7c10f8459939d9dae1c9f088fa009d1c4e400d7dceb4c6f234d1fd01964e19e5

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 01:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15aac7667c29318bb8da5c42740f5895_JaffaCakes118.html
Size

10KB
MD5

15aac7667c29318bb8da5c42740f5895
SHA1

1ca2b83d34e126ef8e86c3c6a22d1c3c23e1990c
SHA256

7c10f8459939d9dae1c9f088fa009d1c4e400d7dceb4c6f234d1fd01964e19e5
SHA512

8a25ac3980171ec6b236c55a493c81bfe877c51caa0259d5af5dade80ccdd62d8afa4a8e12cf46282fd2799ea6c9e3757695248140b4f8ed063a1f6455b449a7
SSDEEP

192:2VmclIsr03in8k/w1whqJk1bBlDrnoFzwr01y5uBuLbdU8d:smclIcuiB/g6bBlDrnoFzwr0y5guLZ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1984	msedge.exe
1984	msedge.exe
5020	msedge.exe
5020	msedge.exe
1472	identity_helper.exe
1472	identity_helper.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 3064	5020	msedge.exe	82
PID 5020 wrote to memory of 3064	5020	msedge.exe	82
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 676	5020	msedge.exe	83
PID 5020 wrote to memory of 1984	5020	msedge.exe	84
PID 5020 wrote to memory of 1984	5020	msedge.exe	84
PID 5020 wrote to memory of 2600	5020	msedge.exe	85
PID 5020 wrote to memory of 2600	5020	msedge.exe	85
PID 5020 wrote to memory of 2600	5020	msedge.exe	85
PID 5020 wrote to memory of 2600	5020	msedge.exe	85
PID 5020 wrote to memory of 2600	5020	msedge.exe	85
PID 5020 wrote to memory of 2600	5020	msedge.exe	85
PID 5020 wrote to memory of 2600	5020	msedge.exe	85
PID 5020 wrote to memory of 2600	5020	msedge.exe	85
PID 5020 wrote to memory of 2600	5020	msedge.exe	85
PID 5020 wrote to memory of 2600	5020	msedge.exe	85
PID 5020 wrote to memory of 2600	5020	msedge.exe	85
PID 5020 wrote to memory of 2600	5020	msedge.exe	85
PID 5020 wrote to memory of 2600	5020	msedge.exe	85
PID 5020 wrote to memory of 2600	5020	msedge.exe	85
PID 5020 wrote to memory of 2600	5020	msedge.exe	85
PID 5020 wrote to memory of 2600	5020	msedge.exe	85
PID 5020 wrote to memory of 2600	5020	msedge.exe	85
PID 5020 wrote to memory of 2600	5020	msedge.exe	85
PID 5020 wrote to memory of 2600	5020	msedge.exe	85
PID 5020 wrote to memory of 2600	5020	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\15aac7667c29318bb8da5c42740f5895_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa08db46f8,0x7ffa08db4708,0x7ffa08db4718
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,12992797825569111705,5087743319968639766,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,12992797825569111705,5087743319968639766,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,12992797825569111705,5087743319968639766,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12992797825569111705,5087743319968639766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12992797825569111705,5087743319968639766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12992797825569111705,5087743319968639766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,12992797825569111705,5087743319968639766,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,12992797825569111705,5087743319968639766,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12992797825569111705,5087743319968639766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12992797825569111705,5087743319968639766,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12992797825569111705,5087743319968639766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12992797825569111705,5087743319968639766,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,12992797825569111705,5087743319968639766,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4972 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
8fbe6640238802c9c7cd2727a7f5070d

SHA1
509e9e57f502dc993692ba64084dcb31e2e47ec4

SHA256
260818711558494e40faa0cee7f2d2447d0224465d67f9e8013c05d125f04e20

SHA512
62108b8c22e25c6fd03d4003469021b7a7a5e4f3814e777da07e936f80e107317f89eba3d828e8a818d080c6b0265c411cebc46c0460384006bbc1aaa10518bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c64df8debd5312ce79a4d786ed87f3b9

SHA1
286675dbf235c26354f7206577f4c079b9b637d3

SHA256
6cf4c2321a6e941dedee329e7b586e7d2a0ddc548e642847621e77934c11d48c

SHA512
3ddb2ea87b78aa6fd9aa0e5a53e08f9245b83f082a8461f2c0dfdaaa0eed0536ea9bb7ad83f77f800f7c256cf3c9967c2a298ba157fde403c789f9d4db810fd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cd7939ab5fd4d7ed80bb111346947104

SHA1
c116490d0296f98a450566bd758ea0da01dc94a2

SHA256
0afe05c8e843d2cf3fa7a3adbae7b78394d955ebee472efb0790daa44d38a1cc

SHA512
9ed06e89a4604eb96894215418a36e28fbaf593bc9ae78ea06790f1e895f00ebc9b72993f3f0cb50632dbd261386fffa230922109126484fd612a80746cb9795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fdbe52c571162f2670b2fc2c2ec3374f

SHA1
85f7a2f2ce087749079bcebc500d6a5bd4e6e0b2

SHA256
ca2ee4ec7a54755bbfb60a9e04ca6244f53e46143d670af77731bbf68ba05910

SHA512
f4144a839327faddb446f5cc6fe7c3901c212a2b5b1a4e4fb3ca3a45b74a738a6f3ea734ef35dbb4a759808d9dae57aa99a21fdb5cdca061fd601951d7894196

Download Submit