e47ef04175836ff8a46c7fc1b01a04975e533832e71c5fe3c58649f87cd236f7

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-12-2024 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de40efffa26ac871b3973e2e40df0382_JaffaCakes118.html
Size

154KB
MD5

de40efffa26ac871b3973e2e40df0382
SHA1

7bc5ad6e545b623dc3297dfa19e50fb74627b771
SHA256

e47ef04175836ff8a46c7fc1b01a04975e533832e71c5fe3c58649f87cd236f7
SHA512

750a8f6e4cd7a0085963cece6430df35ecd35d3617dc691b7a7931ab291768cdffdb3a05ae9c356c263f4ada9a1ff5ddbc91fd727ce44c917485937a5ab8b8e4
SSDEEP

1536:STB1taPpvMZbZCnX3wOz+TOfDV4Jnl7QKRdw7ryCFyj+5OkMQr2CEu1cDi8C196g:Sgz6yfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4048	msedge.exe
4048	msedge.exe
4408	identity_helper.exe
4408	identity_helper.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 4944	4048	msedge.exe	82
PID 4048 wrote to memory of 4944	4048	msedge.exe	82
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 1216	4048	msedge.exe	83
PID 4048 wrote to memory of 4880	4048	msedge.exe	84
PID 4048 wrote to memory of 4880	4048	msedge.exe	84
PID 4048 wrote to memory of 2536	4048	msedge.exe	85
PID 4048 wrote to memory of 2536	4048	msedge.exe	85
PID 4048 wrote to memory of 2536	4048	msedge.exe	85
PID 4048 wrote to memory of 2536	4048	msedge.exe	85
PID 4048 wrote to memory of 2536	4048	msedge.exe	85
PID 4048 wrote to memory of 2536	4048	msedge.exe	85
PID 4048 wrote to memory of 2536	4048	msedge.exe	85
PID 4048 wrote to memory of 2536	4048	msedge.exe	85
PID 4048 wrote to memory of 2536	4048	msedge.exe	85
PID 4048 wrote to memory of 2536	4048	msedge.exe	85
PID 4048 wrote to memory of 2536	4048	msedge.exe	85
PID 4048 wrote to memory of 2536	4048	msedge.exe	85
PID 4048 wrote to memory of 2536	4048	msedge.exe	85
PID 4048 wrote to memory of 2536	4048	msedge.exe	85
PID 4048 wrote to memory of 2536	4048	msedge.exe	85
PID 4048 wrote to memory of 2536	4048	msedge.exe	85
PID 4048 wrote to memory of 2536	4048	msedge.exe	85
PID 4048 wrote to memory of 2536	4048	msedge.exe	85
PID 4048 wrote to memory of 2536	4048	msedge.exe	85
PID 4048 wrote to memory of 2536	4048	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\de40efffa26ac871b3973e2e40df0382_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcf1746f8,0x7ffdcf174708,0x7ffdcf174718
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13440816848365748751,4631228511229106939,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,13440816848365748751,4631228511229106939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,13440816848365748751,4631228511229106939,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13440816848365748751,4631228511229106939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13440816848365748751,4631228511229106939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13440816848365748751,4631228511229106939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,13440816848365748751,4631228511229106939,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2112 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13440816848365748751,4631228511229106939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,13440816848365748751,4631228511229106939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,13440816848365748751,4631228511229106939,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13440816848365748751,4631228511229106939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13440816848365748751,4631228511229106939,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13440816848365748751,4631228511229106939,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13440816848365748751,4631228511229106939,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13440816848365748751,4631228511229106939,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
32824d098d4c294d18d7414fb71a7359

SHA1
9a5f914d39ad11fcd1299e190b7211b45c41b70f

SHA256
628d1674bfbd49d0ad68fe517b4049539a67c07dee0112d1d7fbb78a624e9296

SHA512
f39978b210106cb2c2aa9330aefccdf8b5e320ddcc0150f64eae2071d1843e5b0ebaa8327fe506d58eec01f2bfc2239ca0a0aaf988e5ca6553638e3683bbe9b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ab3351ceeff42e6d94864790e374653f

SHA1
c8dbdcf3e4592acff82dc95bcb6c55d9d72142e9

SHA256
b81c4c14cd1db979d3c291f95ebd392f799d1c5f3232c775f7027fe1324c9575

SHA512
2f0845896ce89ffc26ed9f70ad4051eb6f3ec55e04ae7cfa2b71016404b0980a5a2f9cddab377664f3558199dd4c8bc36888b8a04e0766908105da3a5d3aecd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c04b6ee5008167847511996df16a8332

SHA1
71efeaa54febd92b5dcad203aa4f4be45824a7a7

SHA256
d0073109523cd1c83b87999e26f68857feceea541d0be10250e5e2e6043431ec

SHA512
9a35e1c70bbfe8ff570fd16bb7c65dec910af50ecf52e8c5a3eefe790837355dbf0d3daf374e30fead5596ecce649b23b285e0b7bd51bf5edcec6c9a849db69e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 502156.crdownload

Filesize
540KB

MD5
a1a73e6c0786bded077464b66e86743c

SHA1
ce7e63a49f3793747926b17703e20ccf9718f3bb

SHA256
5a70b5447601be78b9ce1af03b68d9bfe00e847d72c44841278e4a5241670002

SHA512
25df4deefca014c38765f794e8828cb4e94282d43319893bed18c0903187537b12a3afd8341f82c26d2593501b941d9c195e9fdf5890ec0adad860a4b7de2849

Download Submit