a7222c8d0b1106e8c6d86f8b6e65fcec5f4dc0d2bf988c597e296f7784c1aee8

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 01:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28c5437a9f22c36a8dbead5d45295d7f_JaffaCakes118.html
Size

10KB
MD5

28c5437a9f22c36a8dbead5d45295d7f
SHA1

4a267106cf2617f3385d83d35933d8e97f3a7f9a
SHA256

a7222c8d0b1106e8c6d86f8b6e65fcec5f4dc0d2bf988c597e296f7784c1aee8
SHA512

257476c10181db21f1af3bad5a196de22b8677347722295b289b4529a2f7a4ce8b70ec4270c3b53f9f68fc716b91656ff09791ea4051034fa1dd8751b49785dd
SSDEEP

192:2VClIsr03nE8k/w1whqJk10Bwrn2vk6hu01y5uBuLbdU8d:sClIcuns/g60Bwrn2vk6hu0y5guLZ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4292	msedge.exe
4292	msedge.exe
1044	msedge.exe
1044	msedge.exe
1496	identity_helper.exe
1496	identity_helper.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe
1044	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2596	1044	msedge.exe	83
PID 1044 wrote to memory of 2596	1044	msedge.exe	83
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 3516	1044	msedge.exe	84
PID 1044 wrote to memory of 4292	1044	msedge.exe	85
PID 1044 wrote to memory of 4292	1044	msedge.exe	85
PID 1044 wrote to memory of 1232	1044	msedge.exe	86
PID 1044 wrote to memory of 1232	1044	msedge.exe	86
PID 1044 wrote to memory of 1232	1044	msedge.exe	86
PID 1044 wrote to memory of 1232	1044	msedge.exe	86
PID 1044 wrote to memory of 1232	1044	msedge.exe	86
PID 1044 wrote to memory of 1232	1044	msedge.exe	86
PID 1044 wrote to memory of 1232	1044	msedge.exe	86
PID 1044 wrote to memory of 1232	1044	msedge.exe	86
PID 1044 wrote to memory of 1232	1044	msedge.exe	86
PID 1044 wrote to memory of 1232	1044	msedge.exe	86
PID 1044 wrote to memory of 1232	1044	msedge.exe	86
PID 1044 wrote to memory of 1232	1044	msedge.exe	86
PID 1044 wrote to memory of 1232	1044	msedge.exe	86
PID 1044 wrote to memory of 1232	1044	msedge.exe	86
PID 1044 wrote to memory of 1232	1044	msedge.exe	86
PID 1044 wrote to memory of 1232	1044	msedge.exe	86
PID 1044 wrote to memory of 1232	1044	msedge.exe	86
PID 1044 wrote to memory of 1232	1044	msedge.exe	86
PID 1044 wrote to memory of 1232	1044	msedge.exe	86
PID 1044 wrote to memory of 1232	1044	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\28c5437a9f22c36a8dbead5d45295d7f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff160146f8,0x7fff16014708,0x7fff16014718
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,3255622688778500089,2501666449274248372,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,3255622688778500089,2501666449274248372,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,3255622688778500089,2501666449274248372,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3255622688778500089,2501666449274248372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3255622688778500089,2501666449274248372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3255622688778500089,2501666449274248372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,3255622688778500089,2501666449274248372,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1748 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,3255622688778500089,2501666449274248372,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3255622688778500089,2501666449274248372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3255622688778500089,2501666449274248372,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3255622688778500089,2501666449274248372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,3255622688778500089,2501666449274248372,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4412 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,3255622688778500089,2501666449274248372,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5924 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
e6b4d6368be6606b5b315cce0a08fb86

SHA1
8e1d11b0d75eb18a97a78ac696d0180b14543535

SHA256
cdf00fea4edf5c946accbb81935f12e3332fcc8b4fca687151ff2d0907211818

SHA512
02680a4999cd96c276f90111a4770e5640a6aa53d44d05ca51a43e0719398808b0dddad61ef5a77fc62233b06ce4a45107db7cddf3567c73333874f53099f6e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0de522d31c85ccc18065cec7e5fb87d9

SHA1
412575649ff8d66fb88ce696dd2296f7f7d86b10

SHA256
c311b21d5f59cf06e7502a9daf248a2400808c17e63381b191b7002f8b60bae3

SHA512
6cc3d9a45ebb2358bf9900e90f52221d9e4ebf44e4de148a79b6daef779900a3d790b00cb368d5ac9c5940e047d4e820963e6669482331e10f08d0a7187ae547

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9bf529cf919946a35825a6c6c9498938

SHA1
64cc42f30a06485b9b384780a4667e9d1be1a0e3

SHA256
3c2e6eb3de886ab0157042c3504615d4e6663171eedb753abd22b738e8840f9e

SHA512
a43aa78049bb2b0c73376e2e30ce2ddb19cd3f5fe6cfdf8f5f75512a9863c07293e4e54f83d9d2cd91d65dd4bf310dcaecc5f0f3b1e5f50b018459efdc1f81a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6cb17a7f98e89d3b913f3f88987f118e

SHA1
0ddfbf787d757fd877209f98bc5c085e1e097aef

SHA256
e669a86066ec29e569a593cc0246ca1e25a98d9240d106585b4cd924d3161a1e

SHA512
54bc4a1ec2786e2899b264e13a4c45a8ccf94e4006f1beb7b6cd440acec608f6534eb23f61dfc8a9ef753811b93ff7c9904a12b2ec5268431a2bb43d5169e826

Download Submit