23f98f5d8ffe0232ee701a088105864ab5f700dcaca52019a4841d13b1663ec9

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 23:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f70b9fff99fa711cce7cd89062edb3df_JaffaCakes118.html
Size

153KB
MD5

f70b9fff99fa711cce7cd89062edb3df
SHA1

dca6a5cb3e1f473e6524d47d5e8a8610d5e60acf
SHA256

23f98f5d8ffe0232ee701a088105864ab5f700dcaca52019a4841d13b1663ec9
SHA512

dd9199b26471a8a52bd5a9706154cf157e563f6d361826d32d2775e0876c354127ffed89ab104e8324a68ce95ced8718712fbafb9dcd41834c7af8745651a61e
SSDEEP

3072:STW43BZjFyfkMY+BES09JXAnyrZalI+YQ:STWlsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
2340	msedge.exe
2340	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 4752	2340	msedge.exe	82
PID 2340 wrote to memory of 4752	2340	msedge.exe	82
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1480	2340	msedge.exe	83
PID 2340 wrote to memory of 1256	2340	msedge.exe	84
PID 2340 wrote to memory of 1256	2340	msedge.exe	84
PID 2340 wrote to memory of 1096	2340	msedge.exe	85
PID 2340 wrote to memory of 1096	2340	msedge.exe	85
PID 2340 wrote to memory of 1096	2340	msedge.exe	85
PID 2340 wrote to memory of 1096	2340	msedge.exe	85
PID 2340 wrote to memory of 1096	2340	msedge.exe	85
PID 2340 wrote to memory of 1096	2340	msedge.exe	85
PID 2340 wrote to memory of 1096	2340	msedge.exe	85
PID 2340 wrote to memory of 1096	2340	msedge.exe	85
PID 2340 wrote to memory of 1096	2340	msedge.exe	85
PID 2340 wrote to memory of 1096	2340	msedge.exe	85
PID 2340 wrote to memory of 1096	2340	msedge.exe	85
PID 2340 wrote to memory of 1096	2340	msedge.exe	85
PID 2340 wrote to memory of 1096	2340	msedge.exe	85
PID 2340 wrote to memory of 1096	2340	msedge.exe	85
PID 2340 wrote to memory of 1096	2340	msedge.exe	85
PID 2340 wrote to memory of 1096	2340	msedge.exe	85
PID 2340 wrote to memory of 1096	2340	msedge.exe	85
PID 2340 wrote to memory of 1096	2340	msedge.exe	85
PID 2340 wrote to memory of 1096	2340	msedge.exe	85
PID 2340 wrote to memory of 1096	2340	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f70b9fff99fa711cce7cd89062edb3df_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb026546f8,0x7ffb02654708,0x7ffb02654718
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11443733212021177257,16652641579615557529,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,11443733212021177257,16652641579615557529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,11443733212021177257,16652641579615557529,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11443733212021177257,16652641579615557529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11443733212021177257,16652641579615557529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11443733212021177257,16652641579615557529,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2552 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d1193d600d2da537fb03c8e8e082d4a8

SHA1
c7099ce0ade299081529cf5d54d3771eb056ac9b

SHA256
9cb4f60da41c156b7d828b5093b7c96e19facc5db4bacbf4a69178b51357e515

SHA512
ad47bce6042c650f879452af85f192a4a882691808e190604660f3f84a6da7e2e793c145d70f036ef39b073689a239411e8c020f42d0698a51de4eacaacd9409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
53ddc33f12449913e2d0d3f259b4181d

SHA1
e04d11e97c3a9e9c2bdfd57edc689c0ba0a4a9be

SHA256
f53f9435464f10bfb67529de8341db5819502737e7ba2538773106855dbbe4a7

SHA512
d695a8df8060c42d0d7553b559ac1ef2486f1e63326a48155515dd663d97df1e9fabb3eaf402d33286dffce65044bf224232579574151a1d984ac9b189952d83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
60fac2fc0e1b545a6a8d6e12bc3512ad

SHA1
60491f98de299b16837915cd2cf1c35aff7f4c5b

SHA256
5be5f2c27a7635ec20c91d6f32dc9575bd976f94de983992c43b483e86a8da91

SHA512
7ba1fe499593cb0efbd5a5c124663c6b3945cb03ba5de1e7961e3c5d98de5d215099b090c1b7ddc23897aba856be7797259d97e98b01747b0e77061d2de08681

Download Submit