a45200fd4db9252858966dfe88ca5f458a088fc9002b062936cb0203177174ea

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b2d6a3fabbf58da02adb49ac5016e67_JaffaCakes118.html
Size

14KB
MD5

2b2d6a3fabbf58da02adb49ac5016e67
SHA1

e6935b0ff68891d826527271302f83ad848cc870
SHA256

a45200fd4db9252858966dfe88ca5f458a088fc9002b062936cb0203177174ea
SHA512

ec1530e41bf9c5820cdaa9937e8de9376b70f4948be454315604221397bd3034e808341a8bfd495e1ed8c5d1e2ce7aa9eca0dffcc1a6f75f5e06afef71a2de7d
SSDEEP

384:rqoG86/V4Z/Hw3CqegfpoxKWEsu4exRDUFIB:rqSH4WEsmxpUuB

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
2884	msedge.exe
2884	msedge.exe
4760	identity_helper.exe
4760	identity_helper.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2340	2884	msedge.exe	83
PID 2884 wrote to memory of 2340	2884	msedge.exe	83
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4856	2884	msedge.exe	84
PID 2884 wrote to memory of 4780	2884	msedge.exe	85
PID 2884 wrote to memory of 4780	2884	msedge.exe	85
PID 2884 wrote to memory of 2152	2884	msedge.exe	86
PID 2884 wrote to memory of 2152	2884	msedge.exe	86
PID 2884 wrote to memory of 2152	2884	msedge.exe	86
PID 2884 wrote to memory of 2152	2884	msedge.exe	86
PID 2884 wrote to memory of 2152	2884	msedge.exe	86
PID 2884 wrote to memory of 2152	2884	msedge.exe	86
PID 2884 wrote to memory of 2152	2884	msedge.exe	86
PID 2884 wrote to memory of 2152	2884	msedge.exe	86
PID 2884 wrote to memory of 2152	2884	msedge.exe	86
PID 2884 wrote to memory of 2152	2884	msedge.exe	86
PID 2884 wrote to memory of 2152	2884	msedge.exe	86
PID 2884 wrote to memory of 2152	2884	msedge.exe	86
PID 2884 wrote to memory of 2152	2884	msedge.exe	86
PID 2884 wrote to memory of 2152	2884	msedge.exe	86
PID 2884 wrote to memory of 2152	2884	msedge.exe	86
PID 2884 wrote to memory of 2152	2884	msedge.exe	86
PID 2884 wrote to memory of 2152	2884	msedge.exe	86
PID 2884 wrote to memory of 2152	2884	msedge.exe	86
PID 2884 wrote to memory of 2152	2884	msedge.exe	86
PID 2884 wrote to memory of 2152	2884	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2b2d6a3fabbf58da02adb49ac5016e67_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a4b946f8,0x7ff9a4b94708,0x7ff9a4b94718
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,7293759632007685644,10995266869794346151,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,7293759632007685644,10995266869794346151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,7293759632007685644,10995266869794346151,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7293759632007685644,10995266869794346151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7293759632007685644,10995266869794346151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7293759632007685644,10995266869794346151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7293759632007685644,10995266869794346151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7293759632007685644,10995266869794346151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1744 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7293759632007685644,10995266869794346151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7293759632007685644,10995266869794346151,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,7293759632007685644,10995266869794346151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1744 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,7293759632007685644,10995266869794346151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7293759632007685644,10995266869794346151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,7293759632007685644,10995266869794346151,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,7293759632007685644,10995266869794346151,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3172 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\452512ba-bd01-4892-9650-a7be9b739542.tmp

Filesize
10KB

MD5
f1a831a127b6cdb4e24d099e843ec77c

SHA1
b45a9fbd3a09e6a85c64713de705ed87f15ee4f0

SHA256
6888151e96dae3f458ded230e00d1eba93cef7e7b0d844ed335d1c10f675f2ba

SHA512
270c609d3f350e5b97d4325bc31d4cd5b572516cb4aa244335de4cd98e8494114160068f2bf6ad28de6d4d7214e962a9cf3c0ca60030dd5d6289631ca46373af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b4f3af3738e36fb293a9cd7c85fea69e

SHA1
041b195704f24b29a5004216c6081a4e0d963ae1

SHA256
592b9fd59a83a26a5be71e93c03cc4e81b05528f0ef30dfbc216316c8f9df15a

SHA512
0fb2582bd118a7029b436804f22126a9772dc64f37957a2039f40f4ed4081fa94427009ecad636c8f2af645a7296fbb5ddc3916f9b76e10c0195efdcaf6678b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
979fa6ef35fa80f6b6087791edce0c16

SHA1
43d1e4b553bc712575f326900ef9cee53691ffe7

SHA256
61284e8de9b5e0189afa2698060a46a120c8a7c5ac58a9ca7016acffbf1dcaed

SHA512
bc29a852d79f3062e808cb9df5416f3062f322d9c20112fe672de8b2bd9c83edfe2aafd4c80be4cdc4007da3708022df66a0e147c468c2809a5df1ec9e5c8d10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit