8d7dfff5fa9998cbe0152d890477338baf5578745e3e0114b7537670bb8c36e9

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25d0a3485bcd62740bdeb966ac03e77d_JaffaCakes118.html
Size

139KB
MD5

25d0a3485bcd62740bdeb966ac03e77d
SHA1

320633b2f1b95f028846670978cdddf2f3af1542
SHA256

8d7dfff5fa9998cbe0152d890477338baf5578745e3e0114b7537670bb8c36e9
SHA512

d77b82b8e0f5a3edb5b3916d60ad3e5747ee6654375e552af54aeb76adb16a056758807604826ce92ec9b133fa38fc51132e539ee73214044a2d120962830526
SSDEEP

1536:SONoxJUPpBBieumwflXnzyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09wd:SOruvnzyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe
3468	msedge.exe
3468	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 5116	3468	msedge.exe	83
PID 3468 wrote to memory of 5116	3468	msedge.exe	83
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 2272	3468	msedge.exe	84
PID 3468 wrote to memory of 3244	3468	msedge.exe	85
PID 3468 wrote to memory of 3244	3468	msedge.exe	85
PID 3468 wrote to memory of 3132	3468	msedge.exe	86
PID 3468 wrote to memory of 3132	3468	msedge.exe	86
PID 3468 wrote to memory of 3132	3468	msedge.exe	86
PID 3468 wrote to memory of 3132	3468	msedge.exe	86
PID 3468 wrote to memory of 3132	3468	msedge.exe	86
PID 3468 wrote to memory of 3132	3468	msedge.exe	86
PID 3468 wrote to memory of 3132	3468	msedge.exe	86
PID 3468 wrote to memory of 3132	3468	msedge.exe	86
PID 3468 wrote to memory of 3132	3468	msedge.exe	86
PID 3468 wrote to memory of 3132	3468	msedge.exe	86
PID 3468 wrote to memory of 3132	3468	msedge.exe	86
PID 3468 wrote to memory of 3132	3468	msedge.exe	86
PID 3468 wrote to memory of 3132	3468	msedge.exe	86
PID 3468 wrote to memory of 3132	3468	msedge.exe	86
PID 3468 wrote to memory of 3132	3468	msedge.exe	86
PID 3468 wrote to memory of 3132	3468	msedge.exe	86
PID 3468 wrote to memory of 3132	3468	msedge.exe	86
PID 3468 wrote to memory of 3132	3468	msedge.exe	86
PID 3468 wrote to memory of 3132	3468	msedge.exe	86
PID 3468 wrote to memory of 3132	3468	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\25d0a3485bcd62740bdeb966ac03e77d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe18f46f8,0x7fffe18f4708,0x7fffe18f4718
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13712476709384163795,1797855665208136649,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,13712476709384163795,1797855665208136649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,13712476709384163795,1797855665208136649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13712476709384163795,1797855665208136649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13712476709384163795,1797855665208136649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13712476709384163795,1797855665208136649,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8c764bde337e7ae4bc2c07cf59a830ff

SHA1
c149e01f53062e1733e5f44de6724d1629af0a5e

SHA256
1ff072ea5ec998624618c525ac0ac07fbe839d26c0e2de2f4ced7b530317d8e5

SHA512
ef0924c434b2fb1360b1e1a6ca1710fa97b0846b99a919cce16afa4373c49969ecc551235a09f97d6d808f3a85e6639df7aed06a47172cd10d1bb82bb6906865

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2404316522b5aad6cd4088c49f2173d3

SHA1
200102c5e05b6f894204a1f0eadf181294d87789

SHA256
61a523e4dccfba98e2c985543d47df475908ea8c19cc8b10c07d73d4e6a391aa

SHA512
d6ac84596cf55e1934f5457f0692e517cdf54e6f055e2081f57c1873859704b93747a2ee0953fae4978684b40f8eb5e8fd229fd2d61d54894980371f3be0d145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a8770baacdc0ebc3b0006be6b5e749f4

SHA1
38b5e41b6fa7ba22d70f88baa60501cdb6c9a7c9

SHA256
59a370cec407ac3712d99b55beb8b7c49ea4e271510b58ff7cc95d3ec64baeb7

SHA512
a1cb23dbd283aaacd0d6c8502acbe57fd7b08b4e5d378e562279e7a8736eb307dc144819aac444d199669c717b291d2573dc5586f44f2b6244390de16dc613eb

Download Submit