4b43acc3076801270cf47537825e76c3de04180cbcd627408caadf1207f6352e

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2024, 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

450deb2f6a1793670173b82ad5291133_JaffaCakes118.html
Size

139KB
MD5

450deb2f6a1793670173b82ad5291133
SHA1

5772677896f01336a222a26f57a6e213523b0584
SHA256

4b43acc3076801270cf47537825e76c3de04180cbcd627408caadf1207f6352e
SHA512

9d773da4c25deccdf446744f849c622a4ed70b8ffd7cdc9414b509e456d3f93f1186aa241fe790e2c26775370283156ae3a1985266a398a30c4795e29b0679fa
SSDEEP

3072:SckbtSY0P9R+yfkMY+BES09JXAnyrZalI+YQ:SckT0PDbsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe
1260	msedge.exe
1260	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe
3828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1260	msedge.exe
1260	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 440	1260	msedge.exe	84
PID 1260 wrote to memory of 440	1260	msedge.exe	84
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 1056	1260	msedge.exe	85
PID 1260 wrote to memory of 2300	1260	msedge.exe	86
PID 1260 wrote to memory of 2300	1260	msedge.exe	86
PID 1260 wrote to memory of 3208	1260	msedge.exe	87
PID 1260 wrote to memory of 3208	1260	msedge.exe	87
PID 1260 wrote to memory of 3208	1260	msedge.exe	87
PID 1260 wrote to memory of 3208	1260	msedge.exe	87
PID 1260 wrote to memory of 3208	1260	msedge.exe	87
PID 1260 wrote to memory of 3208	1260	msedge.exe	87
PID 1260 wrote to memory of 3208	1260	msedge.exe	87
PID 1260 wrote to memory of 3208	1260	msedge.exe	87
PID 1260 wrote to memory of 3208	1260	msedge.exe	87
PID 1260 wrote to memory of 3208	1260	msedge.exe	87
PID 1260 wrote to memory of 3208	1260	msedge.exe	87
PID 1260 wrote to memory of 3208	1260	msedge.exe	87
PID 1260 wrote to memory of 3208	1260	msedge.exe	87
PID 1260 wrote to memory of 3208	1260	msedge.exe	87
PID 1260 wrote to memory of 3208	1260	msedge.exe	87
PID 1260 wrote to memory of 3208	1260	msedge.exe	87
PID 1260 wrote to memory of 3208	1260	msedge.exe	87
PID 1260 wrote to memory of 3208	1260	msedge.exe	87
PID 1260 wrote to memory of 3208	1260	msedge.exe	87
PID 1260 wrote to memory of 3208	1260	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\450deb2f6a1793670173b82ad5291133_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa803c46f8,0x7ffa803c4708,0x7ffa803c4718
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,975023150823426458,1233569043640831902,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,975023150823426458,1233569043640831902,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,975023150823426458,1233569043640831902,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,975023150823426458,1233569043640831902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,975023150823426458,1233569043640831902,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,975023150823426458,1233569043640831902,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
476B

MD5
26b8e18b20315c41969864ea111bdb0d

SHA1
3004ee765c9fa2358ca766078331528875a2e9ae

SHA256
518ca8f2f8e98f07ddbc494834fbbfac69308429655d8361469cded4c3d634c9

SHA512
1b23bf09933a3f7c8c0e5a22a56350bf88838abb64742d2d571c6e465e91fd438f576a3580f0cd026943114cee1bb00e14901183e6a7b41e095ca0169b499367

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
15710fc4089495b208a8d2aa179f0481

SHA1
49aa6d6da8c6424db1ac11df99d3e5fb614098be

SHA256
df33283c0ad23dcdf594e2b9d81030b6cdd58d208626a958b0578df9948f3fc9

SHA512
a052dc4ee62de3266ff172b78ff37ea606ed3e0150bf1fbf19d13e85bf09a1f05f1b3826549fba9c25f79eddfea5a65802eaea9880de71e8412875f65c0d89ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2ac2a63a96cc86dc43449ee22fe6e1b1

SHA1
2851fa4d37c7b0aff55d38051ddab0ea1146b7e5

SHA256
7637a99ca4d8769c213d00d8edd08c8e040beebbfaf8298d722de15a9e5d57a8

SHA512
d0b86684fc4f387551958cf3a291b42afc1d78bf9caf6885fc72310b7c03204d69caf05b2d066bee3050e161538ff4decac840c89a9e5ea0b1246f319e70190c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
15caf95f477eb0c5e534c59a09587574

SHA1
d8ceb862fea304036a67a1bda904854e74a53b95

SHA256
5ab82314fd8c64eba1229301cd609ccca92c9d29fe8b78d69d680da847854e84

SHA512
e3bbc9ae7eb253bade828cbd78ce621fb35ee4b81f0989604e381a2f044ae8176929ae7c2a72a459d9694c5a74b803325b6ab2a38f2ace692da369ec653e2ce6

Download Submit