39ee9998b64ad9e4cee6fc2adbf85fa78751ee8f35faa0cabdb9693ea893fd56

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 05:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4f37c25ae1738c51423a4c0944af187_JaffaCakes118.html
Size

175KB
MD5

b4f37c25ae1738c51423a4c0944af187
SHA1

a4adddc783648e11a80a2f5cc3686c62ac77daf6
SHA256

39ee9998b64ad9e4cee6fc2adbf85fa78751ee8f35faa0cabdb9693ea893fd56
SHA512

4790ca70433add1cda39d852a8f1695bcd5bd00e6ab21c23a071e0b4da32b6ea0974eb27ab62d263b3299cc0334c957bf6260783b25e2a2eb7c5687ceff77a83
SSDEEP

1536:xbWfiN5BpT+IyfZBk75mV9ChNSzsIN44t+gUbWfiN5BpT+IyfZBk3:xbWKN5BpT+IyfZq4UbWKN5BpT+IyfZq3

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
3464	msedge.exe
3464	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 2960	3464	msedge.exe	83
PID 3464 wrote to memory of 2960	3464	msedge.exe	83
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 2168	3464	msedge.exe	84
PID 3464 wrote to memory of 4080	3464	msedge.exe	85
PID 3464 wrote to memory of 4080	3464	msedge.exe	85
PID 3464 wrote to memory of 3528	3464	msedge.exe	86
PID 3464 wrote to memory of 3528	3464	msedge.exe	86
PID 3464 wrote to memory of 3528	3464	msedge.exe	86
PID 3464 wrote to memory of 3528	3464	msedge.exe	86
PID 3464 wrote to memory of 3528	3464	msedge.exe	86
PID 3464 wrote to memory of 3528	3464	msedge.exe	86
PID 3464 wrote to memory of 3528	3464	msedge.exe	86
PID 3464 wrote to memory of 3528	3464	msedge.exe	86
PID 3464 wrote to memory of 3528	3464	msedge.exe	86
PID 3464 wrote to memory of 3528	3464	msedge.exe	86
PID 3464 wrote to memory of 3528	3464	msedge.exe	86
PID 3464 wrote to memory of 3528	3464	msedge.exe	86
PID 3464 wrote to memory of 3528	3464	msedge.exe	86
PID 3464 wrote to memory of 3528	3464	msedge.exe	86
PID 3464 wrote to memory of 3528	3464	msedge.exe	86
PID 3464 wrote to memory of 3528	3464	msedge.exe	86
PID 3464 wrote to memory of 3528	3464	msedge.exe	86
PID 3464 wrote to memory of 3528	3464	msedge.exe	86
PID 3464 wrote to memory of 3528	3464	msedge.exe	86
PID 3464 wrote to memory of 3528	3464	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\b4f37c25ae1738c51423a4c0944af187_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc8f5846f8,0x7ffc8f584708,0x7ffc8f584718
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,4425808597912923792,7760320449340808836,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,4425808597912923792,7760320449340808836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1840 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,4425808597912923792,7760320449340808836,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4425808597912923792,7760320449340808836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4425808597912923792,7760320449340808836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,4425808597912923792,7760320449340808836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,4425808597912923792,7760320449340808836,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3268 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\456ca73f-3d75-4347-a174-012c414acde6.tmp

Filesize
5KB

MD5
c0b88d589da239004864334ea56044f4

SHA1
4a9385b733c31ffebdda007c0a3f0be7623ff533

SHA256
37fa9d4a282e14ad56695ddb86e81eb06b27bba51e5778ca730b2a208567e19f

SHA512
e619eaa26a59e2d56bafa4d6f881917d16c1a34d6a4af4d67e32d08ac8db8061405a3be5f01e3839dfcbf78b6e1b1d66628bd93c1a19f41cdb72dd66f81a1dd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cc5e4ec27bc924e35d7eb40d62ca1edf

SHA1
2cd185c82d3ef4095ec4925a934a5441a1e01ebe

SHA256
6c340149fc2ba1a27e7caf1bce1c44fc68da86f27c1f757fecf698aea249f782

SHA512
16f0790db93c4bd37ee936d704046b13208de79e7c9be8122d3404a908d92cffbecf3835860d081eaa86c9aa167149c86c79cf7dd3c18e73261f5081ba80261a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
73df12fc8fc4029aebc6c0e503c114ca

SHA1
11e0906b5929a8c50e48ce47c5e91f42f84bc0c2

SHA256
9a9752213f40ef1c78ab3c3b107ef7f239085bb45fa4fc39f236d10009da51db

SHA512
c9f53c92d6ec3294eee436d5f1feb8265d4e017082457cc75f5224bf164fa5e459f6a69008c4940f93da837f1dd5b3098f1592b9fb9fdced8306d9af6d4b2d4c

Download Submit