be2d0a594339ae8e4413f0b558327c0f63d8ba8263dee4e63944140989f52af7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 23:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

153def22bb09919c7ab749cad5b139c1_JaffaCakes118.html
Size

15KB
MD5

153def22bb09919c7ab749cad5b139c1
SHA1

5ff9669a6a953abda476e61d4be29725c6480414
SHA256

be2d0a594339ae8e4413f0b558327c0f63d8ba8263dee4e63944140989f52af7
SHA512

2be7a3b8fe141a81c2d274376ca49d656c36aef470647f50c01fbac6b56e429a99bc0399d3300213e250f4961c191184cc2be72d8c7f65fbece26e9de81345bb
SSDEEP

384:q34gRlQPMgjLsduLE9K8NoNtP99I8w7jL:iP4bsgAoNN9vw7jL

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2860	msedge.exe
2860	msedge.exe
4508	msedge.exe
4508	msedge.exe
4580	identity_helper.exe
4580	identity_helper.exe
3292	msedge.exe
3292	msedge.exe
3292	msedge.exe
3292	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 4724	4508	msedge.exe	82
PID 4508 wrote to memory of 4724	4508	msedge.exe	82
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2864	4508	msedge.exe	83
PID 4508 wrote to memory of 2860	4508	msedge.exe	84
PID 4508 wrote to memory of 2860	4508	msedge.exe	84
PID 4508 wrote to memory of 3164	4508	msedge.exe	85
PID 4508 wrote to memory of 3164	4508	msedge.exe	85
PID 4508 wrote to memory of 3164	4508	msedge.exe	85
PID 4508 wrote to memory of 3164	4508	msedge.exe	85
PID 4508 wrote to memory of 3164	4508	msedge.exe	85
PID 4508 wrote to memory of 3164	4508	msedge.exe	85
PID 4508 wrote to memory of 3164	4508	msedge.exe	85
PID 4508 wrote to memory of 3164	4508	msedge.exe	85
PID 4508 wrote to memory of 3164	4508	msedge.exe	85
PID 4508 wrote to memory of 3164	4508	msedge.exe	85
PID 4508 wrote to memory of 3164	4508	msedge.exe	85
PID 4508 wrote to memory of 3164	4508	msedge.exe	85
PID 4508 wrote to memory of 3164	4508	msedge.exe	85
PID 4508 wrote to memory of 3164	4508	msedge.exe	85
PID 4508 wrote to memory of 3164	4508	msedge.exe	85
PID 4508 wrote to memory of 3164	4508	msedge.exe	85
PID 4508 wrote to memory of 3164	4508	msedge.exe	85
PID 4508 wrote to memory of 3164	4508	msedge.exe	85
PID 4508 wrote to memory of 3164	4508	msedge.exe	85
PID 4508 wrote to memory of 3164	4508	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\153def22bb09919c7ab749cad5b139c1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9023646f8,0x7ff902364708,0x7ff902364718
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,16797209691504647763,4754148035524474469,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,16797209691504647763,4754148035524474469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,16797209691504647763,4754148035524474469,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2364 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,16797209691504647763,4754148035524474469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,16797209691504647763,4754148035524474469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,16797209691504647763,4754148035524474469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,16797209691504647763,4754148035524474469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,16797209691504647763,4754148035524474469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,16797209691504647763,4754148035524474469,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,16797209691504647763,4754148035524474469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,16797209691504647763,4754148035524474469,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,16797209691504647763,4754148035524474469,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3588 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
12646157f8821e2b86cc35e364d95f39

SHA1
c6f0504750b789dc3af1c42977870a863060c97d

SHA256
0b214b4a265f1186841a2cba60641471af0b0b039f1062871158acbbb8926589

SHA512
d1a2c713d85714dc11bce3cca08c39e5a4a028d10ae4d9ad22aae1909ee810d7234d2f2c70553ad00b09654a82d4a5c3a2987a487ffed89756e1de9be2435bc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
40c32ca2f1956206e88da26b9726141d

SHA1
aab7c0eec057c3ae2c607a99cab68bd598983ec8

SHA256
639ac1685c67dea2445eb682142fd4d54d57e950e9cca8a43466c03b85c09ab7

SHA512
6b6179c9828ea893ad8baf702d99e26b843d526c168887299d940558d05cff2c594508286e543aff5dd7deb85b1c3b71dca0218541b6203afa94fb37f827c668

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
62d3f906d8ced9e0e72ad7b01b385d6e

SHA1
6a1296152103f7e4f1e530d00cfcf656434d2f66

SHA256
c049fe566948b7fd60738f40826ce9702a6ee9032890e09f66d14ef0ac041c6d

SHA512
57dd2228deaf0c74ee1f56c42807dcadb171676132ab1436331bf8a39e89bd172ae285c1c4813511ee0551c34efccbb6fec4942e62f902d0d08cc66d529e9224

Download Submit