1d3385060239cd750e92437bcaa7f893b8cb5433a644f7256200848bb9ac5ce3

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2024 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb468d9e98f5a824ce3adf8615291bf9_JaffaCakes118.html
Size

126KB
MD5

eb468d9e98f5a824ce3adf8615291bf9
SHA1

caca9dda68f1cd240704aadbc5f547ad968dc044
SHA256

1d3385060239cd750e92437bcaa7f893b8cb5433a644f7256200848bb9ac5ce3
SHA512

410b97a9fc64289eefc0be904b1568af3e61db2129f2b2d264f152226b3996caea67d51bbdf86082e095e61f7309bf108443f36af90de6724711e4b8ced22589
SSDEEP

1536:iX9kyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCW:itkyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1568	msedge.exe
1568	msedge.exe
4472	msedge.exe
4472	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 4656	4472	msedge.exe	82
PID 4472 wrote to memory of 4656	4472	msedge.exe	82
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 832	4472	msedge.exe	83
PID 4472 wrote to memory of 1568	4472	msedge.exe	84
PID 4472 wrote to memory of 1568	4472	msedge.exe	84
PID 4472 wrote to memory of 4680	4472	msedge.exe	85
PID 4472 wrote to memory of 4680	4472	msedge.exe	85
PID 4472 wrote to memory of 4680	4472	msedge.exe	85
PID 4472 wrote to memory of 4680	4472	msedge.exe	85
PID 4472 wrote to memory of 4680	4472	msedge.exe	85
PID 4472 wrote to memory of 4680	4472	msedge.exe	85
PID 4472 wrote to memory of 4680	4472	msedge.exe	85
PID 4472 wrote to memory of 4680	4472	msedge.exe	85
PID 4472 wrote to memory of 4680	4472	msedge.exe	85
PID 4472 wrote to memory of 4680	4472	msedge.exe	85
PID 4472 wrote to memory of 4680	4472	msedge.exe	85
PID 4472 wrote to memory of 4680	4472	msedge.exe	85
PID 4472 wrote to memory of 4680	4472	msedge.exe	85
PID 4472 wrote to memory of 4680	4472	msedge.exe	85
PID 4472 wrote to memory of 4680	4472	msedge.exe	85
PID 4472 wrote to memory of 4680	4472	msedge.exe	85
PID 4472 wrote to memory of 4680	4472	msedge.exe	85
PID 4472 wrote to memory of 4680	4472	msedge.exe	85
PID 4472 wrote to memory of 4680	4472	msedge.exe	85
PID 4472 wrote to memory of 4680	4472	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\eb468d9e98f5a824ce3adf8615291bf9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc36c046f8,0x7ffc36c04708,0x7ffc36c04718
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14687137257535661554,14261231842292399393,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,14687137257535661554,14261231842292399393,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,14687137257535661554,14261231842292399393,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14687137257535661554,14261231842292399393,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14687137257535661554,14261231842292399393,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14687137257535661554,14261231842292399393,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14687137257535661554,14261231842292399393,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3004 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b0e34220cfecd883266295d0d5b4e67b

SHA1
b1c3b379491adf1d3f032017a1079a00e71e48e6

SHA256
90882a5d4688fe8df3cc8993abf5cb924c568e16462e2a2fa6a355809a43dd20

SHA512
41a72162fd859b1b1ca3b66ca4a867d24c2c1d34eaca952e52ad663d41cdfd758dc2ac6d1c4942dcf8793df6706fd69d43438a81be48a1fbce88551c9cbff6c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ba38f94f56e44c9f03273b6c239780b3

SHA1
4a2e9742ee630438058f8bbd60a1a1c497d0ac50

SHA256
2c141b37e52d45fe2e3d5b3b488dd73196cdc797c691c28365fbdc9233b98761

SHA512
d7f30e0ed1c618f07578c11731afa56c93d41de46b895be8d5ec4783e8c8d4c14d8c87f4e0313b0878cbf11e9e96c309e88e44daaa3d1e2e2aa93f80004a1445

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4178834ad535da2d619c212f19fca19c

SHA1
70b36e21c6d0788cfea47622d830675abb5f6631

SHA256
da40c2ff15026505702bb23a5f01da06b0a37035c29da91531126db9c450f5bd

SHA512
2e72103b86c7034d6ac740ada5314659fe1703ebe9afa5d7e6f2f7d06724c3677123c7b54c410c32ecfc48ffdc2f98fdab084ce251e4406cecde5704ebee5c33

Download Submit