481fb1966986fa069490e9f8269a120872b64957e9d5a711faece156691576cb

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 05:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4f5f3021e9fcf972d4b0fe046b653ea_JaffaCakes118.html
Size

13KB
MD5

b4f5f3021e9fcf972d4b0fe046b653ea
SHA1

b67120501be04d7ae943adf0e1a077cf588a0e37
SHA256

481fb1966986fa069490e9f8269a120872b64957e9d5a711faece156691576cb
SHA512

69789f6e07cf46682d77e7d63d726cf5659b23017028ab8aa06a3eae7817d15c0d967c4cb7af5a5778aa0bdf7f562ab15af1fb8c02f4fc1594e9831f8fe61762
SSDEEP

192:CJufTCyLoqEivkMxRBCpuTV83gKDJsWnQ63hVPsfTD9L9N7ljuHY:CuDOm7TVrKDJsWnpxVEfTD9LbwHY

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
4176	msedge.exe
4176	msedge.exe
1888	identity_helper.exe
1888	identity_helper.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 4564	4176	msedge.exe	82
PID 4176 wrote to memory of 4564	4176	msedge.exe	82
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 3100	4176	msedge.exe	83
PID 4176 wrote to memory of 1368	4176	msedge.exe	84
PID 4176 wrote to memory of 1368	4176	msedge.exe	84
PID 4176 wrote to memory of 2512	4176	msedge.exe	85
PID 4176 wrote to memory of 2512	4176	msedge.exe	85
PID 4176 wrote to memory of 2512	4176	msedge.exe	85
PID 4176 wrote to memory of 2512	4176	msedge.exe	85
PID 4176 wrote to memory of 2512	4176	msedge.exe	85
PID 4176 wrote to memory of 2512	4176	msedge.exe	85
PID 4176 wrote to memory of 2512	4176	msedge.exe	85
PID 4176 wrote to memory of 2512	4176	msedge.exe	85
PID 4176 wrote to memory of 2512	4176	msedge.exe	85
PID 4176 wrote to memory of 2512	4176	msedge.exe	85
PID 4176 wrote to memory of 2512	4176	msedge.exe	85
PID 4176 wrote to memory of 2512	4176	msedge.exe	85
PID 4176 wrote to memory of 2512	4176	msedge.exe	85
PID 4176 wrote to memory of 2512	4176	msedge.exe	85
PID 4176 wrote to memory of 2512	4176	msedge.exe	85
PID 4176 wrote to memory of 2512	4176	msedge.exe	85
PID 4176 wrote to memory of 2512	4176	msedge.exe	85
PID 4176 wrote to memory of 2512	4176	msedge.exe	85
PID 4176 wrote to memory of 2512	4176	msedge.exe	85
PID 4176 wrote to memory of 2512	4176	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\b4f5f3021e9fcf972d4b0fe046b653ea_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe93e646f8,0x7ffe93e64708,0x7ffe93e64718
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,790957069768357470,3098681453712324748,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,790957069768357470,3098681453712324748,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,790957069768357470,3098681453712324748,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,790957069768357470,3098681453712324748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,790957069768357470,3098681453712324748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,790957069768357470,3098681453712324748,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,790957069768357470,3098681453712324748,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,790957069768357470,3098681453712324748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,790957069768357470,3098681453712324748,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,790957069768357470,3098681453712324748,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,790957069768357470,3098681453712324748,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,790957069768357470,3098681453712324748,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b2473bf8abf011b4886d1da55b13f567

SHA1
47b43b95bedc8ada03fc31feaef82f44e549a222

SHA256
b7e56e1980acc9933ea571b92a76d696bcf1896391871dd0ee838080149d27b0

SHA512
d13fef4f053b0560fd74dae544c0bbf92e4853c0886856f1da38e69c7f4f78e4f567d90563c74aff509ccb7ab07f87bf3e953f4585892e8788649376cbbac6b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3bd394c3a0c02e7626b41ef317a483a8

SHA1
f7f19869010820b5d822e1f6f4940a78c9c64c17

SHA256
be06f6433a113b62e577c3f0bb87936863c45ecad3d5719c2ac9ea6345aabfbf

SHA512
b8ea14a62595331043f9d0f39f52b9211e75dc30b31acd84360da32ddaefab169c9f1ba0ec0667eff038c1dcb9ec8084c8a285894d34ee5638835c4bec59f0dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b87c7803f9b9b8268b6b61ca81a5af53

SHA1
e88ce0c2674100a239ab25449e6ea04f06b15217

SHA256
954538e8100ad33ca4f85437100d95bc20fdcf446df4b441448ecf9e74514ede

SHA512
b686a0046b91d98087cba2c95f3dce6bd3b8e0a4edd04180065f142bfe2aa088b79dc8dbd38af44a3a42b03126abeab94a99784bc6961e85eab5e4d8c39b3148

Download Submit