2ce04c9b830b240e8817906ba19b16d427942f8f9cecd6385c506110fc92f8be

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2024 14:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec04de185d1a2f46cce3ece0db3d266b_JaffaCakes118.html
Size

77KB
MD5

ec04de185d1a2f46cce3ece0db3d266b
SHA1

280793f36fa856b5697232a4fdcd9f4306b59020
SHA256

2ce04c9b830b240e8817906ba19b16d427942f8f9cecd6385c506110fc92f8be
SHA512

083faa106bbafb0efeb125c421a5bdc1ce2d1039d9107ec573e1849f94333e8aa217215ce2a2cc3559fb5ed1c473ebf7be4b9e65e9b0328191cc91f814524f0b
SSDEEP

1536:9p5pBoNzHFkZvNu1z1seeeebKJOHITNs9tua:9p5pBoxlY1gNs9tua

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
3180	msedge.exe
3180	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 3516	3180	msedge.exe	82
PID 3180 wrote to memory of 3516	3180	msedge.exe	82
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 672	3180	msedge.exe	83
PID 3180 wrote to memory of 4836	3180	msedge.exe	84
PID 3180 wrote to memory of 4836	3180	msedge.exe	84
PID 3180 wrote to memory of 3756	3180	msedge.exe	85
PID 3180 wrote to memory of 3756	3180	msedge.exe	85
PID 3180 wrote to memory of 3756	3180	msedge.exe	85
PID 3180 wrote to memory of 3756	3180	msedge.exe	85
PID 3180 wrote to memory of 3756	3180	msedge.exe	85
PID 3180 wrote to memory of 3756	3180	msedge.exe	85
PID 3180 wrote to memory of 3756	3180	msedge.exe	85
PID 3180 wrote to memory of 3756	3180	msedge.exe	85
PID 3180 wrote to memory of 3756	3180	msedge.exe	85
PID 3180 wrote to memory of 3756	3180	msedge.exe	85
PID 3180 wrote to memory of 3756	3180	msedge.exe	85
PID 3180 wrote to memory of 3756	3180	msedge.exe	85
PID 3180 wrote to memory of 3756	3180	msedge.exe	85
PID 3180 wrote to memory of 3756	3180	msedge.exe	85
PID 3180 wrote to memory of 3756	3180	msedge.exe	85
PID 3180 wrote to memory of 3756	3180	msedge.exe	85
PID 3180 wrote to memory of 3756	3180	msedge.exe	85
PID 3180 wrote to memory of 3756	3180	msedge.exe	85
PID 3180 wrote to memory of 3756	3180	msedge.exe	85
PID 3180 wrote to memory of 3756	3180	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\ec04de185d1a2f46cce3ece0db3d266b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba9dc46f8,0x7ffba9dc4708,0x7ffba9dc4718
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,152365780111471087,17080603833008293167,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,152365780111471087,17080603833008293167,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2532 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,152365780111471087,17080603833008293167,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,152365780111471087,17080603833008293167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,152365780111471087,17080603833008293167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,152365780111471087,17080603833008293167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,152365780111471087,17080603833008293167,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,152365780111471087,17080603833008293167,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
550df8991f02a1dbc3ddb947635f742f

SHA1
3e38dd6b6ba64d7b8a98917a5fb2f3df084cdb84

SHA256
104789ee802d50157c541837127f7231f7ef9eecda4898e17b507f29f91639dc

SHA512
da027e0da2e327b903fcbc907bc562c256daa34cccb62aef5d8ea55d015522d1906d5f0e7012bbbd68f637aaf060016a1bedcb7f98632c7cf68b39253e25c0a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a9b6721a4ded82b67f5261e9012f3643

SHA1
f41dc735530d2bab717a7b40778e978a52c5e129

SHA256
47e366d14d044f13fdaf58d30b3d86eb90d843998d7534ceb3fd3c3beb482e3d

SHA512
df737e32287177746f290a31b49cbab1a23d5d3ce03c0d8676a90265bce33007d0922cd1f1f99ad5d6f79d0b0e1a58ba7ef94068164e785b887c4edd8fb5495b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
76e58f6af569120a8955762c35119c7f

SHA1
b3d944c4b2bd4413bb57544bc7a1c34fc1cc2c12

SHA256
a73af5a16f13207f20917111c0cb3c5246ca106d46c337c77d4e8a3f954d8dad

SHA512
b22ad18b574901d9184a2927dfb4d2de3be589a978228b01178bca97bbe270f6a64379bcfb2015804c2e40dd71a8f05b2c1f134e320d845bf9bfc2f4e8b117a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ee722f17797b437052b7488ecb1541f0

SHA1
a7fe8495fecd33a352a844e2facf91529ddd7cf9

SHA256
003090e3ced8c74991303aa020a05ed56e9eb32ccf919bb975d840ee36f474a8

SHA512
abb3d70354d1a3391d4347902984ad5cf058b590fc4d48f76f3e8a04a43b73791e614fbd4d08e8a14aac02cc84a0ca214ef9df7f5ca8624a77b496554f6cd9f1

Download Submit