Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-05-2024 13:00

General

  • Target

    2f3bd68fca59a105c7532240223579ab_JaffaCakes118.html

  • Size

    162KB

  • MD5

    2f3bd68fca59a105c7532240223579ab

  • SHA1

    670f4b3f40289468bf728a737872fc315d7f09a4

  • SHA256

    1de2ea7dd3ded633a139f0d6831de2d7ab7349c3f2714955e73949de9f585cb8

  • SHA512

    ecfabbe15fc6534db293665cd01722b252e9c681fce615f1e6f45f1ad42997b4b8f6ca2be6c93f073aafbb454f92da2b93b046a17862260b54baed3bf1a5c036

  • SSDEEP

    3072:lT8pBqL0dDtZpkjr9tfbUfNqiRybRpuyf7kjBu4u6xt:lT8pBjtZpkjx9g18/6

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2f3bd68fca59a105c7532240223579ab_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1076
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7a7146f8,0x7ffc7a714708,0x7ffc7a714718
      2⤵
        PID:3532
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
        2⤵
          PID:1512
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1268
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
          2⤵
            PID:2768
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
            2⤵
              PID:4032
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
              2⤵
                PID:3240
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
                2⤵
                  PID:4648
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2308 /prefetch:1
                  2⤵
                    PID:1432
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
                    2⤵
                      PID:4412
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
                      2⤵
                        PID:2384
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
                        2⤵
                          PID:1316
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6840 /prefetch:8
                          2⤵
                            PID:4912
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6840 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4864
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
                            2⤵
                              PID:3800
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
                              2⤵
                                PID:1056
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
                                2⤵
                                  PID:5212
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
                                  2⤵
                                    PID:5220
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,15693693392717042178,2395413265030097815,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5076 /prefetch:2
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:2824
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:628
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:1032
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:4856

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                        Filesize

                                        152B

                                        MD5

                                        c9c4c494f8fba32d95ba2125f00586a3

                                        SHA1

                                        8a600205528aef7953144f1cf6f7a5115e3611de

                                        SHA256

                                        a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

                                        SHA512

                                        9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                        Filesize

                                        152B

                                        MD5

                                        4dc6fc5e708279a3310fe55d9c44743d

                                        SHA1

                                        a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

                                        SHA256

                                        a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

                                        SHA512

                                        5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

                                        Filesize

                                        44KB

                                        MD5

                                        88477d32f888c2b8a3f3d98deb460b3d

                                        SHA1

                                        1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

                                        SHA256

                                        1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

                                        SHA512

                                        e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                        Filesize

                                        264B

                                        MD5

                                        31aabf6adb520d11f7d4ec70f0ba347d

                                        SHA1

                                        e79299007237f9a7a80328432ed776233cbeb400

                                        SHA256

                                        d5ee55da3345b11dae36eef796270d51bacde7b5d20770869bbb0dff6a43aa38

                                        SHA512

                                        2bfcb643282fd0266e108ad89ffb05411f8dd5f051acd90084b17c4d0d38edcc5c66943e9da27d166bd01b5cf771e1f03d93fd1494f2dc831327d034507ab53b

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                        Filesize

                                        240B

                                        MD5

                                        14ca9d0db97306aff93214b156a450f3

                                        SHA1

                                        33a794eeca244490f9b052fbef8e301fc58e0a0b

                                        SHA256

                                        4bce228fb90bedafd900e059bd23ad88b5295323469ad9ccdc1a6fe2607a3310

                                        SHA512

                                        a1e7a22ad9ecd88cf9d5c2f9467eb2412ef540648021e913c5c3dd36d53bf18f404d9515217d6e9dc34ac4cf6d19e8344bac20cb577bb2bcfba862c5c5cdc1bc

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                        Filesize

                                        4KB

                                        MD5

                                        dd70497edef066478fb51bfbd3837122

                                        SHA1

                                        3ec050b507e8c93ec19729c777ebe0d816d8db94

                                        SHA256

                                        18a9f3dbaf97e948e76e587e21965e563906e3fadae1bf5bf885527a61b4e9fa

                                        SHA512

                                        54ac14e1c37afee065df2f16e963b3f343451b84a74c5c6cf9234c2f111bb1da85284e47fd1cce6f378b41681a30732680a547d6e04d739b138eeec998d050d3

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                        Filesize

                                        4KB

                                        MD5

                                        6fbf0e72ce4b776d92fe064009e8af75

                                        SHA1

                                        965b92250170442ce35de3237a703cc4f8cecc3e

                                        SHA256

                                        860fc8653910ee2566b7f2cf57f06170ffdc41bcfed11b5d6aaa6b8d99e3ff5e

                                        SHA512

                                        787c06abea3fd937cbb17b3482be5341d2cedca7d8180d05c1cf86967db5268d2110dc18e6f751f62c8084778a6f0817f72aee7a71d8d0baa0ac029afb8e8114

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        8KB

                                        MD5

                                        43ed0bae42d3e857dfec80eebd602589

                                        SHA1

                                        40f997ab3881edc27b388ef68776c326f96ad2ca

                                        SHA256

                                        6cb52c97e58fe2453ed9248de3aeeb25f1c4a9acd10c570c65831755e4927f71

                                        SHA512

                                        9f33f87f432f8bb35fdbc505a63dc63611c474248b815f20daa2440fa3233ec2b69b3269c0a5e9d31f767624f77e1eaaf0187d290f57d4ea193ba88444b19877

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        5KB

                                        MD5

                                        b0aed4ca7d42346dd161b7a97269bff2

                                        SHA1

                                        06e25fca89c6135c127d7a338ff9e65fab6458ad

                                        SHA256

                                        2ff1eefd9bfb92e7d8d7aa841a25f18826cc3c0e931705f38b1982a62feda951

                                        SHA512

                                        82dab4b1ade66cc9fc515fe3a7c881ffa501cd54134f4ff2d822fea65a0c8a157f6aee3c4c61caf6e6573cb76af4184501b90e115495fb87a1b3ff4f6e2b2413

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        8KB

                                        MD5

                                        6cc72744bbe7e18fa65397dc633bce9e

                                        SHA1

                                        85dbd823747f9b06bf1afb649664bfb74d31a201

                                        SHA256

                                        fdbbe5c32e5e9c006614719b7dc52b427bb9465d3b1db20f1e5577f1d61182de

                                        SHA512

                                        1650b9bb5589967fac777ab42b973eb30626cfcdfe198d3611c79089b5e1549ac5106e8428bd29c72f7b7e61d5d25fd586913f63fb417277268438aed3c189b9

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c1c0745f-a60e-41de-b0a7-c90343ba478e.tmp

                                        Filesize

                                        8KB

                                        MD5

                                        17c313a49de33ca7d6e859cdf1560695

                                        SHA1

                                        6aa0ccadeae0ae324f1c66f3c542df48f22ef06f

                                        SHA256

                                        d85a18b4549d38cd208efe84649fe084b3ce154c1bbd0718c03cbe6c8e824136

                                        SHA512

                                        701b7e316023433e5a837a6f9ee9df2ce6dc3c2aadf0fd36641e0b5530664986bae8545c468f6affedb7b0f9783b447964d5e676292f589f35fe51925674f627

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                        Filesize

                                        16B

                                        MD5

                                        46295cac801e5d4857d09837238a6394

                                        SHA1

                                        44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                        SHA256

                                        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                        SHA512

                                        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                        Filesize

                                        16B

                                        MD5

                                        206702161f94c5cd39fadd03f4014d98

                                        SHA1

                                        bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                        SHA256

                                        1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                        SHA512

                                        0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                        Filesize

                                        11KB

                                        MD5

                                        5b01a8ab5724db94a1e31284d2205b08

                                        SHA1

                                        072fa7f3bfb4298eafa745b4ffb9e951236e45a0

                                        SHA256

                                        5f46f743f8308063f5704fdd8e91ec0d09a0b12a02be2b6e223be3c097f39160

                                        SHA512

                                        4631cb58fe9cb97399dde1b5894257e0fe8ae5ff77be2512ad4aabbb7bbb284ab09f7204e74a54c8ed1ac9e66ffbf41e151e0289a1113406596f6c15c2eef5fe

                                      • \??\pipe\LOCAL\crashpad_1076_APXHAKMEXPWDTUVM

                                        MD5

                                        d41d8cd98f00b204e9800998ecf8427e

                                        SHA1

                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                        SHA256

                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        SHA512

                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e