b8128cf5c62e6b909240ed0dde1f5dd4cbe3c6e45e70ffab042f734dfa7d4f10

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2024 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

925700649caca66856bd9ea637dfe300_JaffaCakes118.html
Size

130KB
MD5

925700649caca66856bd9ea637dfe300
SHA1

44c379d3220c77ef69fec0493cda9884de72dc03
SHA256

b8128cf5c62e6b909240ed0dde1f5dd4cbe3c6e45e70ffab042f734dfa7d4f10
SHA512

74336413eed82c7dd61bdcf77a99c6b64e9796c5fc0a66d8e5e49c1f98fce601b9b4f9dcfa27fd93f1586c4f4196b726957822c50e2737a2811942927c9fd6c5
SSDEEP

1536:SPJH4OTl8kRKEyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:SWEyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1068	msedge.exe
1068	msedge.exe
1736	msedge.exe
1736	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 4416	1736	msedge.exe	84
PID 1736 wrote to memory of 4416	1736	msedge.exe	84
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 548	1736	msedge.exe	85
PID 1736 wrote to memory of 1068	1736	msedge.exe	86
PID 1736 wrote to memory of 1068	1736	msedge.exe	86
PID 1736 wrote to memory of 2916	1736	msedge.exe	87
PID 1736 wrote to memory of 2916	1736	msedge.exe	87
PID 1736 wrote to memory of 2916	1736	msedge.exe	87
PID 1736 wrote to memory of 2916	1736	msedge.exe	87
PID 1736 wrote to memory of 2916	1736	msedge.exe	87
PID 1736 wrote to memory of 2916	1736	msedge.exe	87
PID 1736 wrote to memory of 2916	1736	msedge.exe	87
PID 1736 wrote to memory of 2916	1736	msedge.exe	87
PID 1736 wrote to memory of 2916	1736	msedge.exe	87
PID 1736 wrote to memory of 2916	1736	msedge.exe	87
PID 1736 wrote to memory of 2916	1736	msedge.exe	87
PID 1736 wrote to memory of 2916	1736	msedge.exe	87
PID 1736 wrote to memory of 2916	1736	msedge.exe	87
PID 1736 wrote to memory of 2916	1736	msedge.exe	87
PID 1736 wrote to memory of 2916	1736	msedge.exe	87
PID 1736 wrote to memory of 2916	1736	msedge.exe	87
PID 1736 wrote to memory of 2916	1736	msedge.exe	87
PID 1736 wrote to memory of 2916	1736	msedge.exe	87
PID 1736 wrote to memory of 2916	1736	msedge.exe	87
PID 1736 wrote to memory of 2916	1736	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\925700649caca66856bd9ea637dfe300_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd70846f8,0x7ffcd7084708,0x7ffcd7084718
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,1872244663102303456,7632930690848609938,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,1872244663102303456,7632930690848609938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,1872244663102303456,7632930690848609938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1872244663102303456,7632930690848609938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,1872244663102303456,7632930690848609938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,1872244663102303456,7632930690848609938,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2ded645846a6b07acf230fbd83ce8e80

SHA1
d12956fa68e433b879ccecb54d321345aea502df

SHA256
ef9b98f5c887d00df3d8eb9d4c1d338ee506aa4875c3d4b27bc9152dec03cc8c

SHA512
66739b25dfa932d160a50f802708e2eb76f9bacdaf90f8e751311e5f9f3d7c694d124a7090774c8b71c284b6243db72268db1f2bc590756e3106319d635cdfa0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
34e0eaa1f176b083999bb9925d2dac83

SHA1
91b087148311fa34917f621f86c25fc5ca861635

SHA256
995782e3a0cce9215c72f3ead4fd5be2d9e4dc514e85f4cd4525bb849716ae05

SHA512
acbdf07a1241303f0cfda19af2c3a039e7fffcd419337809a6a08a4cfa293cdbaaf83d9e829e1416442e973f323590c756a6d093847b8412593c15d69d17b5d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
671d0f2636a786b331e830de61ab3982

SHA1
9297328d7cb4afabfca03e8c9201fc17fef86b3f

SHA256
6c2ea74a259c48198359927b146249977ff408c7f1b89e166ef829a7d4fc5d39

SHA512
1c502c0c2e70a2c0f86cf0d2e877574d506fbd818132dee9709a262176581c7b5a8057ca3dbe80f82cf358d106e7ab711d84f5cb545a88754ecdfac078c54700

Download Submit