42e30a61d084e90998bf5c89e2eb75f189cff33e6c8cd39f55113e231b865359

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
06/07/2024, 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28d61b138c143235077acd249e55ae18_JaffaCakes118.html
Size

11KB
MD5

28d61b138c143235077acd249e55ae18
SHA1

4bb86e56877a4edae0c428c271cf57a3ee43f204
SHA256

42e30a61d084e90998bf5c89e2eb75f189cff33e6c8cd39f55113e231b865359
SHA512

efa685e9f8dd3022ffe75008ff288e0bbc9c2d5bd86948d1d44a717b648c2514acb736338ba801db8349d74ae657f6499bb359842579381b58e6e0c6cb498302
SSDEEP

192:2ValIsr0r57M4wxalT8Iw/w1wvqa18LOXuBuLbdU8d:salIcIQ4wxatw/gg8LOXguLZ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4684	msedge.exe
4684	msedge.exe
1852	identity_helper.exe
1852	identity_helper.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 740	4684	msedge.exe	82
PID 4684 wrote to memory of 740	4684	msedge.exe	82
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 3936	4684	msedge.exe	83
PID 4684 wrote to memory of 4640	4684	msedge.exe	84
PID 4684 wrote to memory of 4640	4684	msedge.exe	84
PID 4684 wrote to memory of 1384	4684	msedge.exe	85
PID 4684 wrote to memory of 1384	4684	msedge.exe	85
PID 4684 wrote to memory of 1384	4684	msedge.exe	85
PID 4684 wrote to memory of 1384	4684	msedge.exe	85
PID 4684 wrote to memory of 1384	4684	msedge.exe	85
PID 4684 wrote to memory of 1384	4684	msedge.exe	85
PID 4684 wrote to memory of 1384	4684	msedge.exe	85
PID 4684 wrote to memory of 1384	4684	msedge.exe	85
PID 4684 wrote to memory of 1384	4684	msedge.exe	85
PID 4684 wrote to memory of 1384	4684	msedge.exe	85
PID 4684 wrote to memory of 1384	4684	msedge.exe	85
PID 4684 wrote to memory of 1384	4684	msedge.exe	85
PID 4684 wrote to memory of 1384	4684	msedge.exe	85
PID 4684 wrote to memory of 1384	4684	msedge.exe	85
PID 4684 wrote to memory of 1384	4684	msedge.exe	85
PID 4684 wrote to memory of 1384	4684	msedge.exe	85
PID 4684 wrote to memory of 1384	4684	msedge.exe	85
PID 4684 wrote to memory of 1384	4684	msedge.exe	85
PID 4684 wrote to memory of 1384	4684	msedge.exe	85
PID 4684 wrote to memory of 1384	4684	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\28d61b138c143235077acd249e55ae18_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff0a3746f8,0x7fff0a374708,0x7fff0a374718
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4156098037841556639,14575124542951275866,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,4156098037841556639,14575124542951275866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,4156098037841556639,14575124542951275866,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4156098037841556639,14575124542951275866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4156098037841556639,14575124542951275866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4156098037841556639,14575124542951275866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4156098037841556639,14575124542951275866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3228 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4156098037841556639,14575124542951275866,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4156098037841556639,14575124542951275866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4156098037841556639,14575124542951275866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4156098037841556639,14575124542951275866,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4156098037841556639,14575124542951275866,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4156098037841556639,14575124542951275866,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f0f818d52a59eb6cf9c4dd2a1c844df9

SHA1
26afc4b28c0287274624690bd5bd4786cfe11d16

SHA256
58c0beea55fecbeded2d2c593473149214df818be1e4e4a28c97171dc8179d61

SHA512
7e8a1d3a6c8c9b0f1ac497e509e9edbe9e121df1df0147ce4421b8cf526ad238bd146868e177f9ce02e2d8f99cf7bb9ce7db4a582d487bbc921945211a977509

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0331fa75ac7846bafcf885ea76d47447

SHA1
5a141ffda430e091153fefc4aa36317422ba28ae

SHA256
64b4b2e791644fc04f164ecd13b8b9a3e62669896fb7907bf0a072bbeebaf74a

SHA512
f8b960d38d73cf29ce17ea409ef6830cae99d7deafaf2ff59f8347120d81925ff16e38faaa0f7f4c39936472d05d1d131df2a8a383351f138c38afb21c1a60e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
f6da56b8410c22737af31f34164b1df1

SHA1
5d5b411103497426695e44cd45caee5ee66f41ef

SHA256
6e742b19740591342bb03138fd134caabf94e78222e580b7718aee5cca33f094

SHA512
4cd15b586f19e960cf96dd19c14f9b77e92e36bfec3a30d7f461639b1cc27737e06f89b8ede17d1b9cddd855aa3ccfd0be547ea36b81a93a2573c0b028484f9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
911b79e31dee0c4ce4f70867b262a0d0

SHA1
2fdae9de479c87f9fd376130934acdaf96085bc2

SHA256
aeea2555a518a2465d79a754bcce02cdd178c4463cb7c5d90d4e81ab2ed016a9

SHA512
8ff6ade002f1141552fe672da1996d5d0a66d739c19ba4e58f3663815b5140965716911c30a59068903e8d7165fcca45e371d4558a8a47f754c71c9e2eb757c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5e1467b1da882e565be15dc67ffc1f35

SHA1
8a8311ed93a31e52110fcc1d88a76801f17e9580

SHA256
e9825aec82c6a4f07fd9d35ef9ea683b3eedf3c393f04e39cae1a6f58907e119

SHA512
043dec86997d98462dfec4330fab0798aab101039b75c4fa448f81f29304cb16d04e0adfa2af92367fe12856c661ac16bee8d5e66eac7358c8dcfdddad910630

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
eb83187f310a92746306018e16bf7af7

SHA1
2073296ff4e2335fb5ba18b2352f8eb80a0257cb

SHA256
262255f6999c6e8cf54c5f7e021db2602ae59f9d252cd96e7c407c53fa65ffe6

SHA512
3b7a999e54cda51d9de8803c9b76d1b96c1213e388dc31697880dbc86ec7d48a651bc18301c69f5d57b62bdf5898ed1453377417970b5c92610ac46dbaa013e2

Download Submit