7dff5bb591155dbefe6b723e8bd60581448977366758caa202ed4c69dd669820

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2024 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce5c5ebc79ce24a8084d1c6a379a8e5d_JaffaCakes118.html
Size

107KB
MD5

ce5c5ebc79ce24a8084d1c6a379a8e5d
SHA1

e5db627573025537bbc0adf7dfc2a936812055ea
SHA256

7dff5bb591155dbefe6b723e8bd60581448977366758caa202ed4c69dd669820
SHA512

3a8fd2523cd8261ee002a86ffa5f5cd7c323b9ce1a52bca5ed65c518833500b3e2508b9a63eab48022f92d454d5c81c079f492347829cd4a796cbf5b9346c47a
SSDEEP

3072:Ww7zyP5XFXjI22U6ogpY04MHFc3fqt5+G5QodzhN4twnA:9zyP5pM22U6oguGA

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1728	msedge.exe
1728	msedge.exe
4788	msedge.exe
4788	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 4696	4788	msedge.exe	82
PID 4788 wrote to memory of 4696	4788	msedge.exe	82
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 3480	4788	msedge.exe	83
PID 4788 wrote to memory of 1728	4788	msedge.exe	84
PID 4788 wrote to memory of 1728	4788	msedge.exe	84
PID 4788 wrote to memory of 1100	4788	msedge.exe	85
PID 4788 wrote to memory of 1100	4788	msedge.exe	85
PID 4788 wrote to memory of 1100	4788	msedge.exe	85
PID 4788 wrote to memory of 1100	4788	msedge.exe	85
PID 4788 wrote to memory of 1100	4788	msedge.exe	85
PID 4788 wrote to memory of 1100	4788	msedge.exe	85
PID 4788 wrote to memory of 1100	4788	msedge.exe	85
PID 4788 wrote to memory of 1100	4788	msedge.exe	85
PID 4788 wrote to memory of 1100	4788	msedge.exe	85
PID 4788 wrote to memory of 1100	4788	msedge.exe	85
PID 4788 wrote to memory of 1100	4788	msedge.exe	85
PID 4788 wrote to memory of 1100	4788	msedge.exe	85
PID 4788 wrote to memory of 1100	4788	msedge.exe	85
PID 4788 wrote to memory of 1100	4788	msedge.exe	85
PID 4788 wrote to memory of 1100	4788	msedge.exe	85
PID 4788 wrote to memory of 1100	4788	msedge.exe	85
PID 4788 wrote to memory of 1100	4788	msedge.exe	85
PID 4788 wrote to memory of 1100	4788	msedge.exe	85
PID 4788 wrote to memory of 1100	4788	msedge.exe	85
PID 4788 wrote to memory of 1100	4788	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\ce5c5ebc79ce24a8084d1c6a379a8e5d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb78b346f8,0x7ffb78b34708,0x7ffb78b34718
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,11903769460281368132,410271309089579854,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,11903769460281368132,410271309089579854,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,11903769460281368132,410271309089579854,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11903769460281368132,410271309089579854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11903769460281368132,410271309089579854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11903769460281368132,410271309089579854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1692 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,11903769460281368132,410271309089579854,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,11903769460281368132,410271309089579854,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3136 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
684B

MD5
a765c26abbd541e3fb4363a69ef788f4

SHA1
6c7f3e4cb1fb5a5f27f2ac68d37cbdf921f26fdb

SHA256
83fac15b871cf13683f4d25487897ad22e1b75736200552ab8891a2abd23754f

SHA512
49601fadb74bb05d1142726d713c4b59837b85da3c0507b873aa07a010d55ef32e15fbf989a9fddefad0305389a1b24cfee390e7e0b01b02956814c5af18640a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c3db79f29bf912da0e0bf93ef449e951

SHA1
466fe0e9f8a93cbe7f968c2da202cf92b1430e4c

SHA256
f658af6d817db60d194d1bbaba935a4c9a6a69ea54995dd1db702a81f6374394

SHA512
dabb2665d553ed1955c27a8d1ea936052d778877d5ce5a44481241f3d936213868497bdd66db9251da79f702b9b06bbedc3bb267a263acc447cb2e27227d63e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
72d1b1c2b9d0563b4065ace0b0268bcc

SHA1
4197ac28ef811e09756d30f003fdbc0d74bd8895

SHA256
c4a76689894bc1c2c6ee0a462bad125eb8da9076b3abb2f9966c5470b9906470

SHA512
91c2a2610146826b0960ede883586a6236c29e1c1bc673b5959f2a483353ec91acf95e6d64c7bebf00cf5fddc1f5a495b1420cb191ef977f93c633f9217114cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5a7fbb1ee37b7aeac7f057404ab636c4

SHA1
13842e13209c9dc9f654a0818f78761182fc3e88

SHA256
980ab375f92c8117c3c00d877f770a9e7d63c6badb54cb5d4575e126b91d13c4

SHA512
32cdc26523ee6dfe50aae085d2b916cbe5c00d864aa844d7673b40f074fbbfe67ec6cb9496923a389ff1fd3ea40428235d3ee3985383e95dca693c0cdc058819

Download Submit