696008253237681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14475275402113264024,1133696008253237681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14475275402113264024,1133696008253237681,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14475275402113264024,1133696008253237681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14475275402113264024,1133696008253237681,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14475275402113264024,1133696008253237681,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3060 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
613B

MD5
f3f11d4f0bc53521fc4b0856f2088708

SHA1
782800cb035ddb9d87782c83cce708e5c632704c

SHA256
c180232da423cf5f362fef68cfae2c7d4b310658740d1af06abc0ae7cde7f1b8

SHA512
c3095232b1b5548c6a237c33112dde2010737131ada996d55ec59d7989e4fc857eb5fc47e5dbbbaa98e83f8ef485577dfeb2c69dcd08c8d0ee063a8f0cdfae30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f2e18457ad4f133c1a61c7ed333c7a64

SHA1
cdc12737734581deed2ca3395a5e0d1d1a5af7dc

SHA256
ef32a50f391996acf3a069950320b2fdcb6aacccd9cad6290d4c14251da9c693

SHA512
e90aa1c06040af2d5a0a1798341810ba013331aa7f204653cc5bf35af417cdae68b4b11fe555b83b61d3bcdfd0097ce572e9e16d6097584c64ea2d156fe3544c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b43f726be9c12aed07c3566fd0ed726e

SHA1
64a19582fd89aea93ce588815e70ce46925100e8

SHA256
a27805d4139a5b5582b07d81332270c913d47d2d49c8c6ee7d741bc506d6d1f5

SHA512
9c24e1bf8941223ecbdcd22d46469d29f1d0937c1862f683d94aa537f4fe9ed1599eeaa600457d3403dbe0856b8bb17397a84ca3af073e7b10f1f5cae035e1ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3377dfc4d41a408abafd4ad1456a444d

SHA1
f4d44e4bfba82d522f9a3824e91be83f5be03a43

SHA256
cdc5d38369e02b543fe62dd3d5ec72c26609328a68a0d1dcc2a5620e617b54c4

SHA512
dbcfe1b9cf21f9d60d5c2d22dbedadb8858b026b34d644abb1ae4f26f68aa72f9be241d681d579c0111fd58a0064d8e8cb40743010064eecd06be187fabfed66

Download Submit