f854950f7d80e9d13bbdfb199f563e084a22fc994d8b35108ce5c0edde47d5ae

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4eeecc50b7046bdde5dced7cd4c9173_JaffaCakes118.html
Size

139KB
MD5

b4eeecc50b7046bdde5dced7cd4c9173
SHA1

33e7b1e1254e387e1e4e9aeb50fc67018477149a
SHA256

f854950f7d80e9d13bbdfb199f563e084a22fc994d8b35108ce5c0edde47d5ae
SHA512

efed14230566e3e289cafecbee51666317dd8a75fff68f72f318131868f21e186e1a2c83fcab404945a96bb84ddee1e1860e1df5a4468014f8ce5869e3a02d15
SSDEEP

1536:SRHu0HClktlvT5OHyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3om:SRGlkVOHyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
3252	msedge.exe
3252	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe
3252	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 1668	3252	msedge.exe	83
PID 3252 wrote to memory of 1668	3252	msedge.exe	83
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 864	3252	msedge.exe	84
PID 3252 wrote to memory of 5076	3252	msedge.exe	85
PID 3252 wrote to memory of 5076	3252	msedge.exe	85
PID 3252 wrote to memory of 5084	3252	msedge.exe	86
PID 3252 wrote to memory of 5084	3252	msedge.exe	86
PID 3252 wrote to memory of 5084	3252	msedge.exe	86
PID 3252 wrote to memory of 5084	3252	msedge.exe	86
PID 3252 wrote to memory of 5084	3252	msedge.exe	86
PID 3252 wrote to memory of 5084	3252	msedge.exe	86
PID 3252 wrote to memory of 5084	3252	msedge.exe	86
PID 3252 wrote to memory of 5084	3252	msedge.exe	86
PID 3252 wrote to memory of 5084	3252	msedge.exe	86
PID 3252 wrote to memory of 5084	3252	msedge.exe	86
PID 3252 wrote to memory of 5084	3252	msedge.exe	86
PID 3252 wrote to memory of 5084	3252	msedge.exe	86
PID 3252 wrote to memory of 5084	3252	msedge.exe	86
PID 3252 wrote to memory of 5084	3252	msedge.exe	86
PID 3252 wrote to memory of 5084	3252	msedge.exe	86
PID 3252 wrote to memory of 5084	3252	msedge.exe	86
PID 3252 wrote to memory of 5084	3252	msedge.exe	86
PID 3252 wrote to memory of 5084	3252	msedge.exe	86
PID 3252 wrote to memory of 5084	3252	msedge.exe	86
PID 3252 wrote to memory of 5084	3252	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\b4eeecc50b7046bdde5dced7cd4c9173_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa470446f8,0x7ffa47044708,0x7ffa47044718
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,11500530857930437740,11348787682672249238,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,11500530857930437740,11348787682672249238,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,11500530857930437740,11348787682672249238,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11500530857930437740,11348787682672249238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11500530857930437740,11348787682672249238,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,11500530857930437740,11348787682672249238,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1720

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a59637800e1329a59199de2b97168cad

SHA1
a3e0f469c8e5385d65e4d1f0ddc732799e3689e7

SHA256
13ae4dc4a8fffa1835cf9739ea98a90db9a02b11b0f7cd17222b659573d569b8

SHA512
af58e0a8a674a7263a87fa4c0ab52c7343bcaf9fb6085d090c6326bbcdec089ce1af8899035e8901de54177e8c1ddf0d9f13123d9030042ae7c5e7c3e8c3c7f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
798841ef1fc6fb7ced40bbee55f2f2c0

SHA1
d60185d42b7fc91ab0f24ce0d2e5439a90fd4109

SHA256
99abc382804594c4acedffc840c7ce6deb6233b6e8919ca15a3eff006c1b4e32

SHA512
c436068019c7a6f0b6bcaff0083cfd4ef7856a10db8af056b42c45fe85df01eefafaf299f1098ec1a7c872642be488b551543efe902d22f0e6844cb36f5205c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
72a7ecc03ed48661e4a2ffe869f081fc

SHA1
38d1c956d1a77fe04557f8d8915a46ae7538e170

SHA256
4f93e7f489bdce404c2606a8d0bc991277366afbfabe9fcc1253389e9d226e05

SHA512
fe9d999acfa9c5231c1da00d54410bb87a78443e14197539a06214967d786902e389a92662aba074593ca9f59ef003989c028db24dc6b5570b94fb7637839cce

Download Submit