897e4e823c48d4a40921e5459eb2f7d41ec5bdbd57c9595e3361c6d324c4c7d5

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ce17db8bdd153710b445623c255c7e7d_JaffaCakes118.html
Size

166KB
MD5

ce17db8bdd153710b445623c255c7e7d
SHA1

b593411358fc416c008f946bffd4d93657b4fb8c
SHA256

897e4e823c48d4a40921e5459eb2f7d41ec5bdbd57c9595e3361c6d324c4c7d5
SHA512

a5c71fbff8d629698169cf7de6d23b41d2f8ae9244ec3a80d625ea579b4b6eb796a963d85dc1e68a49641972d634577f060e5179fa72dcaa3432e8b1d500dcf1
SSDEEP

3072:SdgVjdAJc7Rpw3+TsMd9OvsUx+JcrGCDR8Bri7puwtkZXntH:Sds7Rpw3+TsMd9OvsUx+JcrGCDR8Bris

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
2140	msedge.exe
2140	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe
2140	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 5084	2140	msedge.exe	83
PID 2140 wrote to memory of 5084	2140	msedge.exe	83
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 3860	2140	msedge.exe	84
PID 2140 wrote to memory of 4708	2140	msedge.exe	85
PID 2140 wrote to memory of 4708	2140	msedge.exe	85
PID 2140 wrote to memory of 3200	2140	msedge.exe	86
PID 2140 wrote to memory of 3200	2140	msedge.exe	86
PID 2140 wrote to memory of 3200	2140	msedge.exe	86
PID 2140 wrote to memory of 3200	2140	msedge.exe	86
PID 2140 wrote to memory of 3200	2140	msedge.exe	86
PID 2140 wrote to memory of 3200	2140	msedge.exe	86
PID 2140 wrote to memory of 3200	2140	msedge.exe	86
PID 2140 wrote to memory of 3200	2140	msedge.exe	86
PID 2140 wrote to memory of 3200	2140	msedge.exe	86
PID 2140 wrote to memory of 3200	2140	msedge.exe	86
PID 2140 wrote to memory of 3200	2140	msedge.exe	86
PID 2140 wrote to memory of 3200	2140	msedge.exe	86
PID 2140 wrote to memory of 3200	2140	msedge.exe	86
PID 2140 wrote to memory of 3200	2140	msedge.exe	86
PID 2140 wrote to memory of 3200	2140	msedge.exe	86
PID 2140 wrote to memory of 3200	2140	msedge.exe	86
PID 2140 wrote to memory of 3200	2140	msedge.exe	86
PID 2140 wrote to memory of 3200	2140	msedge.exe	86
PID 2140 wrote to memory of 3200	2140	msedge.exe	86
PID 2140 wrote to memory of 3200	2140	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ce17db8bdd153710b445623c255c7e7d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa579246f8,0x7ffa57924708,0x7ffa57924718
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,1260326543139324182,303363332912838399,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,1260326543139324182,303363332912838399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,1260326543139324182,303363332912838399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,1260326543139324182,303363332912838399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2884 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,1260326543139324182,303363332912838399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,1260326543139324182,303363332912838399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,1260326543139324182,303363332912838399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,1260326543139324182,303363332912838399,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
1c247c69d9163c110fe3040f22ff9b89

SHA1
c37b2310ad8bd986bd7b9def8af3251c78a53720

SHA256
db71629e8338daf39d7e4aa2df0dbfba29fd99d4a278ec3663af1a354711259a

SHA512
4e6cc891d7e7e24560ee9570146d976d9c13311edbc43495e169c019836ec9b2db275f8712170db50b3c63581eea3928db90c46dfd790e4c4b7d8dfbb8047017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c707768be90f02a950ee3e1712a8402a

SHA1
18c810c5cde85cec66bd16ed9b448e12c22e94e1

SHA256
eb92a91b13c9606e82af02a997912e3dc8e85788a618fae0438bd2a16e582dd2

SHA512
4be90d08fc05075c52e60f0f523b94384ea66c2116579aa0e6f27359d1dd59df95a0df8bd076ce4931fe03ab36f6517220e5fb23f2ffea9660630ee0bc04ae05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
75db3142689efc9a3574d16f7083a57c

SHA1
c03cbb824988f0c603fc9169c4838f3fa6a6613c

SHA256
fb03fdeb1ac18fe3f33edc137b22fcbdc7908288dbd3e44a1d601cddb4fb4110

SHA512
247622bd120494fcb8754ac764db5f3ad1b4dd3ab2e7b7e5d5c09e1b260f37b688ad4afe01f78e20fa1002b93534fbfcf74e3f7b7b9e214a7d2dfebd139d5b82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7a3d24446b10a1c8bc73c7a3b12f8940

SHA1
b7355521ae78a40cf9e192d53ef38020e3116187

SHA256
778148cc3a96dc57cdf5345e5ff3022181e7a7412e195c936d24a9760f1893b0

SHA512
21fd87022080203f0396e2d79cc12969897053743afffc335666d7fbea1c85e642425bf1307cbeed0ab2b3a574f8875b20e971a1a1d78da1fbdcee36047530b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e1b2868dc743a053d7a3c30609f1a5a7

SHA1
c46034d9f7eb0365c7b620dba0b4998dbc5e031e

SHA256
9f11699885bdc2f6aaf4ee9388c14bc45a9c40c1dc77e24fb3dce7cb08b0506a

SHA512
31598412281fbb236dd159d04d20a94eea44a28a23caad2eb5451898c78316c6c32df4e6d0ff013a2faef41a4356bf0f794598422932e1d3064d55f0bab764c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0eac6578dc5f8177301e1959f8256786

SHA1
cfb3fcd470e68d9ac3b6e90e99b358814b4bd1fd

SHA256
345e332d8bc306371e4c67170618eac3b6d8fecfc39440327238235452a9eacf

SHA512
bee0cbd4bf58bc30610cab6df53bb56c4bbb984106ecc62b37f7b1efaf72e731d83c261bd24f9bf7c182bba324f7db0f41f4bff8db1d4a92ecf717ab33a47a37

Download Submit