Analysis

  • max time kernel
    145s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 20:32

General

  • Target

    6c2b4992c577f006a2d0563508565f80_JaffaCakes118.html

  • Size

    185KB

  • MD5

    6c2b4992c577f006a2d0563508565f80

  • SHA1

    de43e610bc85773ef1d8653c4aa7297570e4fec3

  • SHA256

    d7314b56107e5c87c1574c183dfc79fefb6ba06febc52767dc98046d3739ce23

  • SHA512

    90ca9d43bad52aa505c18dd9a912ea75e8d5c01df36555d766b6541e10b6487685f1a8fa2f6aa72ab72fd5ec162e122039794da53dd9b687f02b4d3107e4d2f7

  • SSDEEP

    3072:WxDNvG8rm/GXmNJUNBVTRQUe+ErvfnLIgufWyHb/th2wHngwDWERa1:oVXmNJo81

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6c2b4992c577f006a2d0563508565f80_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4532
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd168946f8,0x7ffd16894708,0x7ffd16894718
      2⤵
        PID:1720
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,16350096995657823546,5549380057365333227,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
        2⤵
          PID:4752
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,16350096995657823546,5549380057365333227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1028
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,16350096995657823546,5549380057365333227,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
          2⤵
            PID:4848
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16350096995657823546,5549380057365333227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
            2⤵
              PID:4104
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16350096995657823546,5549380057365333227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
              2⤵
                PID:3960
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16350096995657823546,5549380057365333227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
                2⤵
                  PID:3184
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16350096995657823546,5549380057365333227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
                  2⤵
                    PID:1744
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16350096995657823546,5549380057365333227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
                    2⤵
                      PID:4904
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16350096995657823546,5549380057365333227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
                      2⤵
                        PID:4856
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16350096995657823546,5549380057365333227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
                        2⤵
                          PID:1600
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,16350096995657823546,5549380057365333227,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2352
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:3040
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:3924

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                            Filesize

                            330B

                            MD5

                            c5a1825ad30a16f88d9d2e3a8142d41a

                            SHA1

                            3e2f53c3c00a73bf97ec5c052732121918ac58de

                            SHA256

                            4d82d3f22ee7fe4b3c5ad1193155bfdaa9eff91cfc80dc02490cbbd75224a256

                            SHA512

                            399384453543e30078b942ada951e6853398c7dadfa89ca33550abf3aebfa4dc8b45ef9e3ff3cdb852ff462d1579d9047f3a10a1397345e39d1fc4f9da4b9091

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            56641592f6e69f5f5fb06f2319384490

                            SHA1

                            6a86be42e2c6d26b7830ad9f4e2627995fd91069

                            SHA256

                            02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

                            SHA512

                            c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            612a6c4247ef652299b376221c984213

                            SHA1

                            d306f3b16bde39708aa862aee372345feb559750

                            SHA256

                            9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

                            SHA512

                            34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

                            Filesize

                            20KB

                            MD5

                            b6c8122025aff891940d1d5e1ab95fce

                            SHA1

                            a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

                            SHA256

                            9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

                            SHA512

                            e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

                            Filesize

                            44KB

                            MD5

                            88477d32f888c2b8a3f3d98deb460b3d

                            SHA1

                            1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

                            SHA256

                            1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

                            SHA512

                            e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            456B

                            MD5

                            ec2a8767463d6d00cc8436e35c86d061

                            SHA1

                            87dc225617070a1156da68a0e1909ef7e41dc012

                            SHA256

                            38b22d9fc7af813452a07aca5dba58a8440d4e79b7b79f01927b8a61d510c039

                            SHA512

                            deb7bf283efa839f5994b3937277abf43924bcd38ea8d94f3d5dec2ee8cf42065e4f78a406e03f66630d55ecccc33cd602a7609fa585b1f08ed0fac2e7cff693

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            432B

                            MD5

                            86db7bb6857a295293c0eb5d72d4e158

                            SHA1

                            18d05bddd73a892b66f2a74a2b12229c9f49d757

                            SHA256

                            32c82633fee8bca310ab317feeba0d2266b4600cb05e8e64bae5bffc93a07021

                            SHA512

                            e95b00de2c7d5c3d2d1546ddb7fae0be5ab402afedaf09fe5023f16380f748f04601ef5284da1610a22d7e0eabf13be45e8f418aa1acd17464b9396a61a81a7c

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                            Filesize

                            4KB

                            MD5

                            58361418230f5ea7b29c258b723ee7de

                            SHA1

                            e88061dfaae8e18cf10d4bc768ea06ff145a6f05

                            SHA256

                            ce997a6f4ac7efdc7ed401a6aecc2eaee0aa060a829cca149725e14f352a45e0

                            SHA512

                            79d5ef3d2ac640e35b49f3b5010de5d890e23edc6bae997a310f7014cdad49a48fbd9af19787b61599e97fb13bf3a56a7c72d79845e87b98b9e42e02d2b1433f

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            306c50595aded9a268b88dfc1284c47f

                            SHA1

                            1c9d81ded1b089451cab3a8b81be41f8c120ee3b

                            SHA256

                            9109ace2d2c6e35b798dfcaa09a43b6a2f70fdb05fe883ad153e3624227ab87f

                            SHA512

                            ade04f989291ad4d67e3290f92a12a6eeb56174642045f57b7fc26ca54996b68332fab62c23885c418a4db8d1352ec332f3285fcf76d2afd3209f017ab25fa33

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            8KB

                            MD5

                            7b3a4f81e00a6a24fc3153c00bfdfb24

                            SHA1

                            0bdbd0dfa53f47deb1d0714af544c944a6bd0c7d

                            SHA256

                            552d473b49cfa559bc0a2edeb0de7a0e190abba5821b014ccd5b8670b49b80a9

                            SHA512

                            a4d1b3b07d94f151d06f898a65fecb18a5ac65cfe62c7966181f0659426bd5500228a31d7894b1b3cce0825c291ea870dc10803bfb5afcf5698c5bf9b37cff58

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            11KB

                            MD5

                            16c9a729229fd5aea16e7a15689de13b

                            SHA1

                            0a54d93ecf9a0a218e564ebc00320897ad08e46c

                            SHA256

                            12074f4bbe5164a8e9a22f4e1b2ae4ad1007eb4d215477eaede36ffa3da1b87c

                            SHA512

                            73b70743bae0aca0286364d6d35a5c9ebd0fcd13ae596532ee4f74bf133b173366916e85340b38dfdb9723cc3ce9235a21bb5e4230686b5e4967fa955a697e66