88a068be79d56b693e1dedee602bea2fcf72f55f5bb083d3f038e440ea162bbf

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 10:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a50ec799bb42df1155daa3f4f99b1353_JaffaCakes118.html
Size 60KB
Sample240613-mdzessvbqe
SHA256 88a068be79d56b693e1dedee602bea2fcf72f55f5bb083d3f038e440ea162bbf
MD5 a50ec799bb42df1155daa3f4f99b1353
SHA1 d93334272f691d0c5eaed4791c29a8e56f2731cf
SHA512 771d7184cee544390581d83b5bb806b78d6d18bf755e28e3cb8c73e3ff1edc122940a9c9b3c827d334eaf61e2eb8a1aa55c4bcf7a6c504fd3d4a990cc8e7df10
SSDEEP 768:rnn5pqmNqbEarbVNqCaWSqmVY0hvNt/ifqxH7rgT:rnnrqmNqXhMCkz1VifqxH7rgT
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
2876	msedge.exe
2876	msedge.exe
2076	identity_helper.exe
2076	identity_helper.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe
1772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe
2876	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 924	2876	msedge.exe	82
PID 2876 wrote to memory of 924	2876	msedge.exe	82
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 2280	2876	msedge.exe	84
PID 2876 wrote to memory of 1144	2876	msedge.exe	85
PID 2876 wrote to memory of 1144	2876	msedge.exe	85
PID 2876 wrote to memory of 4816	2876	msedge.exe	86
PID 2876 wrote to memory of 4816	2876	msedge.exe	86
PID 2876 wrote to memory of 4816	2876	msedge.exe	86
PID 2876 wrote to memory of 4816	2876	msedge.exe	86
PID 2876 wrote to memory of 4816	2876	msedge.exe	86
PID 2876 wrote to memory of 4816	2876	msedge.exe	86
PID 2876 wrote to memory of 4816	2876	msedge.exe	86
PID 2876 wrote to memory of 4816	2876	msedge.exe	86
PID 2876 wrote to memory of 4816	2876	msedge.exe	86
PID 2876 wrote to memory of 4816	2876	msedge.exe	86
PID 2876 wrote to memory of 4816	2876	msedge.exe	86
PID 2876 wrote to memory of 4816	2876	msedge.exe	86
PID 2876 wrote to memory of 4816	2876	msedge.exe	86
PID 2876 wrote to memory of 4816	2876	msedge.exe	86
PID 2876 wrote to memory of 4816	2876	msedge.exe	86
PID 2876 wrote to memory of 4816	2876	msedge.exe	86
PID 2876 wrote to memory of 4816	2876	msedge.exe	86
PID 2876 wrote to memory of 4816	2876	msedge.exe	86
PID 2876 wrote to memory of 4816	2876	msedge.exe	86
PID 2876 wrote to memory of 4816	2876	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a50ec799bb42df1155daa3f4f99b1353_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb750746f8,0x7ffb75074708,0x7ffb75074718
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13186067860905012891,12209191085542892129,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,13186067860905012891,12209191085542892129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,13186067860905012891,12209191085542892129,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13186067860905012891,12209191085542892129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13186067860905012891,12209191085542892129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13186067860905012891,12209191085542892129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1836 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13186067860905012891,12209191085542892129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13186067860905012891,12209191085542892129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13186067860905012891,12209191085542892129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13186067860905012891,12209191085542892129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13186067860905012891,12209191085542892129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13186067860905012891,12209191085542892129,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5648 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5848f6de-bd45-4414-bc10-f9b982ad2909.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5848f6de-bd45-4414-bc10-f9b982ad2909.tmp
Size 11KB
SHA256 220a9c80046ade2f23f3c8ee69c03d89817175c66581f8d7ac65d5b864c812c1
MD5 513163ba8d445c73f01b7c95472c5f56
SHA1 bc36cb630bf3dbcc9186c85d717c02ede985c877
SHA512 51a0335f7c1233f5f2e3393aabba5f8c615c543f820cbf62ffe50dd59dfef529dc715f47aaac5dc95c365f4a9a3dc6162562de064d47828e7f093ffc169cd98a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupUp0Le2RUedvX3z2OMDCRHa:A9iIxuERzA83h09RZxYDb1XaOMWRHqlL
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
MD5 81e892ca5c5683efdf9135fe0f2adb15
SHA1 39159b30226d98a465ece1da28dc87088b20ecad
SHA512 c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
MD5 56067634f68231081c4bd5bdbfcc202f
SHA1 5582776da6ffc75bb0973840fc3d15598bc09eb1
SHA512 c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 625B
SHA256 4871dc6799465582a9becf992c5762b7cd0198109ca19e760c0d33c79720530e
MD5 cf3096de132566753859621a7c18a47a
SHA1 cbd5468e58d71a3ac97de642b81afe13e91917f6
SHA512 d4bd448332d7674beed2046bf935060d9c1f9b027d50a1538674958a39ae04132246d036d6ca65a969b35f652017a09bd493c5c7184993402ba6784687c15254
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ea183fb93adf8645ed709a67b3dd7f32c93d1270bdd898484240981618872f0f
MD5 97e95bb551d3a9fd711fbbff48b6c3e1
SHA1 7833b7158b8dad85f11788700641ab0edf3c9195
SHA512 0d6cd56615c154ab3ac64a8f961aeabc575fc387ea2adbdb76e6093f41e7df48799cc90539122325c7b7fd78d30623eb922d6e4b777b32e14fced58d0e97c26e
SSDEEP 96:nDk7oxm/Dnmqj1k4wpvWMoiVmde6qIqQZ3WUWQyV+VDCAiEwb:nDkd6sW4GWMKqdkmrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e041f0d258686217c5cd02a3e5ff4d18894de9048e62a68c994553cdee391fd9
MD5 3b541d0224e7aebdf104235622965421
SHA1 cea05f6d9d7c541a32f90f0a1d8be6685612b1d9
SHA512 b3d19c773ebda18d7858c89d8f572115e7c1ab192d23842c8681772fd611601a132195e6fd00c349c30112062170fb640f2d6673d2f3e5bcd17a711a4e5e52ba
SSDEEP 96:nDk7oxm/DQYmqj1k4wpvWMoiVmdeHIqQZ3WUWQyV+VDCziEwb:nDkdIsW4GWMXdkmro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 64e2453caabe72e653e9bf9e39fb60d509261c87da2f43dda783ca317ddddba0
MD5 ba84a0022f9a476e79426b00c974f0b6
SHA1 528e43326b4110625c1bdf297b6c76e0c8caa28f
SHA512 30cc9c7406189cb445427ca44c3b90bb91bfd571942ba3c7da9dc58c67922c422ae5b10ec3f72b6a89a7ce471e2909badba374c96e216bc4bad287000030d9e9
SSDEEP 96:nDk7oxm/Dnmqj1k7wpvWMoiVmde6uT2IqQZ3WUWQyV+VDCAiEwb:nDkd6sW7GWMKg2dkmrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download