c1ffdb8b646add0749c92e81c181f3a597e0faece88a738aed771592401ae3f4

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 19:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c9714ae16be780a717c54319b2a08645_JaffaCakes118.html
Size

20KB
MD5

c9714ae16be780a717c54319b2a08645
SHA1

16f3527cf954e512997549cc50774c839c2c338f
SHA256

c1ffdb8b646add0749c92e81c181f3a597e0faece88a738aed771592401ae3f4
SHA512

129b820eb0c0acced0926770169f767fa7c33898de5230678b24f1cb9fa42f9387890e95a03cae872f5121e2430b04052749e4f560a3e181610639130dd8520f
SSDEEP

384:ziMrKcRAa5r9DIivVBD8cyQ3R5E96UIEmd5WScfIk9xheLrzVc9i:zixa5r9DxgcV3XE96ymNOIk9eLnqi

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
648	msedge.exe
648	msedge.exe
3132	identity_helper.exe
3132	identity_helper.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe
5880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 1156	648	msedge.exe	84
PID 648 wrote to memory of 1156	648	msedge.exe	84
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 3684	648	msedge.exe	85
PID 648 wrote to memory of 1144	648	msedge.exe	86
PID 648 wrote to memory of 1144	648	msedge.exe	86
PID 648 wrote to memory of 1208	648	msedge.exe	87
PID 648 wrote to memory of 1208	648	msedge.exe	87
PID 648 wrote to memory of 1208	648	msedge.exe	87
PID 648 wrote to memory of 1208	648	msedge.exe	87
PID 648 wrote to memory of 1208	648	msedge.exe	87
PID 648 wrote to memory of 1208	648	msedge.exe	87
PID 648 wrote to memory of 1208	648	msedge.exe	87
PID 648 wrote to memory of 1208	648	msedge.exe	87
PID 648 wrote to memory of 1208	648	msedge.exe	87
PID 648 wrote to memory of 1208	648	msedge.exe	87
PID 648 wrote to memory of 1208	648	msedge.exe	87
PID 648 wrote to memory of 1208	648	msedge.exe	87
PID 648 wrote to memory of 1208	648	msedge.exe	87
PID 648 wrote to memory of 1208	648	msedge.exe	87
PID 648 wrote to memory of 1208	648	msedge.exe	87
PID 648 wrote to memory of 1208	648	msedge.exe	87
PID 648 wrote to memory of 1208	648	msedge.exe	87
PID 648 wrote to memory of 1208	648	msedge.exe	87
PID 648 wrote to memory of 1208	648	msedge.exe	87
PID 648 wrote to memory of 1208	648	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c9714ae16be780a717c54319b2a08645_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bcd146f8,0x7ff8bcd14708,0x7ff8bcd14718
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,1003457370509226061,12355929258417803082,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,1003457370509226061,12355929258417803082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,1003457370509226061,12355929258417803082,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1003457370509226061,12355929258417803082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1003457370509226061,12355929258417803082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1003457370509226061,12355929258417803082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1003457370509226061,12355929258417803082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,1003457370509226061,12355929258417803082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,1003457370509226061,12355929258417803082,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1003457370509226061,12355929258417803082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1003457370509226061,12355929258417803082,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1003457370509226061,12355929258417803082,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1003457370509226061,12355929258417803082,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,1003457370509226061,12355929258417803082,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5308 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1772074d-7bf5-494b-ac06-b4bbd5f60863.tmp

Filesize
5KB

MD5
391e97851211217fa0035bd8b38147f5

SHA1
5cebe431d631694fdb4a230f75bbc9579b5c151a

SHA256
8d1e78083a505db9ee5bb8002e16c6409415e8cf9839129c7afb131b770c6117

SHA512
0c9eb9a63245b233b99e899b2e3d8c55d4f37e667598b276719d4479651305a2f0d7eb4d69b087d05d76de782f8ba9e185d016e39343ac5e8c3ed61b5fd77fa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
211KB

MD5
e7226392c938e4e604d2175eb9f43ca1

SHA1
2098293f39aa0bcdd62e718f9212d9062fa283ab

SHA256
d46ec08b6c29c4ca56cecbf73149cc66ebd902197590fe28cd65dad52a08c4e1

SHA512
63a4b99101c790d40a813db9e0d5fde21a64ccaf60a6009ead027920dbbdb52cc262af829e5c4140f3702a559c7ac46efa89622d76d45b4b49a9ce01625ef145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
463cd1943ba0fad9464b9e866c53e2ef

SHA1
df2a264ac460304c9385d25af3c1895e39a42597

SHA256
01673790297afd59005e04ec2134f033d0e6098cb23f2d2a20bd7c5bc9886a97

SHA512
30c5851298e0562cc8b5fba1a59944e7883c5e4cdf1efbe7b7d24b2e32fbd9bb0689b463825baac765cada680a54ed2cdeb55708f8a4b8399d48c07902e5dbb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1015B

MD5
80b6bd2314d6d7574c52d081d972719f

SHA1
57b60ff708597a9ba9b6f0b5bca54819864a8b78

SHA256
ddb4423bb11422ab0c8c8aa83358205da4881eee74394dcd2f475ff0e107dd67

SHA512
fb849d3922f8f4f0ba5f473f1753a56637d026a66323142bbf4053e3679d541f5750006ab4fe6382d7e4856b20d0387ac1f18112f277fd7f61901af023573082

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9a1bc8146dbb3838b81910ab2efbe782

SHA1
9f3bb8e21a6702c9e603ac5b7c7ada434cc7fe70

SHA256
4fb69eb92064088bd901dd61302bd697ad2b01b965f5bd2b3e590a4f7471fc5d

SHA512
11b2f7e14e2da3570ba06490f97fe22d2d59026a329936e4f185a16e8a49028bb45489d8783a92f8d5a1ddba69272f2798db00a71020892ac2cde16c713a1d66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b939a9b4628c4fce47d3eba1c0662e5a

SHA1
af7a76e6d4d337a84393413506abd9f9e9e2521e

SHA256
cadf315af37a2177fa14ba4325833a275002f500409e2a8db3aba3299bcf875a

SHA512
b8b9099d77ed0661e1e6d70d433efd7f41f88f2c092199a6e2c52cf237b44575758b48f44df2bd9966bb7d4a9ae44ce20ab0284f41379bfcb2a35bb6b6e5bd6e

Download Submit