ac348463f46eff10936016c946158111c51378b707d6b315fd31d0813b594fd1

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 02:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15c4f70fb80d836a8bb97ed64b7bcabf_JaffaCakes118.html
Size

12KB
MD5

15c4f70fb80d836a8bb97ed64b7bcabf
SHA1

77599cfafa31490574ce255929f2a7bfc7dd87df
SHA256

ac348463f46eff10936016c946158111c51378b707d6b315fd31d0813b594fd1
SHA512

a6c0e0aa78291d4ce6b0efeb84453257fd9014ebccf952281520dc07b8246f1f7ce0f36676bc76aea30d79af7566378559903e028c5f405adc7a824c95f3d97c
SSDEEP

384:sblIcPVGjns/gcLBkZcnY1DA708LOXguLZ:ug/SJExLZ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe
4828	msedge.exe
4828	msedge.exe
2572	identity_helper.exe
2572	identity_helper.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe
2952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 3176	4828	msedge.exe	83
PID 4828 wrote to memory of 3176	4828	msedge.exe	83
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1088	4828	msedge.exe	84
PID 4828 wrote to memory of 1860	4828	msedge.exe	85
PID 4828 wrote to memory of 1860	4828	msedge.exe	85
PID 4828 wrote to memory of 2400	4828	msedge.exe	86
PID 4828 wrote to memory of 2400	4828	msedge.exe	86
PID 4828 wrote to memory of 2400	4828	msedge.exe	86
PID 4828 wrote to memory of 2400	4828	msedge.exe	86
PID 4828 wrote to memory of 2400	4828	msedge.exe	86
PID 4828 wrote to memory of 2400	4828	msedge.exe	86
PID 4828 wrote to memory of 2400	4828	msedge.exe	86
PID 4828 wrote to memory of 2400	4828	msedge.exe	86
PID 4828 wrote to memory of 2400	4828	msedge.exe	86
PID 4828 wrote to memory of 2400	4828	msedge.exe	86
PID 4828 wrote to memory of 2400	4828	msedge.exe	86
PID 4828 wrote to memory of 2400	4828	msedge.exe	86
PID 4828 wrote to memory of 2400	4828	msedge.exe	86
PID 4828 wrote to memory of 2400	4828	msedge.exe	86
PID 4828 wrote to memory of 2400	4828	msedge.exe	86
PID 4828 wrote to memory of 2400	4828	msedge.exe	86
PID 4828 wrote to memory of 2400	4828	msedge.exe	86
PID 4828 wrote to memory of 2400	4828	msedge.exe	86
PID 4828 wrote to memory of 2400	4828	msedge.exe	86
PID 4828 wrote to memory of 2400	4828	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\15c4f70fb80d836a8bb97ed64b7bcabf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99b4946f8,0x7ff99b494708,0x7ff99b494718
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,8803753551865115993,3140386975125156920,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,8803753551865115993,3140386975125156920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,8803753551865115993,3140386975125156920,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,8803753551865115993,3140386975125156920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,8803753551865115993,3140386975125156920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,8803753551865115993,3140386975125156920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,8803753551865115993,3140386975125156920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,8803753551865115993,3140386975125156920,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,8803753551865115993,3140386975125156920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,8803753551865115993,3140386975125156920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,8803753551865115993,3140386975125156920,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,8803753551865115993,3140386975125156920,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,8803753551865115993,3140386975125156920,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5044 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
9ee02dacf66771a8fc042a66854cd971

SHA1
8ae1c3577695a61cb75098ba444efa457859115a

SHA256
5f7cfd5b1860e9bfbe67a0126de5ff7cb1c4601f483b137c16ff64c8972af35e

SHA512
cad0e9aeed51a323f475d5325ce452c55228df6e92881cd9d1327962f2adef000c1b7479075f2ed556a3d4039dd3fa9ce0b439dbc15e1c3ffe3aed0896339005

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7e35d3649debc292931a4696f4706b39

SHA1
c5c824b3ed9a8a636d08efa63c6a0bd3d3405786

SHA256
b19358d22d3a01e73deb1c263f267c52ab9253fe37e19f8fd5c442e7bb1d69e4

SHA512
21e44fc1ceb6606093766cc3e674cf36e49c7afb4544240ee0c3fcca0d5eb458f0fa60d431b53894a831574c5b0d0c8e18d8e8c2ea37bbfbb1a6a7fc36219a7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f9a050e54f02bed8df42fd87e6cb3b03

SHA1
17e9dde36c47cbaa2fa930e2ac51e3243268f5f8

SHA256
e9432b241f47bec8134b7e95b8ea553cf4e3d4658e209fbfa7d43ac787895e07

SHA512
d4795121ac02b2b18afe4bf9771537c3e33f835cd2dc0d68c99765d0af943110267e68309d6618ad3476cdf08f5a6704e16e3c416c1e98a7ef3ff91fcf46e608

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
44b1ecc820b806227466afd22ccb986f

SHA1
de431a7cb1d997d4a186610ebfd09115863886cd

SHA256
e5d8b4188639b21480f7b4a66f270949c855c344834cdb3615b8f565f6995a74

SHA512
65e2db220f8e9f0f310d33d74daabea6ec1c01d0fa14336d2a29afc3f988ef9d4dc57c03eb310456729ec7aee927f4a295ba820a32834b3fa560c57baa4a75bb

Download Submit