bf274500ba6fb13b3f936eb88700eb7e67d9ce24fb78f883cf2e469be9735894

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 22:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

424ec80b743ae667fe476565502743b2_JaffaCakes118.html
Size

23KB
MD5

424ec80b743ae667fe476565502743b2
SHA1

53c7aed469110abfb16a24330399a3d9eb169642
SHA256

bf274500ba6fb13b3f936eb88700eb7e67d9ce24fb78f883cf2e469be9735894
SHA512

38e823201c958b858765ecdc5ad62cc1aaaf362357ea0087eba838ac230a0768a1b4e4eb6fac986522459f96d9a7418603c9bc470fecb5e1dca41c853e6c5146
SSDEEP

192:uWLAb5nQSnQjxn5Q/XnQiemNnqnQOkEntNP9nQTbnFnQACnQtMwMBGqnYnQ7tnWn:ZQ/Acn

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2472	msedge.exe
2472	msedge.exe
3512	msedge.exe
3512	msedge.exe
2872	identity_helper.exe
2872	identity_helper.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe
3512	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 2056	3512	msedge.exe	83
PID 3512 wrote to memory of 2056	3512	msedge.exe	83
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 60	3512	msedge.exe	85
PID 3512 wrote to memory of 2472	3512	msedge.exe	86
PID 3512 wrote to memory of 2472	3512	msedge.exe	86
PID 3512 wrote to memory of 64	3512	msedge.exe	87
PID 3512 wrote to memory of 64	3512	msedge.exe	87
PID 3512 wrote to memory of 64	3512	msedge.exe	87
PID 3512 wrote to memory of 64	3512	msedge.exe	87
PID 3512 wrote to memory of 64	3512	msedge.exe	87
PID 3512 wrote to memory of 64	3512	msedge.exe	87
PID 3512 wrote to memory of 64	3512	msedge.exe	87
PID 3512 wrote to memory of 64	3512	msedge.exe	87
PID 3512 wrote to memory of 64	3512	msedge.exe	87
PID 3512 wrote to memory of 64	3512	msedge.exe	87
PID 3512 wrote to memory of 64	3512	msedge.exe	87
PID 3512 wrote to memory of 64	3512	msedge.exe	87
PID 3512 wrote to memory of 64	3512	msedge.exe	87
PID 3512 wrote to memory of 64	3512	msedge.exe	87
PID 3512 wrote to memory of 64	3512	msedge.exe	87
PID 3512 wrote to memory of 64	3512	msedge.exe	87
PID 3512 wrote to memory of 64	3512	msedge.exe	87
PID 3512 wrote to memory of 64	3512	msedge.exe	87
PID 3512 wrote to memory of 64	3512	msedge.exe	87
PID 3512 wrote to memory of 64	3512	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\424ec80b743ae667fe476565502743b2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa62046f8,0x7fffa6204708,0x7fffa6204718
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,4744294261700350054,17910181501757266803,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,4744294261700350054,17910181501757266803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,4744294261700350054,17910181501757266803,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4744294261700350054,17910181501757266803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4744294261700350054,17910181501757266803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:184
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,4744294261700350054,17910181501757266803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,4744294261700350054,17910181501757266803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4744294261700350054,17910181501757266803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4744294261700350054,17910181501757266803,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4744294261700350054,17910181501757266803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,4744294261700350054,17910181501757266803,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,4744294261700350054,17910181501757266803,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
12ffacf5369756ab97a7d233cb02f6bd

SHA1
7f036fa80caf6776a61fed8c8f67dfae239fe463

SHA256
379f8c0fb1b2a61739444ffb3ee56e7c91b217eb035941f34db6bbc0c1826365

SHA512
5bf5ec2fd62e378e56699916322bcaf92e5b34210b82d9d1b53df1821363e2cc7e0db68ebd7ddd8cc44ee01c969d65786768b6ab8cb8f021c058e3c2655f38f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
79f94fc01ce174b3b8866e0f4efbcfab

SHA1
f863160a63248a54749cfdeea8065692de2d5085

SHA256
e5db3ceabbd91289642879aef0bc8fb4c201bfa8d93d382579dac09ae8cec203

SHA512
4602de9a7162ef8cd5e6a161181a1686e7d28bd2f09e94a6ba384fde309aa0599bf1051efcba032068250eb6481b208aaf1814ddb5d074d91cdb331a5f889abb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
50832317534664ac7c747b7390198448

SHA1
211ede19492cfebcd67333994353daac44579925

SHA256
e4cf1219b29c78f8eae28c3e8328fdfc140a1b323053b6495fac3b5aa08149f5

SHA512
6174e592737732e9c99cfd51fa89adf0c830dbfd49295eaad25bc7bd768f97814bcea14848e6dd370ed2ead8d27c2cd8c9a0ef9ec3a73a09701cb39d9d100a6e

Download Submit