50f09a6edc85fad5acacaca6724c7ffd72e4af74900b6500134e40cecb6b68cb

Analysis

max time kernel
145s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 11:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a088b7a15c0c39ad8285d699cfc6d6a6_JaffaCakes118.html
Size 213KB
Sample240612-nr2mratand
SHA256 50f09a6edc85fad5acacaca6724c7ffd72e4af74900b6500134e40cecb6b68cb
MD5 a088b7a15c0c39ad8285d699cfc6d6a6
SHA1 cbcc0ddeb65691e66051d36fb301c8d3a004532c
SHA512 c84c6f3708bc199b951c98970e73dceab0d78e775cb82a8b6d700ac493550d96122848e58e38ffad49855a4652e76626465c576393e4a2e08a919b0b1d68daff
SSDEEP 3072:MrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJx:Uz9VxLY7iAVLTBQJlx
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1324	msedge.exe
1324	msedge.exe
5020	msedge.exe
5020	msedge.exe
1704	identity_helper.exe
1704	identity_helper.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe
4276	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 4176	5020	msedge.exe	83
PID 5020 wrote to memory of 4176	5020	msedge.exe	83
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 2276	5020	msedge.exe	84
PID 5020 wrote to memory of 1324	5020	msedge.exe	85
PID 5020 wrote to memory of 1324	5020	msedge.exe	85
PID 5020 wrote to memory of 2616	5020	msedge.exe	86
PID 5020 wrote to memory of 2616	5020	msedge.exe	86
PID 5020 wrote to memory of 2616	5020	msedge.exe	86
PID 5020 wrote to memory of 2616	5020	msedge.exe	86
PID 5020 wrote to memory of 2616	5020	msedge.exe	86
PID 5020 wrote to memory of 2616	5020	msedge.exe	86
PID 5020 wrote to memory of 2616	5020	msedge.exe	86
PID 5020 wrote to memory of 2616	5020	msedge.exe	86
PID 5020 wrote to memory of 2616	5020	msedge.exe	86
PID 5020 wrote to memory of 2616	5020	msedge.exe	86
PID 5020 wrote to memory of 2616	5020	msedge.exe	86
PID 5020 wrote to memory of 2616	5020	msedge.exe	86
PID 5020 wrote to memory of 2616	5020	msedge.exe	86
PID 5020 wrote to memory of 2616	5020	msedge.exe	86
PID 5020 wrote to memory of 2616	5020	msedge.exe	86
PID 5020 wrote to memory of 2616	5020	msedge.exe	86
PID 5020 wrote to memory of 2616	5020	msedge.exe	86
PID 5020 wrote to memory of 2616	5020	msedge.exe	86
PID 5020 wrote to memory of 2616	5020	msedge.exe	86
PID 5020 wrote to memory of 2616	5020	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a088b7a15c0c39ad8285d699cfc6d6a6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa292946f8,0x7ffa29294708,0x7ffa29294718
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7872738385320845472,8163375974219601674,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,7872738385320845472,8163375974219601674,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,7872738385320845472,8163375974219601674,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7872738385320845472,8163375974219601674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7872738385320845472,8163375974219601674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,7872738385320845472,8163375974219601674,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,7872738385320845472,8163375974219601674,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7872738385320845472,8163375974219601674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7872738385320845472,8163375974219601674,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7872738385320845472,8163375974219601674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7872738385320845472,8163375974219601674,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7872738385320845472,8163375974219601674,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1128 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
MD5 4b4f91fa1b362ba5341ecb2836438dea
SHA1 9561f5aabed742404d455da735259a2c6781fa07
SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
MD5 eaa3db555ab5bc0cb364826204aad3f0
SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 faa4d7b28aba47e4d4d4f957039aef05fb812137bab5832c1cbfb6e03cbff0d2
MD5 e4e493964d439ec0f9d216f3c820d8dd
SHA1 44b1c2b7d7a4ea0ecb91aeb5d428e352d956281b
SHA512 7c3d5f11444c6869ef9426b326f4099074056b7795e687bcbf746baabfeaf2f220d599c551e7634b110deb69e224ff4a832843b885f3810811b37016cc98da9e
SSDEEP 96:nFkhdG1IEj0wpvWMoiVmdeHmQIjUWQyV+VDCziEwb:nFkbG+Ej0GWMX8ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b1a3cfda61f8b0f967a11d7438e81771a827794b1c97085e83c2df766fa444f4
MD5 62c78ecbd612442b6d80ac3c4510ed7b
SHA1 344dc6d6cb4bffec37a390b89036afc9abc7423b
SHA512 268779794800712e7d1b7dfe333f1a7b275c5584532d14ebcce10228d5b6bf195f0b764e3ce834d5c6d4e510186754cd2a87bc3e643f18f26d0cd9b8b04e3883
SSDEEP 96:nFkhdG1Icj0wpvWMoiVmdeHmQIjUWQyV+VD7AiEwb:nFkbG+cj0GWMX8rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0e22ae6b16b82871c98872d8fec92bd539eec24443e3264a176a57c56a9a0ccb
MD5 5c2a4753526a2cc5cce20fb9bd17337d
SHA1 c7ca4a9407e14ebdd1f7dad95b80cea2d71ad5d5
SHA512 5d2f1210f61060f0097f17e6261eb46b1c5713586649435f4d8e58f94d4153d2f1424eda6c68cb1b260b36e3b5996f46f2ea070a90e8bff8e7045c4d52df88ca
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupFKe2RU/IKbd:A9iIxuERzA83h09RZxYFEMd
MD5 SHA1 SHA512 SSDEEP

Submit Download