Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/05/2024, 11:40

General

  • Target

    7907c1bc981d264015b0cf4b63e02357_JaffaCakes118.html

  • Size

    267KB

  • MD5

    7907c1bc981d264015b0cf4b63e02357

  • SHA1

    7f197efe6b7d89e7a49d508e9601976ea75e24fc

  • SHA256

    1a68ad26aa7f6dd23491d656c9fee80ddf734c17ad09a00b1b156be7c73ca87a

  • SHA512

    52ac33a85b7055d35c7a9fd2768f75d3e9ec5fa9e701e568418f49b45db8e3a9ebdede8e2a8e8e114ea845403c6545f5b4fef6ea0062e31341f9e52ff9b423f7

  • SSDEEP

    3072:S/V6THn5iA1Tkv9BU19TQDmvvWri4r+uoC6Jp41viRNGjcosbjRD+7+zB2io0ggF:S/V6THn5iAJkMp2OIjk

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7907c1bc981d264015b0cf4b63e02357_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5020
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbd5146f8,0x7ffdbd514708,0x7ffdbd514718
      2⤵
        PID:4528
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
        2⤵
          PID:3956
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:5040
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
          2⤵
            PID:2004
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
            2⤵
              PID:2384
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
              2⤵
                PID:4896
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2068 /prefetch:1
                2⤵
                  PID:4200
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1992 /prefetch:1
                  2⤵
                    PID:876
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2112 /prefetch:1
                    2⤵
                      PID:1084
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
                      2⤵
                        PID:4156
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6888 /prefetch:8
                        2⤵
                          PID:3900
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6888 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3060
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
                          2⤵
                            PID:1848
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:1
                            2⤵
                              PID:4368
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
                              2⤵
                                PID:2792
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
                                2⤵
                                  PID:2220
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,12655358342293088861,9622796981599743685,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6076 /prefetch:2
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2212
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:1972
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:1776
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:1228

                                    Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                            Filesize

                                            152B

                                            MD5

                                            ce4c898f8fc7601e2fbc252fdadb5115

                                            SHA1

                                            01bf06badc5da353e539c7c07527d30dccc55a91

                                            SHA256

                                            bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

                                            SHA512

                                            80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                            Filesize

                                            152B

                                            MD5

                                            4158365912175436289496136e7912c2

                                            SHA1

                                            813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

                                            SHA256

                                            354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

                                            SHA512

                                            74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003b

                                            Filesize

                                            20KB

                                            MD5

                                            87e8230a9ca3f0c5ccfa56f70276e2f2

                                            SHA1

                                            eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

                                            SHA256

                                            e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

                                            SHA512

                                            37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003e

                                            Filesize

                                            118KB

                                            MD5

                                            dce1011360b966da40f760b23df1b72e

                                            SHA1

                                            4a463114391945d341c29c85892a20d1dcf5eea9

                                            SHA256

                                            a5e8a84b045d2b31be72de1f96c9f21afc6cc2d80d361ef1485d3e0697600e9f

                                            SHA512

                                            462a924c0689da10edf417dc9ff7176dab361251d18bd173adf175588c329684ae136ffbdde5a9da459562784c40443121cf5f73b52f86a1431fd4a23da0d563

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                            Filesize

                                            456B

                                            MD5

                                            d1348a33dd57b06f918cfffddd5fea6e

                                            SHA1

                                            898ac7adc63cf264573c0a8f9907db105f263a0b

                                            SHA256

                                            3b4a972dbe0116d28ee29789bb769514a9ec9a086f9ae0127e85d59cc7c0fb5b

                                            SHA512

                                            bf52435dfa52d39a8d96b0896ca009bfa31d4a37bf7d02cc6926395f9e9696b6730c9a786cc492c334fbab800e3f08d8cdcae50a2ed417b5a57968f285c59d07

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                            Filesize

                                            2KB

                                            MD5

                                            c9b7abb0f15ba64626537dc7a4018fe0

                                            SHA1

                                            2aed3f6a85895a74a5885e58f269a20d6b9e9b87

                                            SHA256

                                            f71c99861da727dcef411dc77ec93acabee77b02bca885c451c38bb1915edec8

                                            SHA512

                                            bd93555224a5ede76a2c8c8007b9cbcc5f43f6afcb5062759b1b835b5eee60da471c575f840e9efd0121045d4c8f61ef0c9d2bb7fcdc2690e6f4793ba3544b75

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                            Filesize

                                            5KB

                                            MD5

                                            63bf6f80233806ba2a8a2597706151a0

                                            SHA1

                                            b977a4ddfcc6897fcdfd1d100cbb3f21e5233627

                                            SHA256

                                            50a8388930c68ce719d0cdfe9143fa9ab1adeb59c2d8db97b4f1c199031029f2

                                            SHA512

                                            94b525a240d0d8f270a543d78de03572bf5c29db84ca65f672700929c1949dfc58c8c1985534315cbc0e0addd9305aad0a007e680f1986644375bf42d41cb0b8

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                            Filesize

                                            6KB

                                            MD5

                                            8ebc08c0080c662391af6c622bd789f6

                                            SHA1

                                            f75ea2900acfbc507e773b57203b0a6be147cc07

                                            SHA256

                                            90cc658f79ae447260dccc71ca15594fd91ea17143b21b9c6b164fb0001e2e9f

                                            SHA512

                                            0dfa0b17d3279d6365c873c544c4b5d7cd9774cb4cfb50d92e48da268103918f38b00edb5932a3e9b1738522c1743b3126fad1443b66fa3e452381b01c87f5ab

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                            Filesize

                                            5KB

                                            MD5

                                            2bbdc36e3c537c24500ad8ce4f5b4da3

                                            SHA1

                                            78918c054eb3df7031804c285a7d1c89000efb67

                                            SHA256

                                            c0cc189f554cd744cd98b9e01622ead799aad12867c8adba8da0fb2178296c62

                                            SHA512

                                            3b1f56599212183fb758ce7befd2483985ee276d6e87558e8c34c65e84bfd84d70b3e6fc5263f49a0a46d4817c34b21b40bd5f3e6a01920bebed772a73978fb3

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                            Filesize

                                            8KB

                                            MD5

                                            936eff5460aa0cf4b81f4ee7a350668c

                                            SHA1

                                            b99ed34eb00573ebea4a2134bdf1a46a2b7920ce

                                            SHA256

                                            1ff2cc467de8aaf6afcfcfb4f23f51aad6fdd49813eb5679425a6a752725161b

                                            SHA512

                                            141a254899d35168358deaa9e0a828b941441500fee854f981077ec1fcdd991f4ba94b5faaea7c930f3a159fcdc85cb4076dc442c8de83e3497f3fc387d068c2

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                            Filesize

                                            1KB

                                            MD5

                                            86a9152ab86edccaac344059e9426293

                                            SHA1

                                            dfe157c9a92ab4d32149118a29574c6e8e865146

                                            SHA256

                                            ad3de2ee52c4de0bdc36647a9b181e7fa5ef15c8d53352213e993676e8a40b90

                                            SHA512

                                            d9b235c877a5ed9f51b52eaeacb71c0937cd9b8e6b014e9773aa4558d50ce3c8bf3fb3356c1c7d8ab1d3e0fd532995a28d120e70d9b243d7eb056b930466cb13

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5912c3.TMP

                                            Filesize

                                            539B

                                            MD5

                                            f690c005c714e5c956710fb2b1534b40

                                            SHA1

                                            8719c87e207b222618c6f998208ef1a9d74fc36a

                                            SHA256

                                            e6dedb938f1ff5423e85b78c652b836338a5106be1624d5b80b2fabe44cf1312

                                            SHA512

                                            d5b0786f5b407beae94a77ea3ba938bfe1760664d60340e32b800af1c78c880ea4043b993be62aa193e6daee3ab6dd0617492ad104616c7756833cff918bdeca

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                            Filesize

                                            16B

                                            MD5

                                            6752a1d65b201c13b62ea44016eb221f

                                            SHA1

                                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                            SHA256

                                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                            SHA512

                                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                            Filesize

                                            11KB

                                            MD5

                                            a91434e6e0f899b8f33636a4bbf334e3

                                            SHA1

                                            be7bf118cb5c0a04ed47204e656d4318d9e1ce86

                                            SHA256

                                            99fe9731b4004b7f8dee74823ed974f9cdc1ca3cc6bf94b45b90d1da6da6dcf5

                                            SHA512

                                            ece3f874c11df5840420b2d461b1ef8ea4925ec151d089ab5c7029660a7bcacd5509a903c0c62c7c17ee5737c9b4ec32024f8439b874567883e660f3f2938b8a