1642c23f112ffb2fc8f0d97849447863e72f7cad141d38f1e351e2bea3b36475

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 21:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25bbd4ea6b86a6736877fa7862eefdec_JaffaCakes118.html
Size

85KB
MD5

25bbd4ea6b86a6736877fa7862eefdec
SHA1

9dbdb3323087ca136a96672dd8909303f75dca6c
SHA256

1642c23f112ffb2fc8f0d97849447863e72f7cad141d38f1e351e2bea3b36475
SHA512

cd3fd509d52cd037bb2e596b60b8851749122d4a34e0ebaef1d04f6d0d69ef95c59a5d6ee85b0796a534455ec042c29e0a7e3a89e35781f1f2b28f03ef6e24c1
SSDEEP

1536:8+ipVn1BUNqvLKvr7R/mnVfWCUHSo0mjiMpbqqvmznhKv++nPLB1VO:8BvLKvr7R6UiyuznhKv++nTB14

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4392	msedge.exe
4392	msedge.exe
212	msedge.exe
212	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
212	msedge.exe
212	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 4476	212	msedge.exe	83
PID 212 wrote to memory of 4476	212	msedge.exe	83
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 3880	212	msedge.exe	84
PID 212 wrote to memory of 4392	212	msedge.exe	85
PID 212 wrote to memory of 4392	212	msedge.exe	85
PID 212 wrote to memory of 1636	212	msedge.exe	86
PID 212 wrote to memory of 1636	212	msedge.exe	86
PID 212 wrote to memory of 1636	212	msedge.exe	86
PID 212 wrote to memory of 1636	212	msedge.exe	86
PID 212 wrote to memory of 1636	212	msedge.exe	86
PID 212 wrote to memory of 1636	212	msedge.exe	86
PID 212 wrote to memory of 1636	212	msedge.exe	86
PID 212 wrote to memory of 1636	212	msedge.exe	86
PID 212 wrote to memory of 1636	212	msedge.exe	86
PID 212 wrote to memory of 1636	212	msedge.exe	86
PID 212 wrote to memory of 1636	212	msedge.exe	86
PID 212 wrote to memory of 1636	212	msedge.exe	86
PID 212 wrote to memory of 1636	212	msedge.exe	86
PID 212 wrote to memory of 1636	212	msedge.exe	86
PID 212 wrote to memory of 1636	212	msedge.exe	86
PID 212 wrote to memory of 1636	212	msedge.exe	86
PID 212 wrote to memory of 1636	212	msedge.exe	86
PID 212 wrote to memory of 1636	212	msedge.exe	86
PID 212 wrote to memory of 1636	212	msedge.exe	86
PID 212 wrote to memory of 1636	212	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\25bbd4ea6b86a6736877fa7862eefdec_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdac5c46f8,0x7ffdac5c4708,0x7ffdac5c4718
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,12176555332517249981,13621049281474936635,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,12176555332517249981,13621049281474936635,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,12176555332517249981,13621049281474936635,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,12176555332517249981,13621049281474936635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,12176555332517249981,13621049281474936635,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,12176555332517249981,13621049281474936635,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6806d72f1478410ad4163d32a82ea36d

SHA1
25ca8fa97622fb1db25d8da92e65287ba511ed1b

SHA256
c8f5de991c2bdc107c5e8798611b8ede4c1ad4d0e13d8b6e46586b05e38208c9

SHA512
48f9f7e23710cd445970fb6dfa24cb4b8f8141fe90eacc1cd3ecbed64e0d924ec7a1e5f34c5ba5c0d8ddbd171c60e32c67e82a2c9d3bd68787f91ea7845803f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5d4a7cdf3f7c2c1d5c3d12f05a90b18a

SHA1
9f996a2a098eee47a6a1ce23483690ee8ccd775c

SHA256
549b465f6c504c59ae14dae90f4dc5ef71590c5cc39aa6a58a1d089115e4531c

SHA512
e2652550cf2c6b4d1dd1cc7e3a9e814f1d88c7d242f70c6486ef4712ca4d49641f6720232ec9b76a6ad5cd27f6fba9ae254da6385ffbd659ce48519e77cab684

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fdc381ac3b0b1858cfa41b9cfce7567e

SHA1
129e7148a71566c1caa39ac3032d4a171afc521f

SHA256
1e78f56006dd9c371a371ac876501bb72e482c67e01bc7be9a88da58e85e5254

SHA512
e55f4256cb199729b31d2681d0db0fa37cc25697d1ef91f8ce7050fa492701712a72954986c86924e08cff9f216fc6b1f2076a5c709750ede8745c0fe5637415

Download Submit