Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-05-2024 03:35

General

  • Target

    2d22b4770c37aeaa26744d01d7a624e1_JaffaCakes118.html

  • Size

    90KB

  • MD5

    2d22b4770c37aeaa26744d01d7a624e1

  • SHA1

    c50d74ed4fe8e8665458b55134d19c4b8b4f58aa

  • SHA256

    42a0efaf0f5a30205b7162572fb013c9ece5c5c5eb48f85277afe98f7aa129af

  • SHA512

    f0e1d5d706662468eaffc59e38c070404f83efd8c57562ce5d6b4caab662b2a7014729769954f69b1c589ecd9175669a610f966cfb4fe9252a92ffcbdeeec439

  • SSDEEP

    1536:y2OVs/biOSx4Bs/biOSx4qkg3GBkzBYjxlrDeeeceReeeeeezeeetAYEb5SpoTkh:y7oDl3GBkz2xlZM9rCX7Ceasg9c5autr

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2d22b4770c37aeaa26744d01d7a624e1_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:744
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ff98fab46f8,0x7ff98fab4708,0x7ff98fab4718
      2⤵
        PID:4880
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,17560057901378121407,8612056840687926773,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
        2⤵
          PID:1208
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,17560057901378121407,8612056840687926773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3388
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,17560057901378121407,8612056840687926773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
          2⤵
            PID:3160
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,17560057901378121407,8612056840687926773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
            2⤵
              PID:772
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,17560057901378121407,8612056840687926773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
              2⤵
                PID:2012
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,17560057901378121407,8612056840687926773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
                2⤵
                  PID:1704
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,17560057901378121407,8612056840687926773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
                  2⤵
                    PID:3348
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,17560057901378121407,8612056840687926773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
                    2⤵
                      PID:2348
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,17560057901378121407,8612056840687926773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
                      2⤵
                        PID:2512
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,17560057901378121407,8612056840687926773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
                        2⤵
                          PID:2984
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,17560057901378121407,8612056840687926773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6168 /prefetch:8
                          2⤵
                            PID:4596
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,17560057901378121407,8612056840687926773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6168 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1044
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,17560057901378121407,8612056840687926773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
                            2⤵
                              PID:4576
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,17560057901378121407,8612056840687926773,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
                              2⤵
                                PID:3860
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,17560057901378121407,8612056840687926773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
                                2⤵
                                  PID:2512
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,17560057901378121407,8612056840687926773,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
                                  2⤵
                                    PID:4908
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,17560057901378121407,8612056840687926773,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:2
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4784
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:1500
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:3152

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      56641592f6e69f5f5fb06f2319384490

                                      SHA1

                                      6a86be42e2c6d26b7830ad9f4e2627995fd91069

                                      SHA256

                                      02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

                                      SHA512

                                      c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      612a6c4247ef652299b376221c984213

                                      SHA1

                                      d306f3b16bde39708aa862aee372345feb559750

                                      SHA256

                                      9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

                                      SHA512

                                      34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

                                      Filesize

                                      20KB

                                      MD5

                                      b6c8122025aff891940d1d5e1ab95fce

                                      SHA1

                                      a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

                                      SHA256

                                      9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

                                      SHA512

                                      e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

                                      Filesize

                                      44KB

                                      MD5

                                      88477d32f888c2b8a3f3d98deb460b3d

                                      SHA1

                                      1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

                                      SHA256

                                      1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

                                      SHA512

                                      e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      96B

                                      MD5

                                      672df0facfc58f98267dd344e06ca7cb

                                      SHA1

                                      a66a22a46409064e6e4f8058c59f106f322cc0fa

                                      SHA256

                                      8a4668a91486e015ee910755b5e7a7e309b15a4d94bee433a20878143017f4b5

                                      SHA512

                                      fb25745678765ba790bb23fb37255e19b2986287f8d5817874edd1c84dd3b389c1afeb7289c6e4e253c7a64080149009f2cdb907d3043f8e2216e69cdb0237f8

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      360B

                                      MD5

                                      d864d474d262962ed5e6c7325c46755d

                                      SHA1

                                      771918ed5703c2806137d1570dccbd84d0a44c9b

                                      SHA256

                                      7e2f5b428597ec8c47a70225a69511166c9ce15091c701ab232f7dd6293ca975

                                      SHA512

                                      9f89fa9214965ff2f8479a733d947dc89eef7b76886883e6d5f354e0cd2d82684ada3946315c49bc1c8b672dfdfeff0bf20b94368272b41a913cde836fd0eeac

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      2KB

                                      MD5

                                      43ef3c2aceeb7c43a80a5566c6780a7c

                                      SHA1

                                      b98155e15c4a3dfeacafca6fbdc1e0b805a96b86

                                      SHA256

                                      b1da7a38d78671f154ca4b1f1172992ef7f25afa84d0aded848fb98e68660a99

                                      SHA512

                                      b4bcf87716369c92f28c3b953cc833398e22d9ede159ee4dfacaf476a2712967ab872e39a1d394e04edf4013e7edc78824cbba1e1c0a2ff098dec83ff7e03862

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      2KB

                                      MD5

                                      414339b48df5bb892b6dbfaae9371472

                                      SHA1

                                      7485611c24a19d78e69a7b5e2465cdf7f9d0ec28

                                      SHA256

                                      6b1fe6c41f2de84e1674936a89ebaff04145b84adc0868c21dab6743ad78349b

                                      SHA512

                                      b90f5409fc921218bafdb1bc470a55fff5f6027ca77704084e4c36cebcb2202a2ebf6181741a3bc16657c2f55901d763f458450e5f778a73b4d06f4b8c6e1336

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      7faeba68b1de7321c472ab90230c6ad1

                                      SHA1

                                      bc799a800ea9747df9eb4bb897ce4ca80e88caf7

                                      SHA256

                                      48016376ae2e82838c116963b948507f00f0c8c3cd849567251b8355e65177be

                                      SHA512

                                      cb0b0230804db1a400a99b3302fd4a473bf1d7ced2c212950385c0771bf1165a2ad493aeae84eb4a4dfc34d75d34a631ee9fcffc1b5c667e682ae363f818fd5f

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      8589dd77dd2b95caa76a47952ff086e7

                                      SHA1

                                      e050305e31e127578126fb5677896e30f0a79bba

                                      SHA256

                                      1d2e4c688292a3699b662723ae105ce815aeeb076a7efc0e9712a966afa30150

                                      SHA512

                                      5a863f906c30ee1cadc2f20da11ca40cbd5ef2b9859a381796ef52b50baefc14c499e7b46bc161ca7d1dfb4ab09cd878700ba5f2295ccf556e7070c7da84b682

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      8KB

                                      MD5

                                      bfed5192ff849b53b833a5db4731f818

                                      SHA1

                                      ccd4f47c75b10a0f0a230626e198bca05b3cafc8

                                      SHA256

                                      ec4ffd6843fdc1d41168f9c003906d161e523d4d7cc5761abc3ec5f69c6c8a5f

                                      SHA512

                                      84f7f6040ca670c1c45f7739212045b746874cfe5f0a36177a772ba9445d98e1c96fbe0b05b30ea3a362976a7d3c5ff9e6e2d3f5a1f2240967d64dbbe34aed37

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      6752a1d65b201c13b62ea44016eb221f

                                      SHA1

                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                      SHA256

                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                      SHA512

                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      1d5b4eb1ec8c081884b729b9e416f818

                                      SHA1

                                      2875066436f2a3c977fc7c231069864b3fb09150

                                      SHA256

                                      b4eeefdc8b27755c3e8e7486f20952f0d27758ab4338420e13f9a2e01832354d

                                      SHA512

                                      349cfd60169bc625a1917ddbd3cfe5f0baee52e8cead743f0d46ac09c11d3eff8fba4457ba86edd91c15a9f83effd565f51811a35e3704e2e9e0ef2e9fa6f168

                                    • \??\pipe\LOCAL\crashpad_744_BUPVRIXRJUMNGWLM

                                      MD5

                                      d41d8cd98f00b204e9800998ecf8427e

                                      SHA1

                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                      SHA256

                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                      SHA512

                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e