17965a12690144eba8627827c3b0592192b0980fe424172f222890c6412086a8

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 12:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8cc56755b018d241ffe70ed1d56c94f_JaffaCakes118.html
Size

87KB
MD5

c8cc56755b018d241ffe70ed1d56c94f
SHA1

9cbd2a4a93d8519621209becb8b0b9acf57f532e
SHA256

17965a12690144eba8627827c3b0592192b0980fe424172f222890c6412086a8
SHA512

4d7199cfaf348e903eb7833bfef552c1356acbceeb90aea77da4161f92efe7cf62caecde3d985f6f069f43ad12b11b6f70278e783ad79c96f297dae9f6f64c2f
SSDEEP

1536:jcsxjv/XRyGXmNJUzIfPlG5nrJ80U9itenKJPb0WjLERdVGv+:jnxDAGXmNJUzKlG5nrJ80UgtenKJj0W2

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
4588	msedge.exe
4588	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe
2908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 3712	4588	msedge.exe	84
PID 4588 wrote to memory of 3712	4588	msedge.exe	84
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 1308	4588	msedge.exe	85
PID 4588 wrote to memory of 5100	4588	msedge.exe	86
PID 4588 wrote to memory of 5100	4588	msedge.exe	86
PID 4588 wrote to memory of 2392	4588	msedge.exe	87
PID 4588 wrote to memory of 2392	4588	msedge.exe	87
PID 4588 wrote to memory of 2392	4588	msedge.exe	87
PID 4588 wrote to memory of 2392	4588	msedge.exe	87
PID 4588 wrote to memory of 2392	4588	msedge.exe	87
PID 4588 wrote to memory of 2392	4588	msedge.exe	87
PID 4588 wrote to memory of 2392	4588	msedge.exe	87
PID 4588 wrote to memory of 2392	4588	msedge.exe	87
PID 4588 wrote to memory of 2392	4588	msedge.exe	87
PID 4588 wrote to memory of 2392	4588	msedge.exe	87
PID 4588 wrote to memory of 2392	4588	msedge.exe	87
PID 4588 wrote to memory of 2392	4588	msedge.exe	87
PID 4588 wrote to memory of 2392	4588	msedge.exe	87
PID 4588 wrote to memory of 2392	4588	msedge.exe	87
PID 4588 wrote to memory of 2392	4588	msedge.exe	87
PID 4588 wrote to memory of 2392	4588	msedge.exe	87
PID 4588 wrote to memory of 2392	4588	msedge.exe	87
PID 4588 wrote to memory of 2392	4588	msedge.exe	87
PID 4588 wrote to memory of 2392	4588	msedge.exe	87
PID 4588 wrote to memory of 2392	4588	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c8cc56755b018d241ffe70ed1d56c94f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97c7046f8,0x7ff97c704708,0x7ff97c704718
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,5487239182246803995,625279988456995558,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2260,5487239182246803995,625279988456995558,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2260,5487239182246803995,625279988456995558,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,5487239182246803995,625279988456995558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,5487239182246803995,625279988456995558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,5487239182246803995,625279988456995558,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,5487239182246803995,625279988456995558,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\181899c9-2b1e-46be-94bc-116ee4d028ed.tmp

Filesize
10KB

MD5
51154abd92ead34f7a305ec40766d891

SHA1
011486d7051c19146f1b6b82b41ffc09a5035814

SHA256
570e9a3f660eb35852f69c0262a73aeca165edcd6ade4e975a47d98bd6cb93ca

SHA512
b22e123598a08d5183c0419720acaf3a73923cc3bfda8894a8b80c573605d2782651877cfcec5cd4525b06f7ee6a4fbee5cc60f6611c3ef8819062768d5326b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
475f379d64cbfc47b0bb7c45099d0a29

SHA1
fbf3a1e4eb6d9fff372bfdf6b33d78a97718617d

SHA256
e65823971e7088c88358adce9d1ed68a88979b00ea3875b119757130e99df6a4

SHA512
82bdf8f7158fc28913ac3d759ea56820f1f27c896a5a30a72ae2ede0853db2ebc000b690bf5c60d56186706935a9a417efa528626a854943137361dbf38f9d84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
eb5af63eb2ad4fb02d2c5b964f85c652

SHA1
9cbdc33ddfdd906f8d996d499e40d520e831971e

SHA256
95dcba49df070de20f1bc11f94302c1dfc2a73e7cb2971abb851edbbb9e07bbb

SHA512
1b64c81fbdb80630ec2d6913e13aac81f7c052c4df8c01b6670114c0217da0a389fb103fecc67a3bc50680bc0bf71a3ab104828bb17040f0de8ebab4dac23b5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e530d491ba73cc97d6f7d7e70613ec2f

SHA1
daf03f6657250c3bfc95da604efa7b04ca685365

SHA256
3978caa210d73479726a110557bc89ff0563757c9c359ddd40a25c1d00b1632f

SHA512
a0e165831d02b3ace1662746630b7ec4398368e1e846e16be72fb4062b52d38be3231a9c36d3dbf961551886421bb057c2e1b0f1582f3ab1742b16ed619ef4f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9419e204a66128170faf0ea9b7867ad3

SHA1
cd0d4a18801bcfefbd6f6946d576659fb53b71ee

SHA256
f4e521853c38333d5d39a74754531e065365c04f9fcea6b329b010533e461b88

SHA512
85d67140aca3776af0e76157205199a8b6ef0d0e3b5706ebb7be1ab8be5d256e33d2f2e8c77ed6d474a90b9405235dc9758fcedc68c5694106442da0c2fea7ed

Download Submit