edc75f831365f45381f7b5fd944c423bbbad190477669f573e928d3afbb1d8d2

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f542d270b67665895979e859dd148a64_JaffaCakes118.html
Size

18KB
MD5

f542d270b67665895979e859dd148a64
SHA1

b11aa2db3ed4a5255df3c31a5558955d30636eba
SHA256

edc75f831365f45381f7b5fd944c423bbbad190477669f573e928d3afbb1d8d2
SHA512

8bb1c6f2e57dd86b82ee384f82c1d3b08957c533841e28382ae9ee3a60316958eb305c90d85b1cc8c4d51c0b3f95862897fafd8846a23831e1e720a570a5795a
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAII4UzUnjBhEu82qDB8:SIMd0I5nvHJsvEdxDB8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe
4600	msedge.exe
4600	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 540	4600	msedge.exe	82
PID 4600 wrote to memory of 540	4600	msedge.exe	82
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 4604	4600	msedge.exe	83
PID 4600 wrote to memory of 3968	4600	msedge.exe	84
PID 4600 wrote to memory of 3968	4600	msedge.exe	84
PID 4600 wrote to memory of 3520	4600	msedge.exe	85
PID 4600 wrote to memory of 3520	4600	msedge.exe	85
PID 4600 wrote to memory of 3520	4600	msedge.exe	85
PID 4600 wrote to memory of 3520	4600	msedge.exe	85
PID 4600 wrote to memory of 3520	4600	msedge.exe	85
PID 4600 wrote to memory of 3520	4600	msedge.exe	85
PID 4600 wrote to memory of 3520	4600	msedge.exe	85
PID 4600 wrote to memory of 3520	4600	msedge.exe	85
PID 4600 wrote to memory of 3520	4600	msedge.exe	85
PID 4600 wrote to memory of 3520	4600	msedge.exe	85
PID 4600 wrote to memory of 3520	4600	msedge.exe	85
PID 4600 wrote to memory of 3520	4600	msedge.exe	85
PID 4600 wrote to memory of 3520	4600	msedge.exe	85
PID 4600 wrote to memory of 3520	4600	msedge.exe	85
PID 4600 wrote to memory of 3520	4600	msedge.exe	85
PID 4600 wrote to memory of 3520	4600	msedge.exe	85
PID 4600 wrote to memory of 3520	4600	msedge.exe	85
PID 4600 wrote to memory of 3520	4600	msedge.exe	85
PID 4600 wrote to memory of 3520	4600	msedge.exe	85
PID 4600 wrote to memory of 3520	4600	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f542d270b67665895979e859dd148a64_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a02a46f8,0x7ff9a02a4708,0x7ff9a02a4718
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,6362233329035128324,94827975086859488,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,6362233329035128324,94827975086859488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,6362233329035128324,94827975086859488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6362233329035128324,94827975086859488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6362233329035128324,94827975086859488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,6362233329035128324,94827975086859488,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
097b5ee9706d15aa0e7639af4f57131d

SHA1
480b31943d8ffbe2ddd9baacf22b41e187073a86

SHA256
e72a6d0ea4e8a4564653b64b61f4674705743f9dcf1b34ed0968eb32a0242b82

SHA512
d7275983e8d26feb9df61368fe8409b429363ce6bd4bbb05f5f18097371d87d42cd117d110af2e5861df75a6dc24af550e96e5a66d2dcc9c40dbbf8dfe70787b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
49c1c5b9afad87cc96c842126f4a003b

SHA1
10fa3e932118ee9154bcd3d0bc91c974105e561f

SHA256
41d492e630e8a06aa8e828620a049c4404240c7ee852c71640180a30cf608259

SHA512
bf93c23d2b14698088e5c286e8c76d912e2fe5e9f1d92a3d69e2ec4a9b440871450e28d0729c5cb450ebc0f87bb229338ad74d5ac5798899a06031833de0a5a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f377ee24c769f8caa20b306dd753766e

SHA1
a39fbfdbb81a05774c7696ecc396f9c03d0c0543

SHA256
3c2962e06d799770dc88101b52d006a897d18eb15f1616358ece1d79e4cef3be

SHA512
191b5c277329132bbf1787cbf126e36deaf35d8a2fb713f6d1be9c60bb33ed970d4634fbcee3aebaa773a61554509b5e0cf66bb3e82fe9977ef926545c510755

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0895587f0f9a393fd1d084a1b4aefe01

SHA1
6f86c43ec9ba1e4aedfc37ee8a11049f7191c6cd

SHA256
6b783c483d0a1be8a4ef1794783f3fb4b52299369431788189c0ec76e3c42440

SHA512
f2b59444808707fbd9228aa8deb2d498e1789ae5400609156a9ddbfdce2a230abfbf99726683de566a94460835bc3252decf4871078b36a45d2defe76f313aee

Download Submit