b8c17081353277faac4b76c0bf6ee400093b9e3e40bc9be9fe8ad50ad3230227

Analysis

max time kernel
145s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-09-2024 03:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce879763b06efe97f3c4b5ec30d2a176_JaffaCakes118.html
Size

103KB
MD5

ce879763b06efe97f3c4b5ec30d2a176
SHA1

e8fd05606a2c60b7f49247c1b50e49910e992f28
SHA256

b8c17081353277faac4b76c0bf6ee400093b9e3e40bc9be9fe8ad50ad3230227
SHA512

c42aac7f22e5b48e77f3b3320eb1baf82f80fd4c2e7ac7515b585618886501c7cdc9148ef0f32892e03a187b2e8f6b63e92bbd3097fbb1fc880741e44a7970df
SSDEEP

3072:swKjrLD+ujlveW2S8ZNm1eKIRbOlk14WZcg6DKN3IpTpmDqn76+VNQ1DAl/3s:sRQ3

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe
4904	msedge.exe
4904	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4904	msedge.exe
4904	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 4120	4904	msedge.exe	83
PID 4904 wrote to memory of 4120	4904	msedge.exe	83
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 3084	4904	msedge.exe	84
PID 4904 wrote to memory of 2300	4904	msedge.exe	85
PID 4904 wrote to memory of 2300	4904	msedge.exe	85
PID 4904 wrote to memory of 4988	4904	msedge.exe	86
PID 4904 wrote to memory of 4988	4904	msedge.exe	86
PID 4904 wrote to memory of 4988	4904	msedge.exe	86
PID 4904 wrote to memory of 4988	4904	msedge.exe	86
PID 4904 wrote to memory of 4988	4904	msedge.exe	86
PID 4904 wrote to memory of 4988	4904	msedge.exe	86
PID 4904 wrote to memory of 4988	4904	msedge.exe	86
PID 4904 wrote to memory of 4988	4904	msedge.exe	86
PID 4904 wrote to memory of 4988	4904	msedge.exe	86
PID 4904 wrote to memory of 4988	4904	msedge.exe	86
PID 4904 wrote to memory of 4988	4904	msedge.exe	86
PID 4904 wrote to memory of 4988	4904	msedge.exe	86
PID 4904 wrote to memory of 4988	4904	msedge.exe	86
PID 4904 wrote to memory of 4988	4904	msedge.exe	86
PID 4904 wrote to memory of 4988	4904	msedge.exe	86
PID 4904 wrote to memory of 4988	4904	msedge.exe	86
PID 4904 wrote to memory of 4988	4904	msedge.exe	86
PID 4904 wrote to memory of 4988	4904	msedge.exe	86
PID 4904 wrote to memory of 4988	4904	msedge.exe	86
PID 4904 wrote to memory of 4988	4904	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ce879763b06efe97f3c4b5ec30d2a176_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffa23db46f8,0x7ffa23db4708,0x7ffa23db4718
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,3418506138825861632,4070958752628652073,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,3418506138825861632,4070958752628652073,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,3418506138825861632,4070958752628652073,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3418506138825861632,4070958752628652073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,3418506138825861632,4070958752628652073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,3418506138825861632,4070958752628652073,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
40beed06950e8ef63b25f137535ab948

SHA1
295121494c63e920cb4fb5b0e979f7a8a1febcf2

SHA256
b91b59b3c0e16920346d3cc29e9545cc6c29fcb168fe86d74c9229c187fef813

SHA512
ed1b340169396f52ec4b007db38cb705587706709e546336e38e680f79edbdcf92bcd4be4a49f5c5499a06d18896c9b29af30ecbfb8d42ee4b54e3222d3a6f5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ddfeb9624853251cc62a23c78ee311da

SHA1
174fd1c810d7fc002dad69f129bc812ba1eee2d0

SHA256
864ecd2df109de1c084c5221064bae1defa179732d1024f391ab65b7057ccb2d

SHA512
58b19ce4a3f541b76eeb956056f1fa8eae83484477b87fe5b6618dc3c093273a2312e1871df4169d4c0fc47a368250658d2df85e12d2e79e853721f633ecc296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
daa4255cc462383d342fb7613ee57bd6

SHA1
6ed2fe9faa67217671f9f08826e6502169802018

SHA256
0acaee62f2158b7f2b93d8a84ca5335d87e531922f0a61ca3c019ef766866c15

SHA512
1575869bcb140139a545ef5f8897b7b4f39bfcb7e387aff00c0051935544c3771a9ead7bf21af47c71fa33842a3be4baae00204359cdf7fbe7e9894808eb57db

Download Submit