2d72c777e692552a71d41f60c3e1d5c7c5760df70015a2e06d0e361ea0a991d5

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 09:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5aff52a04d0da8fff735bcd0de47c11_JaffaCakes118.html
Size

122KB
MD5

f5aff52a04d0da8fff735bcd0de47c11
SHA1

cb7e3472a550ad91ed16fc84025208021746eef8
SHA256

2d72c777e692552a71d41f60c3e1d5c7c5760df70015a2e06d0e361ea0a991d5
SHA512

d4c2baf371652dc00e8385d2634ce1154683a5bfa99f4d9a2b7ee5d7ac61db5bd3917f8604f3a02ef3103f04f63f2011b20d15639b48de2b1082de0a71e32745
SSDEEP

768:4/x/mtu29vnorYHvb1qNpDd3ZoPbUEDlK9uZtclS8OR7OCMPKT41pByVYBvPhUo:4/JQHQUH5qvCgEDpIq7OBPh1pBUyWo

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
516	msedge.exe
516	msedge.exe
2292	msedge.exe
2292	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe
2424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe
2292	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 4420	2292	msedge.exe	82
PID 2292 wrote to memory of 4420	2292	msedge.exe	82
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 3520	2292	msedge.exe	83
PID 2292 wrote to memory of 516	2292	msedge.exe	84
PID 2292 wrote to memory of 516	2292	msedge.exe	84
PID 2292 wrote to memory of 404	2292	msedge.exe	85
PID 2292 wrote to memory of 404	2292	msedge.exe	85
PID 2292 wrote to memory of 404	2292	msedge.exe	85
PID 2292 wrote to memory of 404	2292	msedge.exe	85
PID 2292 wrote to memory of 404	2292	msedge.exe	85
PID 2292 wrote to memory of 404	2292	msedge.exe	85
PID 2292 wrote to memory of 404	2292	msedge.exe	85
PID 2292 wrote to memory of 404	2292	msedge.exe	85
PID 2292 wrote to memory of 404	2292	msedge.exe	85
PID 2292 wrote to memory of 404	2292	msedge.exe	85
PID 2292 wrote to memory of 404	2292	msedge.exe	85
PID 2292 wrote to memory of 404	2292	msedge.exe	85
PID 2292 wrote to memory of 404	2292	msedge.exe	85
PID 2292 wrote to memory of 404	2292	msedge.exe	85
PID 2292 wrote to memory of 404	2292	msedge.exe	85
PID 2292 wrote to memory of 404	2292	msedge.exe	85
PID 2292 wrote to memory of 404	2292	msedge.exe	85
PID 2292 wrote to memory of 404	2292	msedge.exe	85
PID 2292 wrote to memory of 404	2292	msedge.exe	85
PID 2292 wrote to memory of 404	2292	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f5aff52a04d0da8fff735bcd0de47c11_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9545846f8,0x7ff954584708,0x7ff954584718
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,6911639726803485993,15140791529770016689,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,6911639726803485993,15140791529770016689,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,6911639726803485993,15140791529770016689,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6911639726803485993,15140791529770016689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6911639726803485993,15140791529770016689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6911639726803485993,15140791529770016689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6911639726803485993,15140791529770016689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6911639726803485993,15140791529770016689,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,6911639726803485993,15140791529770016689,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3584 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e89db93aaa379ff5ab40feae422964fd

SHA1
e0d7c8a3babfab68a5b180ddd9c2c23532b45d6e

SHA256
2e7158e9b7363cbcdaee2a59acbe275293e003226910a73390c6259efc66140f

SHA512
285d16666fd3e06114fb21cdacdb0f8965a58a672457f9c685cc30ae8a149ad4d5080742e229999120f78f98391dda69ca513a039ffa2b7925e8e6b2201610c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
892514012dc8c0deccf4ca36465027c6

SHA1
7712840942801c045c5db3f4862e1082d79ad451

SHA256
eb9425ecee03199ced66187d867c051d0b6ec87e8834819a75b38e7244ea3fce

SHA512
3673899e989f393da39beb1bb58d4f802684fdb828e0d6c12fd01803a65a3a472840e5e270cc0c315b59f8887ddcd0b7771e05a9c686f01446ee053aecb58352

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b6282ac7db577d323ff7933565ccfbca

SHA1
04562b7c3f2e3dae34637288e9606f884431fa7f

SHA256
a3342561fac27a5a81e258d6080934dd58e18db7d937e8230412518fbda17240

SHA512
da9341c877505b21ae714e92afcff5d6a7807e4c52fdb9d96766b0cd776ce1a7526d6b1d882eb9cda927a89f305b20ca319a9b55ad9dd54efbf8433cfa07453e

Download Submit