77e191c433d5366f0babfaac918483ba7bf4c1e870492b598f2a821ad5944734

Analysis

max time kernel
0s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 01:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9355e394460dccff0f1470846aa4ce57_JaffaCakes118.html
Size

132KB
MD5

9355e394460dccff0f1470846aa4ce57
SHA1

8cba4ff41087004922a0987ef9b3fbad45b6819a
SHA256

77e191c433d5366f0babfaac918483ba7bf4c1e870492b598f2a821ad5944734
SHA512

3916f4eeef531f13f46edd35fb5c5846afe7c698b479bb8f1311ff49967f310ea2e102f127a5f4643d67f099903fb0041b070df119f22684943302a9e0fffd01
SSDEEP

3072:mvOfjDQ/V+nK/+LLg4llvLXSFmyBvbX5NS9m7z:mG0/xUlv4bX7S9m7z

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2624	1792	msedge.exe	84
PID 1792 wrote to memory of 2624	1792	msedge.exe	84
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 2640	1792	msedge.exe	87
PID 1792 wrote to memory of 3692	1792	msedge.exe	88
PID 1792 wrote to memory of 3692	1792	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9355e394460dccff0f1470846aa4ce57_JaffaCakes118.html
1⤵
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaef7f46f8,0x7ffaef7f4708,0x7ffaef7f4718
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,5378548532495113139,642714498756266237,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,5378548532495113139,642714498756266237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,5378548532495113139,642714498756266237,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5378548532495113139,642714498756266237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5378548532495113139,642714498756266237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5378548532495113139,642714498756266237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5378548532495113139,642714498756266237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2124,5378548532495113139,642714498756266237,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,5378548532495113139,642714498756266237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,5378548532495113139,642714498756266237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5378548532495113139,642714498756266237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5378548532495113139,642714498756266237,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5378548532495113139,642714498756266237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5378548532495113139,642714498756266237,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,5378548532495113139,642714498756266237,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5892 /prefetch:2
  2⤵
  PID:1540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3688

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x300 0x38c
1⤵
PID:1592

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
538B

MD5
ccc50398b8a732da0d4640485804dd4b

SHA1
39f7960181b22cfe778a702b1aa0f6493b2f95ea

SHA256
6b324cf2912018e3c0ec53e80b63f00473e62bf30a9816faf1b77481b3e12688

SHA512
a4ccaf6927aa8a42de40266065dd1cc02ad74053fb26676db474fd1b616f3bbc2029fbf6ce46ddcc0d29a83d338349e5e7910873cba983ce2690f573cebda013

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b6ac1c88097af877cedcc569fddc1211

SHA1
788f55b8ad9a1c62eb8b3f10463efb31c5e1cc7c

SHA256
d44ade7a3c8172e1717805f65d9fa7b8683f53c2ecf8c0cd49dd059736e63c01

SHA512
d8cf4fc0448d303aeb34874b5488ae94a41a63ffcb685f503965b8e7e70c9af93a81ac981fd541abeaa8454a0b285c653defb8e6b0621f93a0fc1755c7b83cac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
260e141c8a61a605faac31a18205a493

SHA1
7ae94979579e10ed1dd14f14b8ee0e56be4b963c

SHA256
59c062ed8184b730177ffeaab66fe5a636c74069a8d394ca0438778eb412ea38

SHA512
4bd6601fab2554d1ce7dd3c7b7f74b1ed9aaa257c2eed5ee1aaa01cc7dce66bbcebcb7afe1212465e41058bbee29e2865f4e7daf9214a5eef96aa043b69d155b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1c311321ae765e61040c8a7a07bf80a1

SHA1
1d9bdef59503a720d377d5e06d1163e78a5d5b09

SHA256
3267451a5afd89b96d830c3187da3f79a72334846fe751f99993c2dbe1e71c6a

SHA512
fb780641d37c9cd9f7185f188303e3922693e3b028bc3e72389b2edf0d45982336b6d3daa01a24e05863be078da19eb27f53578f90673eeaeb432e5b46bfefc5

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads