a0d235f43f4929fe341be165fa3a62fa44b6de2f68b515eae5cca5247bfa49bf

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

135ecd9e007abe2843fcd821a8c5891d_JaffaCakes118.html
Size

10KB
MD5

135ecd9e007abe2843fcd821a8c5891d
SHA1

4c53af5b99a07c51abe998e77188c38b3680b7b7
SHA256

a0d235f43f4929fe341be165fa3a62fa44b6de2f68b515eae5cca5247bfa49bf
SHA512

0bb89cc08cabe8c313ff736972429938a0fc99aa4e49b7f947223abd0a247ea7d44156297a201d7561b8fb413313ea2648258af3d4f0c5ffaa93d600f14b6c31
SSDEEP

192:2VjlIsr03aP8k/w1wvqVkZ/B5AncpXrlf01PSbauBuLbdU8d:sjlIcuaJ/gY/B5AncpXrlf0YaguLZ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
4528	msedge.exe
4528	msedge.exe
816	identity_helper.exe
816	identity_helper.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 4628	4528	msedge.exe	82
PID 4528 wrote to memory of 4628	4528	msedge.exe	82
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 988	4528	msedge.exe	83
PID 4528 wrote to memory of 2948	4528	msedge.exe	84
PID 4528 wrote to memory of 2948	4528	msedge.exe	84
PID 4528 wrote to memory of 2996	4528	msedge.exe	85
PID 4528 wrote to memory of 2996	4528	msedge.exe	85
PID 4528 wrote to memory of 2996	4528	msedge.exe	85
PID 4528 wrote to memory of 2996	4528	msedge.exe	85
PID 4528 wrote to memory of 2996	4528	msedge.exe	85
PID 4528 wrote to memory of 2996	4528	msedge.exe	85
PID 4528 wrote to memory of 2996	4528	msedge.exe	85
PID 4528 wrote to memory of 2996	4528	msedge.exe	85
PID 4528 wrote to memory of 2996	4528	msedge.exe	85
PID 4528 wrote to memory of 2996	4528	msedge.exe	85
PID 4528 wrote to memory of 2996	4528	msedge.exe	85
PID 4528 wrote to memory of 2996	4528	msedge.exe	85
PID 4528 wrote to memory of 2996	4528	msedge.exe	85
PID 4528 wrote to memory of 2996	4528	msedge.exe	85
PID 4528 wrote to memory of 2996	4528	msedge.exe	85
PID 4528 wrote to memory of 2996	4528	msedge.exe	85
PID 4528 wrote to memory of 2996	4528	msedge.exe	85
PID 4528 wrote to memory of 2996	4528	msedge.exe	85
PID 4528 wrote to memory of 2996	4528	msedge.exe	85
PID 4528 wrote to memory of 2996	4528	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\135ecd9e007abe2843fcd821a8c5891d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e39c46f8,0x7ff9e39c4708,0x7ff9e39c4718
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3439831782404325854,2469196917559897974,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,3439831782404325854,2469196917559897974,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,3439831782404325854,2469196917559897974,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3439831782404325854,2469196917559897974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3439831782404325854,2469196917559897974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3439831782404325854,2469196917559897974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3439831782404325854,2469196917559897974,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3196 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3439831782404325854,2469196917559897974,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3196 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3439831782404325854,2469196917559897974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3439831782404325854,2469196917559897974,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3439831782404325854,2469196917559897974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3439831782404325854,2469196917559897974,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3439831782404325854,2469196917559897974,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
df4390dc0e448dc0eed4fb4cb3e525d6

SHA1
ac2a65495cc514d476b41c9561337fa31963f738

SHA256
dbffa01499cd3de4c31bbf9deae15592017c757d1a82ce98086e27caa55e10dd

SHA512
60b8509786d13587b8749b9be06f20b745e846dbd46ed58305a5a8bbe17fd3268aa87fa4e3a95460bf3d9ed34659506e27c03a0c44a627a3db82ba76ea8b3bf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1bd97350467530f78e17e18af467bf41

SHA1
5d6e6e55157502e407629dd132070177aa69e26a

SHA256
75a03835a091d7031eb02308764a094b7b58c35be81fbc77aba8156a5aff72e0

SHA512
f1280713224093b8b5d8d43208d79efbf7f6fcd46d22147a16f9881914f60bb690e2c68011e2bd68a247a906f3d73df2842dabbae49747989b75da90bff670ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b67589815e0739f59a9ae3e611960d0c

SHA1
03c2751ca4ad39ef6e5055184044a0a1950109c3

SHA256
63020e4db8fc3761c1211e294670963e65d74583d017dd15e05e8d546d9f9b6b

SHA512
ffe341847ac9ad9aea4b933b7236131a5d6e4ceb86ee05e85b5de26477105c521812ae0efc5b188514cd1ecccb5185a8b4a6e0236992321e901256c83e3acd23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
32a9146ae6c85f3941200cc612e0cfef

SHA1
a4ba3f9d8ef1c9989718ce624707ef6d8e39d8d8

SHA256
41d68c39784dfe1eca7b2e4a29ef406c260fdd291bba4d95ff95dcbaee515879

SHA512
47e9f4da988c6393b0f2909f47a594a65889e1a67cf87d58ba733f126d4c749642be4b8940f5466d811074ce032aed97eb0b5b3b856a4747cedb92322defba43

Download Submit