1ea34acc7fe54f7402beae14ecb67919196853c916b8fa5e2f969124eea5219f

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2024 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ecf1910aed8347440181d5423b1f5974_JaffaCakes118.html
Size

38KB
MD5

ecf1910aed8347440181d5423b1f5974
SHA1

96bd934f4db794a699cc7032fa9ba9367144cf6d
SHA256

1ea34acc7fe54f7402beae14ecb67919196853c916b8fa5e2f969124eea5219f
SHA512

c672ea399100a244908832189c8a4ccb9828933be3972e649e59782fae17dafba6f95e1b2a93efc0819191f2e4255d6c60e35e6495d82db49e155b8eed0c41dd
SSDEEP

384:CFJB+vri8FLx8ocstx8LFCMfUVBvFjgXZyZmsAAque87quYqu/QK7quAwQ37quva:CFj+veQVdZ8amfAV7+n7qwg7h7N7pKN

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: logo@e9bd13f7
phishing
Detected potential entity reuse from brand MICROSOFT.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1516	msedge.exe
1516	msedge.exe
632	msedge.exe
632	msedge.exe
4576	identity_helper.exe
4576	identity_helper.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe
1728	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 952	632	msedge.exe	82
PID 632 wrote to memory of 952	632	msedge.exe	82
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 4180	632	msedge.exe	83
PID 632 wrote to memory of 1516	632	msedge.exe	84
PID 632 wrote to memory of 1516	632	msedge.exe	84
PID 632 wrote to memory of 2180	632	msedge.exe	85
PID 632 wrote to memory of 2180	632	msedge.exe	85
PID 632 wrote to memory of 2180	632	msedge.exe	85
PID 632 wrote to memory of 2180	632	msedge.exe	85
PID 632 wrote to memory of 2180	632	msedge.exe	85
PID 632 wrote to memory of 2180	632	msedge.exe	85
PID 632 wrote to memory of 2180	632	msedge.exe	85
PID 632 wrote to memory of 2180	632	msedge.exe	85
PID 632 wrote to memory of 2180	632	msedge.exe	85
PID 632 wrote to memory of 2180	632	msedge.exe	85
PID 632 wrote to memory of 2180	632	msedge.exe	85
PID 632 wrote to memory of 2180	632	msedge.exe	85
PID 632 wrote to memory of 2180	632	msedge.exe	85
PID 632 wrote to memory of 2180	632	msedge.exe	85
PID 632 wrote to memory of 2180	632	msedge.exe	85
PID 632 wrote to memory of 2180	632	msedge.exe	85
PID 632 wrote to memory of 2180	632	msedge.exe	85
PID 632 wrote to memory of 2180	632	msedge.exe	85
PID 632 wrote to memory of 2180	632	msedge.exe	85
PID 632 wrote to memory of 2180	632	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\ecf1910aed8347440181d5423b1f5974_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff874cb46f8,0x7ff874cb4708,0x7ff874cb4718
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11622492693733604612,2954474433541070987,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,11622492693733604612,2954474433541070987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,11622492693733604612,2954474433541070987,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11622492693733604612,2954474433541070987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11622492693733604612,2954474433541070987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11622492693733604612,2954474433541070987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11622492693733604612,2954474433541070987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11622492693733604612,2954474433541070987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2320 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11622492693733604612,2954474433541070987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11622492693733604612,2954474433541070987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11622492693733604612,2954474433541070987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11622492693733604612,2954474433541070987,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5740 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
591B

MD5
f4180f633cc5ea7a76bd84e52d4ba4ed

SHA1
79c438c13974679253c47d7973c1443e6a977867

SHA256
7bf977d20ea9abb2cfabdd34c7c7a12a1c434e9c885e1c1f734668bca65762f5

SHA512
564cffe0cfcd70b13e98c73fd24f540f00051abf43234a0f84dd48cb0ecb36e65a99de94ca203251fb3d5dfcbef7d9e68ae9dbf313f0ab7fe607ea7441c56155

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8e05d7c45607dff1731c2f0ffe082693

SHA1
153e55e74053311eac1196c056963b48ec7d57ce

SHA256
542a7fba4267369d7352cae432060260b87df49e72d8bcf40221bb00dd9869b1

SHA512
576f554ed11ae91d9f00b56f370be8c31cea0b2510aa22e0c4269fee09005e60d6e9ab5786b17f1eb1f23d1ee40f762e823c89635d9601d2e6295d72ec35a587

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
143c9452ddd48c77698e1e109cd25c50

SHA1
18f96ab368dd140128d6b0f3016f4b8f5f581775

SHA256
3d2834ad7c8d3301e2668cf204f55cc46e84e55d6b34c5b52f60db2f095b69e3

SHA512
a350a124b10f5cd3de441c87343fd108b43e4bd2c4224f626542f69141d92698ef700ebe99042a828e38dc95e2fcc04f1be5fb37bd34a5875fff0ca5a8c1c18b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
25af87bed19ebfd9f70fcc1e0e0b6d2e

SHA1
70b28257f6df6b7c4078da5fb69ff9b229cdb6fb

SHA256
8fb7cce949fb5b04b1eb76d00246ef337d001a6a780983edce4cb55d703622f9

SHA512
43f2bd50f0a4780ca8f329442fd4809921f38ffc76a194024d56fd80b40cfa4d4eb4b87557922fc5de0e7d5ed350f1a0f0774455823b732963cdba42b705e152

Download Submit