4636b2b671ef0de59c490cde3b81940d678fc40ad9438abb0bc30cffd763b2bb

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15610a89722824068a57d4377a5d592e_JaffaCakes118.html
Size

85KB
MD5

15610a89722824068a57d4377a5d592e
SHA1

f297a66e1080ed3b880366d4adb9e7d0aaefc1ca
SHA256

4636b2b671ef0de59c490cde3b81940d678fc40ad9438abb0bc30cffd763b2bb
SHA512

306898185bebcfb638d09097ce90878f427068354ce11737e58b542158e23b67fb733fbba886c9a46165a7676a7a049bbff29b00411939ec04c4aa068ffef61e
SSDEEP

1536:w+ipVn1BUNqvLKvr7R/+nVXWCUPSo0mjiMpbqqvmznhKv++nPLB1Vu:wBvLKvr7RSMiyuznhKv++nTB1k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
664	msedge.exe
664	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
664	msedge.exe
664	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe
664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 664 wrote to memory of 3724	664	msedge.exe	82
PID 664 wrote to memory of 3724	664	msedge.exe	82
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4840	664	msedge.exe	83
PID 664 wrote to memory of 4832	664	msedge.exe	84
PID 664 wrote to memory of 4832	664	msedge.exe	84
PID 664 wrote to memory of 2032	664	msedge.exe	85
PID 664 wrote to memory of 2032	664	msedge.exe	85
PID 664 wrote to memory of 2032	664	msedge.exe	85
PID 664 wrote to memory of 2032	664	msedge.exe	85
PID 664 wrote to memory of 2032	664	msedge.exe	85
PID 664 wrote to memory of 2032	664	msedge.exe	85
PID 664 wrote to memory of 2032	664	msedge.exe	85
PID 664 wrote to memory of 2032	664	msedge.exe	85
PID 664 wrote to memory of 2032	664	msedge.exe	85
PID 664 wrote to memory of 2032	664	msedge.exe	85
PID 664 wrote to memory of 2032	664	msedge.exe	85
PID 664 wrote to memory of 2032	664	msedge.exe	85
PID 664 wrote to memory of 2032	664	msedge.exe	85
PID 664 wrote to memory of 2032	664	msedge.exe	85
PID 664 wrote to memory of 2032	664	msedge.exe	85
PID 664 wrote to memory of 2032	664	msedge.exe	85
PID 664 wrote to memory of 2032	664	msedge.exe	85
PID 664 wrote to memory of 2032	664	msedge.exe	85
PID 664 wrote to memory of 2032	664	msedge.exe	85
PID 664 wrote to memory of 2032	664	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\15610a89722824068a57d4377a5d592e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff79846f8,0x7ffff7984708,0x7ffff7984718
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8775313967656084857,5938493212517218370,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,8775313967656084857,5938493212517218370,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,8775313967656084857,5938493212517218370,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8775313967656084857,5938493212517218370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8775313967656084857,5938493212517218370,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8775313967656084857,5938493212517218370,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
48d3dd34fbc3597ae6300f930170724b

SHA1
b9ab54224f97d9cc8466bb353a056b716af08e72

SHA256
df86a2431c9b361059b955921ee553e6ebac1b1262930c5d6f623ec92cf4c152

SHA512
ec9387bef2b7c6fcd54a58cfb59f75cd5fa994b377b1cc7908dfa260b9c2ce08fe2ab311d3e56b40118c9c2a7316071dad343aa4b22e1b06fb62eafa3e30ec6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5ec80dc433b35f9eaa9b8292068e2ff2

SHA1
c8660876db1392b6af8b809321b21c66bc1ef175

SHA256
55de99d64b3b71ecb199396e3e304bdddea175986b3289202398d21303359f6e

SHA512
377cbff65abf6dd8452b644f5f9c5b49ac13d01d777792bf60f28e0d23aaf17e89ab9d13284cd494d7bace62b47844c497c7a60fb8bbc90c27d80ef4dc6896c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f07f53f9a53c9b26fcea7e0856ddbf05

SHA1
5347b9b5fdce686fae09d2e4aca9fbb777579b9c

SHA256
44660dd06d7dc00516e7f7a0ae693f6bf4514f93033b2ef176daf9bad06d6fa8

SHA512
a8158ee3a11a844cbfb2176b07739826174e033b6bcda1989d7bfd2cc4384f7f6bd49121952946dba7124ea33c46b377c4f5051a5dca0867a76307ed6e04a4aa

Download Submit