a1800455fd921ee36e819503e8da6e04c4fe7110244b7fc70c5a58b05a99f1f0

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 13:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a5650b05236a202df50b4128caff3e3_JaffaCakes118.html
Size

226KB
MD5

3a5650b05236a202df50b4128caff3e3
SHA1

b1ed1e4c134ac04b3b8b179ca7880156366c78fe
SHA256

a1800455fd921ee36e819503e8da6e04c4fe7110244b7fc70c5a58b05a99f1f0
SHA512

1d5f837c7ee68c5f7602a55e37c36dce69510db6443ad1cdfe7876d7fe558a057097879ef1c71a6850bbd162f394c080633ab135d4333af04b377d4497d1951f
SSDEEP

3072:SZMyfkMY+BES09JXAnyrZalI+YuyfkMY+BES09JXAnyrZalI+YQ:SZxsMYod+X3oI+YLsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3148	msedge.exe
3148	msedge.exe
3232	identity_helper.exe
3232	identity_helper.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe
1604	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe
3148	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 4796	3148	msedge.exe	83
PID 3148 wrote to memory of 4796	3148	msedge.exe	83
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 2000	3148	msedge.exe	85
PID 3148 wrote to memory of 3204	3148	msedge.exe	86
PID 3148 wrote to memory of 3204	3148	msedge.exe	86
PID 3148 wrote to memory of 4268	3148	msedge.exe	87
PID 3148 wrote to memory of 4268	3148	msedge.exe	87
PID 3148 wrote to memory of 4268	3148	msedge.exe	87
PID 3148 wrote to memory of 4268	3148	msedge.exe	87
PID 3148 wrote to memory of 4268	3148	msedge.exe	87
PID 3148 wrote to memory of 4268	3148	msedge.exe	87
PID 3148 wrote to memory of 4268	3148	msedge.exe	87
PID 3148 wrote to memory of 4268	3148	msedge.exe	87
PID 3148 wrote to memory of 4268	3148	msedge.exe	87
PID 3148 wrote to memory of 4268	3148	msedge.exe	87
PID 3148 wrote to memory of 4268	3148	msedge.exe	87
PID 3148 wrote to memory of 4268	3148	msedge.exe	87
PID 3148 wrote to memory of 4268	3148	msedge.exe	87
PID 3148 wrote to memory of 4268	3148	msedge.exe	87
PID 3148 wrote to memory of 4268	3148	msedge.exe	87
PID 3148 wrote to memory of 4268	3148	msedge.exe	87
PID 3148 wrote to memory of 4268	3148	msedge.exe	87
PID 3148 wrote to memory of 4268	3148	msedge.exe	87
PID 3148 wrote to memory of 4268	3148	msedge.exe	87
PID 3148 wrote to memory of 4268	3148	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3a5650b05236a202df50b4128caff3e3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a54a46f8,0x7ff9a54a4708,0x7ff9a54a4718
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,7978374040379341854,14032319185297590098,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,7978374040379341854,14032319185297590098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,7978374040379341854,14032319185297590098,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7978374040379341854,14032319185297590098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7978374040379341854,14032319185297590098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,7978374040379341854,14032319185297590098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4156 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,7978374040379341854,14032319185297590098,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7978374040379341854,14032319185297590098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7978374040379341854,14032319185297590098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7978374040379341854,14032319185297590098,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7978374040379341854,14032319185297590098,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,7978374040379341854,14032319185297590098,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3144 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fb0d9901b1c5622238f6d8e973bab29a

SHA1
3278ad66f4bef2b400f4439fc4d2c4eb626be622

SHA256
50ce9b753b98b57ffde559dbbf6cc1cc545ca674e7275d9af64b991bc2b3f03f

SHA512
f4ae0e8fe8fa756fb7a4762370daffd9b788ed034f6607d955a49e266b28c185a2f22a936380b3db289aa9d6e50112e1e0615d725aa67eb6f1c47fc5e334d60b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2f5b009e3a7c645599b5e8a426c59ade

SHA1
315a986e44bf47863ae85990290f08c866608c13

SHA256
4c5b6bbd10343d0a211c4d683f61e96c0dc7f38936598d64cba53357ab7da62a

SHA512
0173e0602f346c335f895d95c5b976ccc75f7f5392df6519ee9fc236fbb08eb30267b4db4c5987086b4c315a0c5c9a2b0338186ca68d7071d73d0007229244f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b4714f6fbc980dd5819bade7d6af15e2

SHA1
6ffd92df45693a9599d060dd14e12d19a459caff

SHA256
a0df101e688b4b8d99a9269fe60878f427deabb18dfc51e9e9125c5b2e292cc2

SHA512
112073fc1d8c23724fcee7d269eb1ddf05caf2c2c921787e91c9236a2465afee7e01e53925a41186a9e0a5a48eb4f42f488badc178f3eeb7a76413788ae85da9

Download Submit