651d01b19ddb8155b57245798b93c996e7e9674dc9487e06cb61dbf5020d1c20

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-10-2024 00:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4508c476c37c0b82a5fa3b4d22293668_JaffaCakes118.html
Size

139KB
MD5

4508c476c37c0b82a5fa3b4d22293668
SHA1

50f85d3e226cba3ba4eb2fcd580593093fa49417
SHA256

651d01b19ddb8155b57245798b93c996e7e9674dc9487e06cb61dbf5020d1c20
SHA512

cada4b9a531018ec7df6df8f4f544f4b4472a4f76ccf517b004f9d22a6e3a00bd844913fe037d2ce24aa356dfdaf7b2128b64a56a3d1ee65261f97dd85051495
SSDEEP

1536:SgNXdgqoFXQBgbbXICZlDWpyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP06:SginWpyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe
4504	msedge.exe
4504	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe
2884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4504	msedge.exe
4504	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 1188	4504	msedge.exe	84
PID 4504 wrote to memory of 1188	4504	msedge.exe	84
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 2196	4504	msedge.exe	85
PID 4504 wrote to memory of 1744	4504	msedge.exe	86
PID 4504 wrote to memory of 1744	4504	msedge.exe	86
PID 4504 wrote to memory of 4092	4504	msedge.exe	87
PID 4504 wrote to memory of 4092	4504	msedge.exe	87
PID 4504 wrote to memory of 4092	4504	msedge.exe	87
PID 4504 wrote to memory of 4092	4504	msedge.exe	87
PID 4504 wrote to memory of 4092	4504	msedge.exe	87
PID 4504 wrote to memory of 4092	4504	msedge.exe	87
PID 4504 wrote to memory of 4092	4504	msedge.exe	87
PID 4504 wrote to memory of 4092	4504	msedge.exe	87
PID 4504 wrote to memory of 4092	4504	msedge.exe	87
PID 4504 wrote to memory of 4092	4504	msedge.exe	87
PID 4504 wrote to memory of 4092	4504	msedge.exe	87
PID 4504 wrote to memory of 4092	4504	msedge.exe	87
PID 4504 wrote to memory of 4092	4504	msedge.exe	87
PID 4504 wrote to memory of 4092	4504	msedge.exe	87
PID 4504 wrote to memory of 4092	4504	msedge.exe	87
PID 4504 wrote to memory of 4092	4504	msedge.exe	87
PID 4504 wrote to memory of 4092	4504	msedge.exe	87
PID 4504 wrote to memory of 4092	4504	msedge.exe	87
PID 4504 wrote to memory of 4092	4504	msedge.exe	87
PID 4504 wrote to memory of 4092	4504	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4508c476c37c0b82a5fa3b4d22293668_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9840e46f8,0x7ff9840e4708,0x7ff9840e4718
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,2854394003427851712,5975630376914953438,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,2854394003427851712,5975630376914953438,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,2854394003427851712,5975630376914953438,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2854394003427851712,5975630376914953438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2854394003427851712,5975630376914953438,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,2854394003427851712,5975630376914953438,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1264 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1b9739f5776a018d1dfea64dee3f4897

SHA1
3dcea83f53d046c24318fb0748f4d0652b213456

SHA256
a667d0d19885a961de72e4ba4b89957e9904bb9ac99e878e7fc106da0b3091e0

SHA512
d22f0a192450d4185fe73674d0bde7f2fa1f68bcc16ade038c372028a891d230391e45d08c02db9d11b8fccc250abbc5a29ca3d7759dbab8cb937cb4066e46e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2c40d5d7c5e0a85321aa5a230e68a231

SHA1
c4ac788ba4da6897adc3c9ef661ca6b469fc547e

SHA256
9bc3a5bef04210d4751fd4ed395131776e8f7737a5a377be09fcddfb7eb45384

SHA512
bb513fae1e4dbaed4ae59181407a24fe987c642451e6546fbcf14555fae575ff2d227fc39dee997fd64407d2927973831bfa14645d675c041b2dfc61ed3d55c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3d7eb6dccbad9cdd98fba8cfaf39fbbf

SHA1
f3e5344193b78f4703113bc10acb7887eb6a2dd1

SHA256
f070a3bc0e7ed41026310820a8b8e3b855554481e0a9c0594320470c11a26af7

SHA512
832ac9789a4ab91b5526c4b3a1518468aea5a9ff22d8286ff465eadd6ff904a38191fd96f33af32e2f6b84eb78a515d1fd3d6ffc44389d8699429e4c8b2df2cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1407ce3c81d78eb98720f3efaeea2232

SHA1
493b712eb812087f9f39bf586c01780d7ca07899

SHA256
837cfde3a70d44bb5c5e3931a8e6f189e93bd45f36fcf91757547706577589bc

SHA512
a6e59323916c2eacc7dc50fbd7ba01748c16971f973ca8139a24389aa2810d6c0a740e9cd6280cae11487c057f87bf8625bfd8cf83837fda554ce80bf0fbeeb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
62fa438b48fdfb61c360e6d4fd356110

SHA1
6e54e946a5211afa1459715b9f37a18ea92cdd57

SHA256
fe3d2e83848ede65097467a54ea813ed25a51119e87121089b3cfc531ebe5798

SHA512
01ada296a3fefe713f53d80d2c95b6e41231012d0998077b7948a68d961b61292d1e3b1b3457488eaa739fc4ff0974672ee448d29d2fcce2c1bebab49da96624

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
2fd54f61da8d73378cd668b8cda11bdf

SHA1
e975a7623261de2969e0d47150624001c5cee144

SHA256
14f8adea2804f79e90b23d6e8a63ef0c182ac9debdec75d55aa219d4fdf9da19

SHA512
02d1b584b163c24014cfc841bb0309905db2c1fd15b1044f0c7773151f331e8745c3adbeebb3089f6bee8f5e2d3ef5e575448ca8d9c120725e4b11b4f10971e7

Download Submit