c3857ea744950edd611ff2452a9ca20984dc352d1300cd45d4801d2fd3a92087

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 16:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

142a9c63c30184c0beeabb3ee39d473e_JaffaCakes118.html
Size

139KB
MD5

142a9c63c30184c0beeabb3ee39d473e
SHA1

cd62c633a6a96ce2ca4266d03f4f040179ae606a
SHA256

c3857ea744950edd611ff2452a9ca20984dc352d1300cd45d4801d2fd3a92087
SHA512

8a62c164ebc5c0c6233073fa76d0555836a33757dcb53075db75cac75a9067376c5e60c83858a3dcb6d6183238ee4a05921d06d858d39bd5e196cd936a102676
SSDEEP

1536:SgBN/nFxHFZieDB0+3+EltoqyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP9:SgBMwoqyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
3972	msedge.exe
3972	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe
3772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 380	3972	msedge.exe	83
PID 3972 wrote to memory of 380	3972	msedge.exe	83
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 4220	3972	msedge.exe	84
PID 3972 wrote to memory of 3616	3972	msedge.exe	85
PID 3972 wrote to memory of 3616	3972	msedge.exe	85
PID 3972 wrote to memory of 4004	3972	msedge.exe	86
PID 3972 wrote to memory of 4004	3972	msedge.exe	86
PID 3972 wrote to memory of 4004	3972	msedge.exe	86
PID 3972 wrote to memory of 4004	3972	msedge.exe	86
PID 3972 wrote to memory of 4004	3972	msedge.exe	86
PID 3972 wrote to memory of 4004	3972	msedge.exe	86
PID 3972 wrote to memory of 4004	3972	msedge.exe	86
PID 3972 wrote to memory of 4004	3972	msedge.exe	86
PID 3972 wrote to memory of 4004	3972	msedge.exe	86
PID 3972 wrote to memory of 4004	3972	msedge.exe	86
PID 3972 wrote to memory of 4004	3972	msedge.exe	86
PID 3972 wrote to memory of 4004	3972	msedge.exe	86
PID 3972 wrote to memory of 4004	3972	msedge.exe	86
PID 3972 wrote to memory of 4004	3972	msedge.exe	86
PID 3972 wrote to memory of 4004	3972	msedge.exe	86
PID 3972 wrote to memory of 4004	3972	msedge.exe	86
PID 3972 wrote to memory of 4004	3972	msedge.exe	86
PID 3972 wrote to memory of 4004	3972	msedge.exe	86
PID 3972 wrote to memory of 4004	3972	msedge.exe	86
PID 3972 wrote to memory of 4004	3972	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\142a9c63c30184c0beeabb3ee39d473e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd15f846f8,0x7ffd15f84708,0x7ffd15f84718
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,13240562023404216117,5730821422514262562,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,13240562023404216117,5730821422514262562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,13240562023404216117,5730821422514262562,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13240562023404216117,5730821422514262562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13240562023404216117,5730821422514262562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,13240562023404216117,5730821422514262562,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4824 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1147db17cf0488354f2c3b47593bad96

SHA1
cec9e7b6a31d764b38c008d013635383610f7776

SHA256
eb0598cb985f9be10273babcfd80cf3d789e04d60d4784b5291c163bbbdd844d

SHA512
87b529fd28c2a1f648b51d2d0a9d8f87426f622dc909475028a3b56ae1136fe7fc5d2616d297e590c9dcf4430cbf5a5252f4a9c719f352c1a310d50bcdff1fd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5af53eaeb7aae508edef747a5c87c7e5

SHA1
479677aa3b317a0ae41b69c23a666f8a63f1cc21

SHA256
976214e359a895446f99905a7686766b29d5c6fa5571737cff3f739978170476

SHA512
b5d19318f70b697c8ddcf4212a7284f144b6a1900bbe44b5ddbdbb89c00213387454bb724068ad09edeecac53753f07727976e47c1570e74230745d0faacbd32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
027eec43623eeba47d54aff7be2a9e19

SHA1
91b9f4e24f70c6c1722e029031b75530e1692819

SHA256
3dd72c8589fa971a0926e9f3aebaa41c3b14bc9314d66b3c05c226d7f908926b

SHA512
e1b30953292ba05009627d53304bbddf1755b78baa0e43243ad277c9eccd2298634d130402326b31f7c17b3ed510b1a3f5d94574bd25f50dfc35cb909649079b

Download Submit