0d679d95989e8e1147dc975e8af5942ca81a58ba703225e57bad6be8d19c62f4

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

390eb66061978c56eae9765d14513280_JaffaCakes118.html
Size

49KB
MD5

390eb66061978c56eae9765d14513280
SHA1

9c91c6167159b93188f3454963e5c3a0a333aad1
SHA256

0d679d95989e8e1147dc975e8af5942ca81a58ba703225e57bad6be8d19c62f4
SHA512

c32539cc072db04c6101f6fa4f23847f36d3029ba5ddb1c1d2be6b8025d1f535c762499090324a1f2e212209ab0cae78a3c65a7dc06f46b04ebd9da2eba4eede
SSDEEP

1536:Dux6TWQI9x+hwqePIpOz7KmVeOEOvAfavSLSy:E6TW2OvAfavg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1216	msedge.exe
1216	msedge.exe
3532	msedge.exe
3532	msedge.exe
640	identity_helper.exe
640	identity_helper.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 1852	3532	msedge.exe	85
PID 3532 wrote to memory of 1852	3532	msedge.exe	85
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 4884	3532	msedge.exe	86
PID 3532 wrote to memory of 1216	3532	msedge.exe	87
PID 3532 wrote to memory of 1216	3532	msedge.exe	87
PID 3532 wrote to memory of 2212	3532	msedge.exe	88
PID 3532 wrote to memory of 2212	3532	msedge.exe	88
PID 3532 wrote to memory of 2212	3532	msedge.exe	88
PID 3532 wrote to memory of 2212	3532	msedge.exe	88
PID 3532 wrote to memory of 2212	3532	msedge.exe	88
PID 3532 wrote to memory of 2212	3532	msedge.exe	88
PID 3532 wrote to memory of 2212	3532	msedge.exe	88
PID 3532 wrote to memory of 2212	3532	msedge.exe	88
PID 3532 wrote to memory of 2212	3532	msedge.exe	88
PID 3532 wrote to memory of 2212	3532	msedge.exe	88
PID 3532 wrote to memory of 2212	3532	msedge.exe	88
PID 3532 wrote to memory of 2212	3532	msedge.exe	88
PID 3532 wrote to memory of 2212	3532	msedge.exe	88
PID 3532 wrote to memory of 2212	3532	msedge.exe	88
PID 3532 wrote to memory of 2212	3532	msedge.exe	88
PID 3532 wrote to memory of 2212	3532	msedge.exe	88
PID 3532 wrote to memory of 2212	3532	msedge.exe	88
PID 3532 wrote to memory of 2212	3532	msedge.exe	88
PID 3532 wrote to memory of 2212	3532	msedge.exe	88
PID 3532 wrote to memory of 2212	3532	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\390eb66061978c56eae9765d14513280_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc634746f8,0x7ffc63474708,0x7ffc63474718
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,14830259501294665471,3266622464090698649,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,14830259501294665471,3266622464090698649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,14830259501294665471,3266622464090698649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14830259501294665471,3266622464090698649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14830259501294665471,3266622464090698649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,14830259501294665471,3266622464090698649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,14830259501294665471,3266622464090698649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14830259501294665471,3266622464090698649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14830259501294665471,3266622464090698649,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14830259501294665471,3266622464090698649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,14830259501294665471,3266622464090698649,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,14830259501294665471,3266622464090698649,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4892 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
245B

MD5
c339c650ff7df4c374b206d0ee6d3a2a

SHA1
742ac917076fdcc0c393e177b26b6ee200f903bb

SHA256
5c51dbd49fd6ab9ca2fc2f7f244c5ad55650ae686feda46c8512a09c9128c037

SHA512
c59bbf82e02a0ebd1d0dd46d693fc9c3a1b76d7409fc55a38c38a97f94381662e80c72c562da50ad56d33255e139abb6d24a2635d996f11862136ebbc9c746a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ecadfaf6eb719cd088e0e501c665dce4

SHA1
156a7c0a87ac4e23b7aac4eb9bd55b0ee3273c4e

SHA256
e35cf08d9db5cc4a3c9ed473c59b83d484d5777f9b6bc752394ef3354d7b7c2c

SHA512
be9713a31171eeb2c9b73bf36d82ba5c71acee819f76bfea4e059c87b8a437226ed23dc5204126cd9ec7df29103069147a310f580a72da66e5857db1ee3d4732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a16af937e716941092b72a9d99174092

SHA1
25ad96ce9ea7a7adab8534a11d5ce2ec1b624dc7

SHA256
32e106fba54e0f759e518dc198c6318045eae4b85f9096bd17e7439423f962f0

SHA512
5c6c2fd9fca846815d86a78bffe3dbe67d02d7778b8ff25ad94c21d834387daead02fe5e464a52a960e1f0e142dabfbc6084fe6290c6ab57efecf873997c5e3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
289271e3eb68ad0bf7c1377f52eeea4c

SHA1
bb63f555e0c0202ca7fc698cfb0f896866ce2cbd

SHA256
69b5f6243ecba333450bfa708fff99782c4ce292a9e93844a431250e8410158f

SHA512
b7f2a3e061c54d9f4eb4f1f628f8684906df5c04971951e8e5519c79b1ffc42a6b49167c198d0c2620d0080893a7a669cd24aeab09b232b92b5f5f43c179280f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
1ec522fbd9ee01514bd0953e003d40bc

SHA1
6ca8c780d53f0582be999650c3990eb571b5ac24

SHA256
9d08db493240c81069827e7a8e67de62449ea6542e5d203913bdbc5fcf895f5a

SHA512
d40b5bf3cfe8e33fada1577ec0cda817854a0856d5b5aea0dce188e79b440a2c6b16a7ca5a08499e5e5dce642361ec6c30ced36c2bdb8cedc57da7c67f14cd51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5811be.TMP

Filesize
372B

MD5
d381493534b7a61ae54e055b4d4e1242

SHA1
dfb5781b7d9b66efc6ce40f8772e01c9869be679

SHA256
6ba2e6500a645114b2f632df7dfcddb25b1b1c4d65c46c0aa47a58d5129c5fa6

SHA512
25b8ea234675733c2adddda663d4ec8c81d9af1946470acad97f5964735c592c1509462a2ddf4d31518f5657f68a523c615fbaf97f4dfca9987d5a7267b98390

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bcb2bfdbb26af3e895e06158c173c69e

SHA1
cea1a488768ba2be881a94e1d817f9b3e1f6442c

SHA256
c5fc4b28d6a678b9dbf7624e444f81b2e221274fe53112ac5f595071121283f1

SHA512
ba0492faedc5425c73393e40a4ba0e90b2a7ec4691c72877e93b71b36d9a592664328d472eb154ba38058e21e7f1d9e8b75caa0400d89c11bf5bb0940e09d3da

Download Submit