Analysis

  • max time kernel
    145s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 08:04

General

  • Target

    910d2de747fc29756b32fcb9d9e8fee4_JaffaCakes118.html

  • Size

    64KB

  • MD5

    910d2de747fc29756b32fcb9d9e8fee4

  • SHA1

    c763f3b719a8a60c348c50170f6177445f57a019

  • SHA256

    3f7bb6de7771c71c2225d773edba147624bd1ac1a9d4b548fc8eba47fcc97d71

  • SHA512

    f709db8736ae543c12606da6322b0d2faa36154c8920796dd8bbbb6c7126d593166fea040abac7bccd30394051847bdc7d0556414c6b2d34faae0bb9f38e3d7d

  • SSDEEP

    1536:5PMrULkBQ9+iDFIpVKjEFtdH1yDkfWUaYoqGxoiwicXcVV/oeTm:9LkBQ9+iDFIpUVDkjGxo

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\910d2de747fc29756b32fcb9d9e8fee4_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:860
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa322e46f8,0x7ffa322e4708,0x7ffa322e4718
      2⤵
        PID:3516
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,13071087335995016113,3975348546543947374,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
        2⤵
          PID:2772
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,13071087335995016113,3975348546543947374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:8
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,13071087335995016113,3975348546543947374,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
          2⤵
            PID:1320
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13071087335995016113,3975348546543947374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
            2⤵
              PID:904
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13071087335995016113,3975348546543947374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
              2⤵
                PID:1200
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13071087335995016113,3975348546543947374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
                2⤵
                  PID:1016
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13071087335995016113,3975348546543947374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
                  2⤵
                    PID:4000
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13071087335995016113,3975348546543947374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
                    2⤵
                      PID:2136
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,13071087335995016113,3975348546543947374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4192 /prefetch:8
                      2⤵
                        PID:4876
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,13071087335995016113,3975348546543947374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4192 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4976
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13071087335995016113,3975348546543947374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
                        2⤵
                          PID:2408
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13071087335995016113,3975348546543947374,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
                          2⤵
                            PID:3000
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13071087335995016113,3975348546543947374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
                            2⤵
                              PID:1480
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13071087335995016113,3975348546543947374,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:1
                              2⤵
                                PID:4832
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,13071087335995016113,3975348546543947374,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5424 /prefetch:2
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4136
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:2924
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:5060

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  ae54e9db2e89f2c54da8cc0bfcbd26bd

                                  SHA1

                                  a88af6c673609ecbc51a1a60dfbc8577830d2b5d

                                  SHA256

                                  5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

                                  SHA512

                                  e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  f53207a5ca2ef5c7e976cbb3cb26d870

                                  SHA1

                                  49a8cc44f53da77bb3dfb36fc7676ed54675db43

                                  SHA256

                                  19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

                                  SHA512

                                  be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  72B

                                  MD5

                                  e02cdf232b2ceb5288accc66c35e4dd2

                                  SHA1

                                  4098646feb3c48190fc037996e2013a9fbe51582

                                  SHA256

                                  5b5308216a6b587f4a59e94a05d3dffddcb89a0c97887a81c316190014918565

                                  SHA512

                                  a1277aaea025bb199e5f35eb5f23e449d9e8ca9d4f157b2ff7980c572ba257dab1f9d556777eff5a763ebb28488a52f075c57a69802352f2d2f0504738dadc9b

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  1016B

                                  MD5

                                  d7f152129967ba3356fdf5f011352228

                                  SHA1

                                  8bb25e2b537695f571f836395833a12b909c53a0

                                  SHA256

                                  7b98f034073e5e04860959d775c8a459517867fbb7e0e633046eec70c3f92095

                                  SHA512

                                  d891b18d92fb077309e7e303b226efb260475c905e9c5469a3a51b3a15b26060d2a4cedfbcfd0e110d2880ca45b9008c6176473e7698a2f899216ce6368e8ee6

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  1KB

                                  MD5

                                  7dcbda5bfb2a89857764fe417c9aeb0c

                                  SHA1

                                  798296137d7ecdb72316c83f3cd65704f4e9e969

                                  SHA256

                                  f30345ef580b87fd31c8457a8bcefd7c045378932851a2bdfff6b81ffc08f635

                                  SHA512

                                  07b2689821a4f39f172767a566688cb3833506334f841a2196b83e606cbc8a813ab451ce8393bb917a03402d85879dddabcc65a172bdf3747e51f49961b961ee

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  5KB

                                  MD5

                                  587c3eef1d7fb8af4cabd9d9341bd191

                                  SHA1

                                  b8ca2223746611ce7197ada05c1758b8b815a2dc

                                  SHA256

                                  977f27b1a80d6fdc00ebb3fcc9aa80890eef2ae5c8aa176ed66933a3e4c52117

                                  SHA512

                                  a5f0825a423e34d872daf923c66138db597e3adcee64aa43293a1deb13b29be61a2b876b6963d50015d96914517b67fffa222677299fd2f22530eca537c40380

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  fd74c90b868aef3be4f519292e01e917

                                  SHA1

                                  fff0119b49fa7f881a284d236e8ae458b474cc4d

                                  SHA256

                                  33ab62fb3d7a6ed3d9f5bd9529c980086a3dcf072b387bab893f13180e9bd8d6

                                  SHA512

                                  4463021777ab3beb8fb2e4d9cd0d13cc4562b312c204feff2042790047d43274148cd4903f3028c9fe7e69db6b61879e7cf7d8798902641cd763320cd32b9c2b

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  f4125d529ab45e084a727aecc41155de

                                  SHA1

                                  2b6910bb56fdbfcfd47589d46040a48196955a25

                                  SHA256

                                  e27ea355f16d06f6287ebd1c383f6f792f2174d5caac3cc46ccbc1514f6b1bce

                                  SHA512

                                  1fa3348dbc099cafdf409259ed345a797f1b7e8699b08820ef6b8545b25254f99bf433305ee94780030837428c071727151c6008a4ca0dd8847bd41ee9e24be3

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  372B

                                  MD5

                                  a7e726560e479c86b7586d6460115070

                                  SHA1

                                  058a8d10931c327121a20f9b104b9dd89c34d0e7

                                  SHA256

                                  4d5979321e0de3275dd260a6414e6430c9b08d3be5ecdeee476894b02be769ed

                                  SHA512

                                  f1c4bb2b6356bfb56f845bf26319dd159d4dec94ca6f1e17e78b90e6278cdd4d59935af9d316c193bf2e5eb50e71bd90b17e615e49c0b635476dbe58a1f3f43b

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b536.TMP

                                  Filesize

                                  372B

                                  MD5

                                  cf1d8da2e473ca78c676dae390b4b66c

                                  SHA1

                                  484b205ea7b62ac41de1cfdf64262206cf979101

                                  SHA256

                                  0af7a14093df8cbc345a2a7a00ab55a88659195d4d0bcf68932161446084b87b

                                  SHA512

                                  ccd7d1e4d57ee31e15fd97922fab81b62a18c490cf35854fb9f358fcdf49737f5569ebccc3934b9813f6af7c3f7aa463d21e51a358b26efe618be688e6102f55

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  6752a1d65b201c13b62ea44016eb221f

                                  SHA1

                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                  SHA256

                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                  SHA512

                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  10KB

                                  MD5

                                  1a10276fac110dad2400902a232218bd

                                  SHA1

                                  49ab3a72deed7af14abaf44ad5d5727850949956

                                  SHA256

                                  0b83c9101cdbab4ef9108d55b3810eaa65fe805784307922c161a95a36a0f147

                                  SHA512

                                  b9ff4f81a5a18f148daf4c910ba07c829609961bb60737850d9a36e24b755231e01894fc058f0026982673435a6372bfede26c703a61ed62e1fde3fd09c1ee19