4130681e2a7370e21caff566bf8fda95f45fce1adea977b74a511a57dcb22491

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e12d35d78715f8b0a89f2bc56552aacc_JaffaCakes118.html
Size

18KB
MD5

e12d35d78715f8b0a89f2bc56552aacc
SHA1

d6e4b596e3340f2eef71b86fe4ab16a3af33f693
SHA256

4130681e2a7370e21caff566bf8fda95f45fce1adea977b74a511a57dcb22491
SHA512

fe780f8e50aacf86865b5e454162263c9b139adaa339e90b289cc9fe74670bb10eff2c82df90941516d36dc8c11a17ecfd02041bafc6e5b676a60e5fe2734c71
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIx4VzUnjBh7d82qDB8:SIMd0I5nO9Hxsv7GxDB8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4596	msedge.exe
4596	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 4788	4596	msedge.exe	83
PID 4596 wrote to memory of 4788	4596	msedge.exe	83
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 3904	4596	msedge.exe	84
PID 4596 wrote to memory of 4000	4596	msedge.exe	85
PID 4596 wrote to memory of 4000	4596	msedge.exe	85
PID 4596 wrote to memory of 1764	4596	msedge.exe	86
PID 4596 wrote to memory of 1764	4596	msedge.exe	86
PID 4596 wrote to memory of 1764	4596	msedge.exe	86
PID 4596 wrote to memory of 1764	4596	msedge.exe	86
PID 4596 wrote to memory of 1764	4596	msedge.exe	86
PID 4596 wrote to memory of 1764	4596	msedge.exe	86
PID 4596 wrote to memory of 1764	4596	msedge.exe	86
PID 4596 wrote to memory of 1764	4596	msedge.exe	86
PID 4596 wrote to memory of 1764	4596	msedge.exe	86
PID 4596 wrote to memory of 1764	4596	msedge.exe	86
PID 4596 wrote to memory of 1764	4596	msedge.exe	86
PID 4596 wrote to memory of 1764	4596	msedge.exe	86
PID 4596 wrote to memory of 1764	4596	msedge.exe	86
PID 4596 wrote to memory of 1764	4596	msedge.exe	86
PID 4596 wrote to memory of 1764	4596	msedge.exe	86
PID 4596 wrote to memory of 1764	4596	msedge.exe	86
PID 4596 wrote to memory of 1764	4596	msedge.exe	86
PID 4596 wrote to memory of 1764	4596	msedge.exe	86
PID 4596 wrote to memory of 1764	4596	msedge.exe	86
PID 4596 wrote to memory of 1764	4596	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e12d35d78715f8b0a89f2bc56552aacc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85f5346f8,0x7ff85f534708,0x7ff85f534718
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,4815719527190508311,17507725825801207923,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,4815719527190508311,17507725825801207923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,4815719527190508311,17507725825801207923,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4815719527190508311,17507725825801207923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,4815719527190508311,17507725825801207923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,4815719527190508311,17507725825801207923,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7438bf41e466ca800004a50ba568e00d

SHA1
b60f794ef4da37cbfd5a8539bdca3ef7911de84a

SHA256
dc2a350711b414d13117203becbf70865d0fc6ad524e30c16a94ecf29c1e6b75

SHA512
a2138a1f762e85314829ceb99c0a5a296c536ec875ced39dd46ef8c909a0fb86e2ff4a89c93ec1a6604b987c128d48b374ee91d13f4a324e0a90489704852dae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f01ec043977d0edf67625e2bd88c800e

SHA1
d6535a4686fb64b2c51bc6baedc21b1fb79377b3

SHA256
00ee54d06dc8c9f1fcf4d492ad3537ec088cfd82207602ec772d88a7f39c9573

SHA512
73053ba21f1d91f8da4d8e753fe9886e082b295168b63bde0dada6f380372c4789df52d444cc9f9c5240a342760ccf5be2e3a67a80a877db5363bd229c2056b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
468d90885413d773e5a2856a4138f93a

SHA1
4a969e523ba8fb8de03fa9aa635f7a3262925722

SHA256
808e81b31bb844e30de106d5383633f724743e7e95038a0e9dcd92b1da547306

SHA512
e9c80690393f59c3c6abb55a2e17f0bc1180d25bd458451c9542555d551eba544208d536458990da57c9c29e4b17b91487c3bfac1b9bbdd6f1ef1a7fea9ce504

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8aea590d2eeea06e2b1c3a13bc19f6fc

SHA1
67d3d9653e78c3837ff1166a0d71568f72bb89e2

SHA256
aa103016c5dc7d51f7af8ad32ba3aa3ceb8f1afce63e540e9187f8c4207d792f

SHA512
09baf63904d8be39940858e586ab5d4e545a6b935799a100aa8743553a30a3c170152c3669548ac597fd18fe4f6ef558b6961a532729835b1ea46c5eebbe367b

Download Submit