d4446abe5075c4a5fb68d1fa3febc941faf0dc389a74aa7a2ed66bfa4bf18a8e

Analysis

max time kernel
139s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-12-2024 03:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e48d7f2fe5cacf76d06801972442d969_JaffaCakes118.html
Size

158KB
MD5

e48d7f2fe5cacf76d06801972442d969
SHA1

1590495fa104de5ec4c5f102406d2f930d8aded8
SHA256

d4446abe5075c4a5fb68d1fa3febc941faf0dc389a74aa7a2ed66bfa4bf18a8e
SHA512

d67220fc854cace6701cc894906e45a7edd57b9d3529397a777595157507e98dd77aaa7ac02c1e4341673c78c430222adaa4ec15ca24c96563e8a8741841ea74
SSDEEP

1536:ilRTMTbH9JIcV/H8ey83mNyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09M:iT0YcVaNyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2768	msedge.exe
2768	msedge.exe
532	msedge.exe
532	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
4976	msedge.exe
3604	identity_helper.exe
3604	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe
532	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 2892	532	msedge.exe	83
PID 532 wrote to memory of 2892	532	msedge.exe	83
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 5092	532	msedge.exe	84
PID 532 wrote to memory of 2768	532	msedge.exe	85
PID 532 wrote to memory of 2768	532	msedge.exe	85
PID 532 wrote to memory of 1536	532	msedge.exe	86
PID 532 wrote to memory of 1536	532	msedge.exe	86
PID 532 wrote to memory of 1536	532	msedge.exe	86
PID 532 wrote to memory of 1536	532	msedge.exe	86
PID 532 wrote to memory of 1536	532	msedge.exe	86
PID 532 wrote to memory of 1536	532	msedge.exe	86
PID 532 wrote to memory of 1536	532	msedge.exe	86
PID 532 wrote to memory of 1536	532	msedge.exe	86
PID 532 wrote to memory of 1536	532	msedge.exe	86
PID 532 wrote to memory of 1536	532	msedge.exe	86
PID 532 wrote to memory of 1536	532	msedge.exe	86
PID 532 wrote to memory of 1536	532	msedge.exe	86
PID 532 wrote to memory of 1536	532	msedge.exe	86
PID 532 wrote to memory of 1536	532	msedge.exe	86
PID 532 wrote to memory of 1536	532	msedge.exe	86
PID 532 wrote to memory of 1536	532	msedge.exe	86
PID 532 wrote to memory of 1536	532	msedge.exe	86
PID 532 wrote to memory of 1536	532	msedge.exe	86
PID 532 wrote to memory of 1536	532	msedge.exe	86
PID 532 wrote to memory of 1536	532	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\e48d7f2fe5cacf76d06801972442d969_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffbc44f46f8,0x7ffbc44f4708,0x7ffbc44f4718
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,983583029138345942,10659738445646418634,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,983583029138345942,10659738445646418634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,983583029138345942,10659738445646418634,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,983583029138345942,10659738445646418634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,983583029138345942,10659738445646418634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,983583029138345942,10659738445646418634,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,983583029138345942,10659738445646418634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,983583029138345942,10659738445646418634,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,983583029138345942,10659738445646418634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,983583029138345942,10659738445646418634,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,983583029138345942,10659738445646418634,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,983583029138345942,10659738445646418634,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:2348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3de14d5af59580a6994baf7f3a427be1

SHA1
6d608141aee6124879772c14b53584a03019e550

SHA256
04b5d39a088175cf9c840ac0ba9ae2a4a8ad5be9e2435c67459577e7012fd9d2

SHA512
133558f46c5c164e6db42883fc01f9b2974277f282bc12d61c477a0006c55bc0eea81c5c4010e9eabe4df2d5b926836c07525073561a9f78bdceebfc1610f840

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a96df60a08ba07261b5f57a7d1b39b20

SHA1
67fde36f6f0083df15ca43166a490e4bf5d4cd97

SHA256
d8aad151f39b064d1b9a0c5815ef1f5868e0180dcf88a869f82c9ffbc27e31ff

SHA512
51d77a7e3f8c7743cb17bce1a12e5b078f84ce30fc3a63b295f2b4a7ec693dbaacdafc23df637014dd28629d17be771ca79ab1a6ca1952b68bb392aa6dc56766

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6581f587594613cee4ae6142692b227a

SHA1
f95dc34c519f647433d450c5dfe06872d4b93ccb

SHA256
76af4f434980c0a7ebe38de2684b8fd0121b5e90094a41e279fd9d75a2cc4ac2

SHA512
440183a8f4e668613ecc4bca8f53e48ac3aa75116591b4d9180c6034ff77aa8a6b7f6244b1351beb8165a21c35f3f633a21fb84ca36f4b5be64260af193b6f2a

Download Submit