Analysis

  • max time kernel
    145s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/06/2024, 04:47

General

  • Target

    8ced791663c0d8235a92c2fbb0988957_JaffaCakes118.html

  • Size

    127KB

  • MD5

    8ced791663c0d8235a92c2fbb0988957

  • SHA1

    1115fd4e21afcea8ba840c0148bf0c19eade4b68

  • SHA256

    ecc5ee4f2a184eff9b2e5db5a42e72512efc4f4fb01342c8e68e7fc406afead5

  • SHA512

    8b6142973e14b4da715494211a7e705e84c76e1b775a9c765728d47beafd3b90700055acf048373fe0674297d27a9a775029cf34c2f2afa1ab4883c91e9c3853

  • SSDEEP

    1536:S1Qba3hydraYGmrmi8Q/Zd3gZ/6oFgPdt3Pdt3PdtE9j4EOzFzbk2xE66KFH5xKm:S5hydracrmi8Q/Zd3gZ/6oinnU+

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8ced791663c0d8235a92c2fbb0988957_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5080
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff091646f8,0x7fff09164708,0x7fff09164718
      2⤵
        PID:1812
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,7249875253891195691,6320457230524103705,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
        2⤵
          PID:940
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,7249875253891195691,6320457230524103705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1356
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,7249875253891195691,6320457230524103705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
          2⤵
            PID:4088
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7249875253891195691,6320457230524103705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
            2⤵
              PID:4876
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7249875253891195691,6320457230524103705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
              2⤵
                PID:2612
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7249875253891195691,6320457230524103705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
                2⤵
                  PID:228
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7249875253891195691,6320457230524103705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
                  2⤵
                    PID:2844
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7249875253891195691,6320457230524103705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
                    2⤵
                      PID:5004
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,7249875253891195691,6320457230524103705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4484 /prefetch:8
                      2⤵
                        PID:3964
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,7249875253891195691,6320457230524103705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4484 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1920
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7249875253891195691,6320457230524103705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4480 /prefetch:1
                        2⤵
                          PID:1900
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7249875253891195691,6320457230524103705,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
                          2⤵
                            PID:1040
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7249875253891195691,6320457230524103705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
                            2⤵
                              PID:4252
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,7249875253891195691,6320457230524103705,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
                              2⤵
                                PID:2956
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,7249875253891195691,6320457230524103705,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6088 /prefetch:2
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2224
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:2480
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:4092
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:5088

                                  Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                          Filesize

                                          152B

                                          MD5

                                          f61fa5143fe872d1d8f1e9f8dc6544f9

                                          SHA1

                                          df44bab94d7388fb38c63085ec4db80cfc5eb009

                                          SHA256

                                          284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

                                          SHA512

                                          971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

                                          Filesize

                                          23KB

                                          MD5

                                          e1c71f7c04be834f5587230db2ad24b3

                                          SHA1

                                          f3bab9cb99d9f343bf7ed3981aaa7450515d2424

                                          SHA256

                                          9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899

                                          SHA512

                                          205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                          Filesize

                                          192B

                                          MD5

                                          f4c9619cf01cc7866c13a6c5077c8431

                                          SHA1

                                          f39fc35f565adb949497a0f93e42fbc54221bd99

                                          SHA256

                                          1df6f10166a2c45e7656bae5336f8736ec942d8fb0403fa92b736089bb8d7e15

                                          SHA512

                                          4531fcbf6df874307e4e67590b6f03fd18b802fb9610fdfa1b26ad084f87a9bfa7043038b62a29cc6e966bae471336b2798a2d3c9fc3afff05c8525df8822887

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                          Filesize

                                          216B

                                          MD5

                                          aceea425c8f337095dc7e633d0e9b0cc

                                          SHA1

                                          e7e2f7c673f20f4b604b76c7c5f0b44d9bc5e4a4

                                          SHA256

                                          abeac8aec1e34ac15da40faba2c1b173ff766198dde3eed0ea40abc3185d1188

                                          SHA512

                                          4ba49be256afb09e31ae3d13948316717a4c1eda16b00268d4e54e844adc9bad7c9ebfda57b5c52030154c1b5dc1b5fce39ada044593edaf3070fcf37764288d

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                          Filesize

                                          2KB

                                          MD5

                                          ca0d194c9dd00d6825c3c0eaffaa329a

                                          SHA1

                                          fbbea3f77760e32e1ee7edb4d8cf3f989654a9b1

                                          SHA256

                                          3a09149bf08b63cf3e28e647d663310e08cc9399139852badd5daa153d84c21a

                                          SHA512

                                          614abbad05f3b56c796291499ef22d39e60a4016f62a8b3e5c646d03d3f6711bdc6c5ac10167ffad3e2dabc099b6bbff5dd4c1954d909c8bbfd7ab43ea9063fc

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                          Filesize

                                          2KB

                                          MD5

                                          0a7fcfa2cba490c3abfb2aaf0566c811

                                          SHA1

                                          72a99f6ea42be2ff74cd778a86d91c6401f38173

                                          SHA256

                                          ae15a70310448c45e57f53aeec494d3ca07b0820cd2e66734005eefffecca6ab

                                          SHA512

                                          5658050ed5fc8a7f57d49e2e9926ff5eb2d35d2ab326024cd183510dc42ade0ac47cfa8da9576a083769bb07306015fb764ae2f7d77259f82a2be04687c597de

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          5KB

                                          MD5

                                          fcc515e9d18074a780940d464002d909

                                          SHA1

                                          08e6cc82b715b5fe6edcf1f94fce1b3baf91f676

                                          SHA256

                                          60c817ad468287b4d23404e723871bd21554d64539ab3a54e330e236c6135a81

                                          SHA512

                                          fe7df63c9863c1c79597970b6a092f2ab381475bf2519ebcb9709c8d2d3fb975822eefc4b7899fd7910c5f4a9589d4a3c1c130287f8105c291ea0b1bf626b0ee

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          7KB

                                          MD5

                                          0c190954830cfc305a7ab828f00e18d1

                                          SHA1

                                          8a3b89fcdfb350e4eb29b23c326555b8571953d3

                                          SHA256

                                          66abc196eee02ebaf431cb7fdde27beb96b117e92e0034c568ff6a010cfd87c4

                                          SHA512

                                          11b0c5582559b8976f614bdbfae96fdda5b7143f9bd761af1a68633cb617ca669c3680954efd7bbe8b1a0f93c656b716e30cd0a90788d9ac91988f6537c20071

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          7KB

                                          MD5

                                          14be739a4ac52f64eb42c90bb0df1558

                                          SHA1

                                          b34a4896eadfa806212d956190f3fa9df901815d

                                          SHA256

                                          bc9dd3fb807f07b6da1f5c9fb898dacfff0ff0bc9484e08251cf229f9acde8ba

                                          SHA512

                                          ef6dd65063c5b16e1495a1e15dbdae25d971239d51116674affefe89eb280627a77b03c74624ef09331efd1e131756292277739e94566eed9c95a201e12dbf77

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          7KB

                                          MD5

                                          7095c5f06806087bfcef4681c5acc1a3

                                          SHA1

                                          168bb5a7cc57bdb4d6b97945be2de2f5df6b8d6f

                                          SHA256

                                          086367fad69bada0ada424df5000c4eac50b75c96f169dd4874de714eec1981c

                                          SHA512

                                          d0143a9135cab4f58bd99f73e868be6946c0aa2aac5c3ff7b3e2f7429510b58bb8bd767c4d1c19db0ea89d4fe93393ee93d42bc383e0990b4a900bbbe802a849

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                          Filesize

                                          16B

                                          MD5

                                          46295cac801e5d4857d09837238a6394

                                          SHA1

                                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                          SHA256

                                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                          SHA512

                                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                          Filesize

                                          16B

                                          MD5

                                          206702161f94c5cd39fadd03f4014d98

                                          SHA1

                                          bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                          SHA256

                                          1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                          SHA512

                                          0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                          Filesize

                                          11KB

                                          MD5

                                          27a6cf804ba7d93c6edba2044bfa7c8a

                                          SHA1

                                          f29dae9715b21fba1ba541a58237556995dd62a9

                                          SHA256

                                          05573838b9df4ffa14c17ce985747ba88cc0470e51e4684b5057add3b90b29f6

                                          SHA512

                                          2a95f97193a7f7bf91442c81f2b31af282d8736529579ec0e83c69d14815cb208a4ac9bc0fa89aacca12e563303d692ced01a3c1eab929e1d11d762e03bc56fa