380c30f5a50561dff7d0c968eee01c7516dde5a42ceb9308a7eccc788bcc4c57

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14/05/2024, 17:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42515e37e85868c996b8fbc7770e056b_JaffaCakes118.html
Size

489KB
MD5

42515e37e85868c996b8fbc7770e056b
SHA1

3ea2bbfdaf687c9953e033f0fbb7ed3e5c58047e
SHA256

380c30f5a50561dff7d0c968eee01c7516dde5a42ceb9308a7eccc788bcc4c57
SHA512

37aab28710b065f1bcc76edc09faa8848e9dce271f3282a770fef8a96073eb7335e86c71830a50109fd8a4f2baa731d5f668cd9cec89b8e096171bfd8fdda3bb
SSDEEP

12288:5EGpd5m8qviYxWFNcIOznp5d+X3EeSLNUFeRt0tPhckpQHiGuzz0s8T:5EGpd5m8qviYxWFNcIOznl+Mxa0s8T

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3984	msedge.exe
3984	msedge.exe
4344	msedge.exe
4344	msedge.exe
1240	identity_helper.exe
1240	identity_helper.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe
944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 1368	4344	msedge.exe	82
PID 4344 wrote to memory of 1368	4344	msedge.exe	82
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 4496	4344	msedge.exe	83
PID 4344 wrote to memory of 3984	4344	msedge.exe	84
PID 4344 wrote to memory of 3984	4344	msedge.exe	84
PID 4344 wrote to memory of 2208	4344	msedge.exe	85
PID 4344 wrote to memory of 2208	4344	msedge.exe	85
PID 4344 wrote to memory of 2208	4344	msedge.exe	85
PID 4344 wrote to memory of 2208	4344	msedge.exe	85
PID 4344 wrote to memory of 2208	4344	msedge.exe	85
PID 4344 wrote to memory of 2208	4344	msedge.exe	85
PID 4344 wrote to memory of 2208	4344	msedge.exe	85
PID 4344 wrote to memory of 2208	4344	msedge.exe	85
PID 4344 wrote to memory of 2208	4344	msedge.exe	85
PID 4344 wrote to memory of 2208	4344	msedge.exe	85
PID 4344 wrote to memory of 2208	4344	msedge.exe	85
PID 4344 wrote to memory of 2208	4344	msedge.exe	85
PID 4344 wrote to memory of 2208	4344	msedge.exe	85
PID 4344 wrote to memory of 2208	4344	msedge.exe	85
PID 4344 wrote to memory of 2208	4344	msedge.exe	85
PID 4344 wrote to memory of 2208	4344	msedge.exe	85
PID 4344 wrote to memory of 2208	4344	msedge.exe	85
PID 4344 wrote to memory of 2208	4344	msedge.exe	85
PID 4344 wrote to memory of 2208	4344	msedge.exe	85
PID 4344 wrote to memory of 2208	4344	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\42515e37e85868c996b8fbc7770e056b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfc0446f8,0x7ffcfc044708,0x7ffcfc044718
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,3868663482227325635,12056789033505825546,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,3868663482227325635,12056789033505825546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,3868663482227325635,12056789033505825546,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3868663482227325635,12056789033505825546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3868663482227325635,12056789033505825546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3868663482227325635,12056789033505825546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,3868663482227325635,12056789033505825546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,3868663482227325635,12056789033505825546,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3868663482227325635,12056789033505825546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3868663482227325635,12056789033505825546,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3868663482227325635,12056789033505825546,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3868663482227325635,12056789033505825546,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,3868663482227325635,12056789033505825546,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5692 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
571198845711d63a777daa553541514b

SHA1
6154156a3a897340877679d342d65b8d52aabe8f

SHA256
9322d1cb87fbea2019aaf4dae60897489f0983027fae20e108403aa63565b626

SHA512
b0d81dfc4de7465e33cb56cacd9f42436151da12718d0c600fc9b362d47c9c149b0270d775c5f5fa7f8ab2e5b58800c6c92fb5d333c0e3d4b27f2043b3eeb529

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
644B

MD5
75c28e318b31219041dc7b689ad11f48

SHA1
bc617007c6ed09052be08040edf2cca3effef3ad

SHA256
ee2ba36ded4bf0d62ccb495eb1ad0980e182a6712077689289275a9ccf9a9d42

SHA512
87988eb7132fb12fd4c07ed4589109ce5bc0fa43a482fae30594eb5db4073c6e47758deb77b810957ce52b65f368ccd97840d87719ec41b788cdba7aa84e80bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a5cff8a2b906bb9d26fcda68bdde1bbd

SHA1
7ce9c8ae70223e37413af91f10cbfeb74edce38f

SHA256
00aca4c4e659ec9065c47f62abade48d2c3abdddde91c3c0350996cd1a010923

SHA512
6d8895672f0903594d1f00af78b79524f317f444df259596c7296883270afd59581ee8af1c4c744a277bea3678986bab2638273c900188810c1d90c80b4126cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
269d954806baf5233caf56bb2dc3e841

SHA1
52cd6396631b7adb83a21cf20a3f5162790be4be

SHA256
2700f9e1697577ac9852ec04851a3e75a84e3a65f6e3f92f2517e507b8341824

SHA512
63c7381294a8758b882fed544df0da88d341ae9dd8fda3700a1a53bdf5f207251839a640eb02fb20a23775f307afa14188853cde1879ce2679ae7c6ec727c429

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1f0082eb9aa6068538f2b4a05cb3f4db

SHA1
98ce7b1bb14ef286a7d21268bc9a88ae842f0f80

SHA256
bf827676bc6cdfcb766dab5649e7abf403a2616d1edfc3147cf5a5c0fcc9e313

SHA512
e6e3efba2b31417fa1b5dcec7b2975a1f2edef87c41e1a350e7d64825490ff8684ac039f5d2ef4d0d0589d917b13edf89c722d245c7c930d0388ddb51b7ca83b

Download Submit