78d15a9a8f9f484cec2b260bcf35cbe1f1be4c0aea179246c5f3b6e710494879

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dce657a84bf8724acd73477e20e31c4c_JaffaCakes118.html
Size

89KB
MD5

dce657a84bf8724acd73477e20e31c4c
SHA1

87c77c590b656935a6c2462e6653dc2340f494cd
SHA256

78d15a9a8f9f484cec2b260bcf35cbe1f1be4c0aea179246c5f3b6e710494879
SHA512

91e5677c9208334e591771b010d63a4b96369585771ed46d4f2840964fbb6503a67bc2b94de6296edd1fbb1b2bfa0b9b8b4868e3c6092963f801c8aa90e64a0e
SSDEEP

1536:SHYDnJrW4H5gVacm1YKeafLQnuAkpr9DGr:S4J5ggihnuNr9D4

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
4836	msedge.exe
4836	msedge.exe
1436	identity_helper.exe
1436	identity_helper.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 2716	4836	msedge.exe	83
PID 4836 wrote to memory of 2716	4836	msedge.exe	83
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 2620	4836	msedge.exe	84
PID 4836 wrote to memory of 1328	4836	msedge.exe	85
PID 4836 wrote to memory of 1328	4836	msedge.exe	85
PID 4836 wrote to memory of 4708	4836	msedge.exe	86
PID 4836 wrote to memory of 4708	4836	msedge.exe	86
PID 4836 wrote to memory of 4708	4836	msedge.exe	86
PID 4836 wrote to memory of 4708	4836	msedge.exe	86
PID 4836 wrote to memory of 4708	4836	msedge.exe	86
PID 4836 wrote to memory of 4708	4836	msedge.exe	86
PID 4836 wrote to memory of 4708	4836	msedge.exe	86
PID 4836 wrote to memory of 4708	4836	msedge.exe	86
PID 4836 wrote to memory of 4708	4836	msedge.exe	86
PID 4836 wrote to memory of 4708	4836	msedge.exe	86
PID 4836 wrote to memory of 4708	4836	msedge.exe	86
PID 4836 wrote to memory of 4708	4836	msedge.exe	86
PID 4836 wrote to memory of 4708	4836	msedge.exe	86
PID 4836 wrote to memory of 4708	4836	msedge.exe	86
PID 4836 wrote to memory of 4708	4836	msedge.exe	86
PID 4836 wrote to memory of 4708	4836	msedge.exe	86
PID 4836 wrote to memory of 4708	4836	msedge.exe	86
PID 4836 wrote to memory of 4708	4836	msedge.exe	86
PID 4836 wrote to memory of 4708	4836	msedge.exe	86
PID 4836 wrote to memory of 4708	4836	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dce657a84bf8724acd73477e20e31c4c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9687b46f8,0x7ff9687b4708,0x7ff9687b4718
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,17278186231485202941,8581780518932364875,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,17278186231485202941,8581780518932364875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,17278186231485202941,8581780518932364875,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17278186231485202941,8581780518932364875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17278186231485202941,8581780518932364875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17278186231485202941,8581780518932364875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17278186231485202941,8581780518932364875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,17278186231485202941,8581780518932364875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,17278186231485202941,8581780518932364875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17278186231485202941,8581780518932364875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17278186231485202941,8581780518932364875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17278186231485202941,8581780518932364875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,17278186231485202941,8581780518932364875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,17278186231485202941,8581780518932364875,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
71b8f09c7f290442959bd96ff3bbd79a

SHA1
afc84f5271da495572f77b65265038ccb78cf802

SHA256
44a32b1aa02fa3aedc145b3f2384b314fc204beb24e826ca695cccc9e711f8e0

SHA512
ed4f48af34fbd6096f84409bb91fdc95c9618e47d1135c8eee95536c80fc0fdbe02e02ef3df45dcdfcb8c063250958520ee79e29292c738dd4cf530e44ff6419

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
333B

MD5
ee57360b409b7db75dfb1640805c2856

SHA1
dd6c9c8c702bd6c7f960a8b2c6017d9cf8dca850

SHA256
206d60ff675449f6b880c83ce18d1b974acdfca7b8b5ec5d4f1db96b265acbbd

SHA512
9513383eb0e93c9557592d60584b3c6261a638d93ea7d4442004a039fd5644e7a5eaf2d9ce970567de52c39bf9aaee9e2b327d18446140c8d41ceed894e4c3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
38a83c2f2a6d258b8bbd3725ad098ebf

SHA1
f93a14d88ad4a575896ce6858ac9491eeb661ae1

SHA256
56023f259ebe32601a190f7129fffcd75acf95fc809a6f93c029d0866e54178c

SHA512
e8636bd33c51d4846b7c765260d019770544e9d5593895b2036705d2efde844db9c0c4a3a8cbde0ae026e2a3f3c2d2520cf28d6d1441de260ac17bc077e29fbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3d4eddea403fa4e9f257b8f3fdbab91a

SHA1
1a7fa78ec5d5a054b2232925c42a854ff8746a38

SHA256
abde34d96091e5a1aa2e1b8704b7dfe32fd8638a7ef66720b45b93b113711c29

SHA512
8652aaacfd0a5cc4326c1a578f348092b56d56b8fc0249b58d2c8025b566853c05ea562af2fc4571d5d9ac9548c08a3573ace8fd7366f78596536c3e62c22c46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fce77ba3d2fee64ed879658a80381847

SHA1
656c8558c4af25f3228989b0e5d6aa59161a8145

SHA256
d26f9c5d54593a152810c55a7f2f782fd1354744b08748a755697b49ab2b2ca0

SHA512
d6e359d63e5f091346dfbd83bd590974bcec10f92203e22a6779a0c6930f2a944646a11a1af6106d235cc44b8c0be0a1e9a41a5734ef2e341df8c9ba8f915938

Download Submit