Analysis

  • max time kernel
    137s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2024 06:19

General

  • Target

    28ae7bbe2cf7bb2e6bd8ace63bd40f09_JaffaCakes118.html

  • Size

    348KB

  • MD5

    28ae7bbe2cf7bb2e6bd8ace63bd40f09

  • SHA1

    ce122bbb0b42663a07b5475a4e4bce0e88eacbec

  • SHA256

    a24d4e7c569fb5e1dcac99f95ba06a8cad943e90f06482a89f992c0a5685ce4a

  • SHA512

    2f05faa2c503c98cec96e6b18e75cde244d371bd254004a4b3f8b047c0678020a40985f62a4acf10632dcd9b7c21a7cb49809b0c6168d2752731cd3f412d2a91

  • SSDEEP

    3072:cqteTYJSMk/liKmSSQNMOGUBq/XjE9uTy:1eTe6j7

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\28ae7bbe2cf7bb2e6bd8ace63bd40f09_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:880
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8daf946f8,0x7ff8daf94708,0x7ff8daf94718
      2⤵
        PID:1240
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,5323752382550357315,16503936948981067350,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
        2⤵
          PID:1272
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,5323752382550357315,16503936948981067350,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4348
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,5323752382550357315,16503936948981067350,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
          2⤵
            PID:3000
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5323752382550357315,16503936948981067350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3040 /prefetch:1
            2⤵
              PID:3024
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5323752382550357315,16503936948981067350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3064 /prefetch:1
              2⤵
                PID:1684
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5323752382550357315,16503936948981067350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
                2⤵
                  PID:1724
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5323752382550357315,16503936948981067350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
                  2⤵
                    PID:1416
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5323752382550357315,16503936948981067350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
                    2⤵
                      PID:440
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5323752382550357315,16503936948981067350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
                      2⤵
                        PID:2944
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,5323752382550357315,16503936948981067350,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6508 /prefetch:8
                        2⤵
                          PID:1856
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,5323752382550357315,16503936948981067350,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6508 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4400
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5323752382550357315,16503936948981067350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:1
                          2⤵
                            PID:4932
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5323752382550357315,16503936948981067350,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
                            2⤵
                              PID:3468
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5323752382550357315,16503936948981067350,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
                              2⤵
                                PID:824
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,5323752382550357315,16503936948981067350,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6792 /prefetch:1
                                2⤵
                                  PID:2476
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,5323752382550357315,16503936948981067350,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6544 /prefetch:2
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:396
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:1856
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:3892

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    ae54e9db2e89f2c54da8cc0bfcbd26bd

                                    SHA1

                                    a88af6c673609ecbc51a1a60dfbc8577830d2b5d

                                    SHA256

                                    5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

                                    SHA512

                                    e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    f53207a5ca2ef5c7e976cbb3cb26d870

                                    SHA1

                                    49a8cc44f53da77bb3dfb36fc7676ed54675db43

                                    SHA256

                                    19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

                                    SHA512

                                    be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

                                    Filesize

                                    20KB

                                    MD5

                                    397383c90a2d930f866f405747e27466

                                    SHA1

                                    7bb6b5d6cee104c877dc5c3462f61232ffe5b360

                                    SHA256

                                    a67db01d19e15d8fa76e5a075e336e195325d79d277a83aadb6a440acf887c47

                                    SHA512

                                    4357eddc0581e3cd6209646540bf59756cb4035d7dba47d5cb6b0050e6c202bda65721d4e9d644f37e3cd105bc5fa240574cfa96649f01e2769b796b523e08aa

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

                                    Filesize

                                    22KB

                                    MD5

                                    5e74c6d871232d6fe5d88711ece1408b

                                    SHA1

                                    1a5d3ac31e833df4c091f14c94a2ecd1c6294875

                                    SHA256

                                    bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

                                    SHA512

                                    9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    264B

                                    MD5

                                    33a53d1f72da769a2b6d2d94bdfa3067

                                    SHA1

                                    7949d536cc92b11e9be5061ce2801f48e9bab86d

                                    SHA256

                                    73f27eee4ca361e3cb6a15b1481306d8023f64c7b7b3268049229ec9438bd51d

                                    SHA512

                                    4857859caeb163866d009a958ed69daa310b145d4532e448989a2c8a9f976448e5ef2c7170d1ec05a4abdc1072d198ce2e86f4097df94102e1cb4e29ac0af4ad

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    240B

                                    MD5

                                    7ddec09ddaf63ce1c0da8e6fd87cf19b

                                    SHA1

                                    0e1c742229b804b08fe61d6d97cb6fe495e1e293

                                    SHA256

                                    9f9f75c71a1fc9389cd20f62422c3f963dafd8577d06231bdd4329912c1cb0cd

                                    SHA512

                                    0ba696a9b676a5fe63eb7080331bd69422636552aa9315d5bc13e831a840c79b5281abf0d1eba2a9d4e94528fbe9df1e27c4fa97d807ded055f3b67d5ed6c0f4

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    3KB

                                    MD5

                                    9eb6b2c31125216c415d105b67bd51cb

                                    SHA1

                                    7a3c81793eb41e06388b77071d3cbf5e04d6d458

                                    SHA256

                                    067e1c2831522e2029eaa2d36bc38cb8d6d18fa5a18bce670fa3e948e3105a20

                                    SHA512

                                    d301c7078dde5765aba2956ca0af75f29f5bf38a3dce20c3212e30870b0c153dd7fef57dd99234867ddd5202100c3efe557ea80cef72d499e19013d169bf8bda

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    7KB

                                    MD5

                                    2e662bc2c43bcd79d9a25d666bc701d5

                                    SHA1

                                    adc09ef12d89e053828b477ba290441dce756c99

                                    SHA256

                                    df10ae31e86c90e93f82e1dd994eac33118b95047dff7a4923db4af82e5c88c2

                                    SHA512

                                    5661ff01db40607c0e57668da0be09689a64db79837e51e82c744d4760ea4825ca2c31282f5ca6f41f21f8f18fb7a2759c78335d942f7b0e2cb7c8210dd93a7b

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    5KB

                                    MD5

                                    20e7ca44b8f375ae1e99ea0320695ff6

                                    SHA1

                                    bb600560696e2d1d89c41ce5c7aaf890127a7b86

                                    SHA256

                                    971bb902f965f38d1bec4e4bc225bbe5f3fe21a29ea82ed423abe41887edf654

                                    SHA512

                                    b211167b8419ef574c8f180bcefa827c135f10cbce87c8c896a023a154a88753da29d0c616faf9f31196d9e957831c89ccfa780cb83150c309881d20dc58e10a

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    8KB

                                    MD5

                                    5aa41addb903c86ac832f6a02cf405a9

                                    SHA1

                                    682f557d9119051112dcf914a58e073808c253a8

                                    SHA256

                                    525271d5be14d9eb0708e863b4b8a528fa9536a6651172f273fe6c21376bc64a

                                    SHA512

                                    ab61cf52f0d7c64ba6fea68a17d799eb8d1ff5b6d2fb7cd560e47a9be65c44fd596316259fc16898af9f85e911ef442cc6ca3c8788bce09803fd7b569fe1a565

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    8KB

                                    MD5

                                    53269e9e5cdcfb64a890b165a6a4154e

                                    SHA1

                                    0c6a032024a40d78f3740a4d701d45615eb6feeb

                                    SHA256

                                    a6d77a82663f3e9e0402227760a7848b64b9983a7ccaf8c51994529a43b3efa1

                                    SHA512

                                    d826232a55ea59755b2a8f206a2a7d96b603920e149865f8302ee760b670bfda3f29ff686b2f3e4d628e001163cfafff9ad05a8fd10fb79f06ee31faa17cd460

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                    Filesize

                                    16B

                                    MD5

                                    6752a1d65b201c13b62ea44016eb221f

                                    SHA1

                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                    SHA256

                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                    SHA512

                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    11KB

                                    MD5

                                    8633c032c88351f046fe11bab4af085b

                                    SHA1

                                    0e3c201caf35fda07087159a8aefbbb3c5790635

                                    SHA256

                                    09d42b5ba672afd9c25b210c7a9892cf2c52d78b2ab19ba43a25ef1d82315c25

                                    SHA512

                                    fc421ec1b7b91ad539dd66343f4d7a5b121c9f7a490321134fb2b72b42af32e3820c31948aa72ec54d39a50295821a0fae627bc0e93118161f3d5d7dce59a71a