a94a90ec09c22860179e4d9515ff2b2d99bb6bbed4eecf4a638624940b4957fe

Analysis

max time kernel
139s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2024 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99e91a2e3ab3e78630bc8334df23536c_JaffaCakes118.html
Size

158KB
MD5

99e91a2e3ab3e78630bc8334df23536c
SHA1

6b8696066cd7fd0a45bdb48e5f58b2fcbad9bb47
SHA256

a94a90ec09c22860179e4d9515ff2b2d99bb6bbed4eecf4a638624940b4957fe
SHA512

f70e11685e59213cbcc4770530eae09a36bec01f324150ffc6c7f596c509435386442832d6143277880123aca3ae71957dbb886aaa2e75050b75f8c5d6758be1
SSDEEP

3072:isjL82E0ByfkMY+BES09JXAnyrZalI+YQ:i0Lc0EsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
3656	msedge.exe
3656	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4396	identity_helper.exe
4396	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 856	3656	msedge.exe	85
PID 3656 wrote to memory of 856	3656	msedge.exe	85
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 4400	3656	msedge.exe	86
PID 3656 wrote to memory of 2296	3656	msedge.exe	87
PID 3656 wrote to memory of 2296	3656	msedge.exe	87
PID 3656 wrote to memory of 4004	3656	msedge.exe	88
PID 3656 wrote to memory of 4004	3656	msedge.exe	88
PID 3656 wrote to memory of 4004	3656	msedge.exe	88
PID 3656 wrote to memory of 4004	3656	msedge.exe	88
PID 3656 wrote to memory of 4004	3656	msedge.exe	88
PID 3656 wrote to memory of 4004	3656	msedge.exe	88
PID 3656 wrote to memory of 4004	3656	msedge.exe	88
PID 3656 wrote to memory of 4004	3656	msedge.exe	88
PID 3656 wrote to memory of 4004	3656	msedge.exe	88
PID 3656 wrote to memory of 4004	3656	msedge.exe	88
PID 3656 wrote to memory of 4004	3656	msedge.exe	88
PID 3656 wrote to memory of 4004	3656	msedge.exe	88
PID 3656 wrote to memory of 4004	3656	msedge.exe	88
PID 3656 wrote to memory of 4004	3656	msedge.exe	88
PID 3656 wrote to memory of 4004	3656	msedge.exe	88
PID 3656 wrote to memory of 4004	3656	msedge.exe	88
PID 3656 wrote to memory of 4004	3656	msedge.exe	88
PID 3656 wrote to memory of 4004	3656	msedge.exe	88
PID 3656 wrote to memory of 4004	3656	msedge.exe	88
PID 3656 wrote to memory of 4004	3656	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\99e91a2e3ab3e78630bc8334df23536c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e6ef46f8,0x7ff9e6ef4708,0x7ff9e6ef4718
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,11060465495260516781,15657419862639422293,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,11060465495260516781,15657419862639422293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,11060465495260516781,15657419862639422293,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11060465495260516781,15657419862639422293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11060465495260516781,15657419862639422293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,11060465495260516781,15657419862639422293,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,11060465495260516781,15657419862639422293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,11060465495260516781,15657419862639422293,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11060465495260516781,15657419862639422293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11060465495260516781,15657419862639422293,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11060465495260516781,15657419862639422293,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,11060465495260516781,15657419862639422293,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:4796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2da24b2faa385b109dc99f6000a7550d

SHA1
191a50a8d204a05c2fa2ef37a934b8fc647eab27

SHA256
87b7d67be5cd8360851cd0a30762b7c41a20cb19fed4d184f722d745e1aaf490

SHA512
22fc42e84cfeed971e177b74f0d60f2d9fa1954edd0472de33d0ac4fdc02c8c9d889fe22414a5ceb659d96d9d78e2458ce24c1c0795b0bf786ad402b54dbfd31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
96f9356307ea4f951308538382f7e651

SHA1
38567fc0387f875c61e2e2900f49d761ca9c9408

SHA256
c3ad34565f5c072067e90566ba99732a985e04996ad14dbcb333b9821d03e774

SHA512
18d4a30dcc189758dd08547ba91b54d43a185e5a1b2912a6cb30f73ad2e682216ce216b4001893b79522bb350a68e1a26d9cba5c9fc9bce975fc328d9a6c759d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c4d907e4dc98c15dbe7eb602a93c665b

SHA1
3e68deaef5680e391d20855f422ae55e9e170563

SHA256
f80827b5f8d6f8b24ce364b464eda6350cfdace5a4c98eec8fc665212bd27596

SHA512
76539c8757971bbccbe0804a6c8b1daf621c823cbd1999d86f6219672fc94baa4ff6fba831b1d5e30481bf5dfac04a4666a0932c1401287837831f178ad346a1

Download Submit