45d7a738e082f6f8aec014f7352f957034267a6d48f646bc91555486439c6caa

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2024 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8e07962242e304042f268acb303e99a_JaffaCakes118.html
Size

192KB
MD5

c8e07962242e304042f268acb303e99a
SHA1

6e12d137adaa431fd66b9a7b49a4e837438226e5
SHA256

45d7a738e082f6f8aec014f7352f957034267a6d48f646bc91555486439c6caa
SHA512

23c44a61a1315d6207d94f0d84d124c8e0ab1127e2b9a52b1b75b39a4648e8e96e6b495abb87e7c1f49ef4487b262a188c1177b4d0b673c84e7faa046f05ee73
SSDEEP

1536:pbMjw2fMk1D3O9Pj2fcmGnHA+39LiCkWjpQcZN8QK0p:sAztLPpQA

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1300	msedge.exe
1300	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1300	msedge.exe
1300	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 2256	1300	msedge.exe	84
PID 1300 wrote to memory of 2256	1300	msedge.exe	84
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 2868	1300	msedge.exe	85
PID 1300 wrote to memory of 1220	1300	msedge.exe	86
PID 1300 wrote to memory of 1220	1300	msedge.exe	86
PID 1300 wrote to memory of 1560	1300	msedge.exe	87
PID 1300 wrote to memory of 1560	1300	msedge.exe	87
PID 1300 wrote to memory of 1560	1300	msedge.exe	87
PID 1300 wrote to memory of 1560	1300	msedge.exe	87
PID 1300 wrote to memory of 1560	1300	msedge.exe	87
PID 1300 wrote to memory of 1560	1300	msedge.exe	87
PID 1300 wrote to memory of 1560	1300	msedge.exe	87
PID 1300 wrote to memory of 1560	1300	msedge.exe	87
PID 1300 wrote to memory of 1560	1300	msedge.exe	87
PID 1300 wrote to memory of 1560	1300	msedge.exe	87
PID 1300 wrote to memory of 1560	1300	msedge.exe	87
PID 1300 wrote to memory of 1560	1300	msedge.exe	87
PID 1300 wrote to memory of 1560	1300	msedge.exe	87
PID 1300 wrote to memory of 1560	1300	msedge.exe	87
PID 1300 wrote to memory of 1560	1300	msedge.exe	87
PID 1300 wrote to memory of 1560	1300	msedge.exe	87
PID 1300 wrote to memory of 1560	1300	msedge.exe	87
PID 1300 wrote to memory of 1560	1300	msedge.exe	87
PID 1300 wrote to memory of 1560	1300	msedge.exe	87
PID 1300 wrote to memory of 1560	1300	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c8e07962242e304042f268acb303e99a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc9c6946f8,0x7ffc9c694708,0x7ffc9c694718
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,17247353967456794645,18310188144011164465,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,17247353967456794645,18310188144011164465,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,17247353967456794645,18310188144011164465,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17247353967456794645,18310188144011164465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17247353967456794645,18310188144011164465,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,17247353967456794645,18310188144011164465,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0ec2ddb8491f6f724e3ed2334fbfbefb

SHA1
4b25ac825c23952da7765184e58ffd51ccd1d747

SHA256
f392517a6214ff4ed531e142dacff12ad3de59ccd26e0c8e45c3da961266fa8d

SHA512
957342461a78a36316c0bd6a878e8d4fbf1471b00ea7f966d2f0fd01dd8d31e23f6e17267b2485e902de730eaefb3cabd7f8318832acd859052b5873817e21c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
849a9dfc4d980c1adb507239f5308077

SHA1
11a01a0dfc3a23122d23de02422498129abccf73

SHA256
b083b37c1991395ad33e764ab7d5a6bd291303a5dd756d62abf72ef3acc60c80

SHA512
ceeb65b1b1f9654e22b9f69b3cdec6fc8e6c91b94beedfa2f07ee08f9570531a34aeba8d097f9d1857f4912cdbbbd49c61202c8b3c0657e3699f14469486816f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1991b51c763db6caafcbf18e7621d3bf

SHA1
e20bb1577c5e844d001893d7ac209b6ea65611c8

SHA256
6344b1fcef79b10b8d426f83a922a7817fa2b31ebebc6b921c5e48a86bfea3ca

SHA512
616cda0ecd7194bad2e7f1bdddd08e7069ffdb9e485df616b1a9ae8540c5f0f66c8a1cf38938940c66ea8ddc0b25c569edf24646d105439349f6a800f7addcfa

Download Submit