5aa7d9a0c4e97382d865a416a0c2b2aee0abf49965cc6daf75e6e0d061975584

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce20f4efb681b0215f9db0b52c867f82_JaffaCakes118.html
Size

139KB
MD5

ce20f4efb681b0215f9db0b52c867f82
SHA1

e031c3e88b5289de975d259f01d5d173df8232d5
SHA256

5aa7d9a0c4e97382d865a416a0c2b2aee0abf49965cc6daf75e6e0d061975584
SHA512

a38bf57816f5ab055e083fc40b409af8cf5d23b21b8e4623e11420b9e069a2d5b164b3ce17d9af30223d8623695ec4e928b552e667116ee9744eb0e2ee795e2e
SSDEEP

1536:SYt+mKZlbiGyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBw:SYcviGyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
3972	msedge.exe
3972	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe
4300	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 3816	3972	msedge.exe	83
PID 3972 wrote to memory of 3816	3972	msedge.exe	83
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 2812	3972	msedge.exe	84
PID 3972 wrote to memory of 4932	3972	msedge.exe	85
PID 3972 wrote to memory of 4932	3972	msedge.exe	85
PID 3972 wrote to memory of 3992	3972	msedge.exe	86
PID 3972 wrote to memory of 3992	3972	msedge.exe	86
PID 3972 wrote to memory of 3992	3972	msedge.exe	86
PID 3972 wrote to memory of 3992	3972	msedge.exe	86
PID 3972 wrote to memory of 3992	3972	msedge.exe	86
PID 3972 wrote to memory of 3992	3972	msedge.exe	86
PID 3972 wrote to memory of 3992	3972	msedge.exe	86
PID 3972 wrote to memory of 3992	3972	msedge.exe	86
PID 3972 wrote to memory of 3992	3972	msedge.exe	86
PID 3972 wrote to memory of 3992	3972	msedge.exe	86
PID 3972 wrote to memory of 3992	3972	msedge.exe	86
PID 3972 wrote to memory of 3992	3972	msedge.exe	86
PID 3972 wrote to memory of 3992	3972	msedge.exe	86
PID 3972 wrote to memory of 3992	3972	msedge.exe	86
PID 3972 wrote to memory of 3992	3972	msedge.exe	86
PID 3972 wrote to memory of 3992	3972	msedge.exe	86
PID 3972 wrote to memory of 3992	3972	msedge.exe	86
PID 3972 wrote to memory of 3992	3972	msedge.exe	86
PID 3972 wrote to memory of 3992	3972	msedge.exe	86
PID 3972 wrote to memory of 3992	3972	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ce20f4efb681b0215f9db0b52c867f82_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5f9846f8,0x7ffe5f984708,0x7ffe5f984718
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,11255197834598318873,7791465384787709104,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,11255197834598318873,7791465384787709104,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,11255197834598318873,7791465384787709104,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11255197834598318873,7791465384787709104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11255197834598318873,7791465384787709104,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,11255197834598318873,7791465384787709104,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4852 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3671d5d649575e591166a3bea03d7047

SHA1
3ce3a932f95858c5b752427bf5e9329f16587504

SHA256
75133c2abc1a4f70c65c7f739b5d0f4142c64dd6ae29d9d9f5e01711bb0cc7fd

SHA512
329d15f98c1092a882d624357f22909c1191cbcdd1ac13f7fa3190a8abc120ea66140ea751e0d73bdd22d8be9353ca007ccb7f20830f4c650252b09f0179cf0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6a53327159f18b1840429ba3c643ea26

SHA1
98d63e6f77b4c15321e18f1968e6f8c47343fd01

SHA256
4b2b1c600a54007ade4ddff2420c728a4441dcdf4fdcca3b7960239ea8aca235

SHA512
50d7ac48ad6a336919d8e1a023e8e4ceeba07e669278dbe96c841d5ab1b0ef1d5d25d2770c3629a3a9c3f11ba2a5a327179ccd3011dce527733e2c13f1c18c40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f0750c0e51446571da4c03e01741a43a

SHA1
43390b0a4dec9ab6b604cd169353db1359be2b16

SHA256
431516c9bf729653fbf44598f88213241bcf1711a1665f1a3ad294b90cabe334

SHA512
a14558943840c9c232ebff7ff322de859f5179c46f5818d57ff5d5bc8c6e5fc364de2100a37e0039328726f0d379125345e49e257c6f5a589bc9a19f0bad90c7

Download Submit