Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2024, 15:53

General

  • Target

    878b9c2d9f8cc5c02fa01847fc720d09_JaffaCakes118.html

  • Size

    123KB

  • MD5

    878b9c2d9f8cc5c02fa01847fc720d09

  • SHA1

    ed259361ce3e20bf13d6efab164bb045f53367f4

  • SHA256

    8826f48608025a3f45429e502a5646b37e5393b296ab19e198163ed579e8e8d6

  • SHA512

    7aaba24b4f3e9cee8712d3a9fd968cecee7ac3dc0a43824c8ac7ed0b638e4e2ee6c3c350ba4d036d6462fc666d8dad3638e3f0f5d7ea94d4f369f6425d61d01e

  • SSDEEP

    1536:SZ12CaBHCzasaayLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:SbasaayfkMY+BES09JXAnyrZalI+YQ

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\878b9c2d9f8cc5c02fa01847fc720d09_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2948
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec5a346f8,0x7ffec5a34708,0x7ffec5a34718
      2⤵
        PID:3304
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,5446927205591746530,17275644605556868555,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
        2⤵
          PID:5112
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,5446927205591746530,17275644605556868555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3644
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,5446927205591746530,17275644605556868555,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
          2⤵
            PID:4272
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5446927205591746530,17275644605556868555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
            2⤵
              PID:1904
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5446927205591746530,17275644605556868555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
              2⤵
                PID:4256
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,5446927205591746530,17275644605556868555,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 /prefetch:2
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:3400
            • C:\Windows\System32\CompPkgSrv.exe
              C:\Windows\System32\CompPkgSrv.exe -Embedding
              1⤵
                PID:2228
              • C:\Windows\System32\CompPkgSrv.exe
                C:\Windows\System32\CompPkgSrv.exe -Embedding
                1⤵
                  PID:3132

                Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                        Filesize

                        152B

                        MD5

                        1ac52e2503cc26baee4322f02f5b8d9c

                        SHA1

                        38e0cee911f5f2a24888a64780ffdf6fa72207c8

                        SHA256

                        f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

                        SHA512

                        7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                        Filesize

                        152B

                        MD5

                        b2a1398f937474c51a48b347387ee36a

                        SHA1

                        922a8567f09e68a04233e84e5919043034635949

                        SHA256

                        2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

                        SHA512

                        4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        9da2ddaee7391b1f8b9cecbdb1488362

                        SHA1

                        da8c28f1541385a8ac79ac41a4195085b2f5e3b9

                        SHA256

                        c5e44d12cef8da8a42759acfcc6957f7acdaf273c22c21de0f838d96e594d4df

                        SHA512

                        18b8a6bf7760a73b96a6e5ca1e9c3f07786e52d93ee8b510cda619b34b224410df464b7cbab1c1311ff6465415650189fdacf0aaf8eed3c5e10338178e217f65

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                        Filesize

                        5KB

                        MD5

                        3adc76b4a27247e0964d0a63b1f2bea5

                        SHA1

                        8498a997d0bce789b32d29e325c58ffdbdb63371

                        SHA256

                        0d274721abbb1c710102475f7ac911d139d892bb0de511a01e9590f06a1df1b2

                        SHA512

                        3e078952ecb2669e618cb19290c5143f14ff8d4c50aa5f5c39f9bfcd4d5c74dd359f550162b31618b244e1b4e9909d86a53dd6f2e513b2dcf3f918d024d28162

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        25d88e7c98ca6827d9e4b76c985aa35a

                        SHA1

                        1f96014d98414d595ff4e3f6b9f874e0bfab69a1

                        SHA256

                        e98abbae7eb64103db02b921e8f1d0643474e588a0dec53e32e3f024b623518a

                        SHA512

                        f981cbb3ba81431f681bdcb9426d9d9ea3734e0d682f600a4c0681d1445fd4d0fc5d04870ae767a61be75698716f063a8bd81003f25b304b753384c2e2785dea

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                        Filesize

                        10KB

                        MD5

                        f1596c42d237bbad3c6cee2af1d3af03

                        SHA1

                        85398da907f7cbcfd132ad40b720ffd6d6a1b045

                        SHA256

                        c6fd2d0ba6ee8996b658d520ae065e4d0a9ed5ceac3424b8cdb63cedb7077200

                        SHA512

                        bcddc6228dda52e5e376ea307fb87f2cc24641fba9a3784b59072a6fef3f38545d35667c40270d7dc68fcc0132d48e022f438cc156aa56684e82f7b74cd3924a