4b6baae8728bb224cdc9a94ab9438fe5c0b9819bf200eeba22d9225914a9d186

Analysis

max time kernel
0s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97c1f4710846d984b3651747a902ad0b_JaffaCakes118.html
Size

3KB
MD5

97c1f4710846d984b3651747a902ad0b
SHA1

f5463e616c5f2c002fb2abd9dd55ae15eac9c666
SHA256

4b6baae8728bb224cdc9a94ab9438fe5c0b9819bf200eeba22d9225914a9d186
SHA512

37e82d383a6647d5a3d82e25fe7728879464dcead752912674f99865528d245c6e1666268b97954a1e6ee4dab9966bb27829983e264d6e2f32d198d8ac543b9c

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 5092	3008	msedge.exe	81
PID 3008 wrote to memory of 5092	3008	msedge.exe	81
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 1292	3008	msedge.exe	84
PID 3008 wrote to memory of 4240	3008	msedge.exe	85
PID 3008 wrote to memory of 4240	3008	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\97c1f4710846d984b3651747a902ad0b_JaffaCakes118.html
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe875746f8,0x7ffe87574708,0x7ffe87574718
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,5751774826071536870,3389389528483192663,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,5751774826071536870,3389389528483192663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,5751774826071536870,3389389528483192663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5751774826071536870,3389389528483192663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5751774826071536870,3389389528483192663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,5751774826071536870,3389389528483192663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,5751774826071536870,3389389528483192663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5751774826071536870,3389389528483192663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2340 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5751774826071536870,3389389528483192663,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5751774826071536870,3389389528483192663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5751774826071536870,3389389528483192663,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,5751774826071536870,3389389528483192663,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3352 /prefetch:2
  2⤵
  PID:1828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
276B

MD5
63e94862b42530f86676ad4d8dad984d

SHA1
3fd2230f79711e641c7d8bc1fc8f6d671319aec8

SHA256
02bd271fbf1d8f8cfeb229ec24d7bfb1c261116853c2e66a3f5d0b3536f59a25

SHA512
8f57ba1d96f3a97a7867f7eb43efd22baea3a78766fd88e87affcbc1e2e1699de833cbe9d78d22fa784ebf9602bd2006ee315ea13aebbcb79b56ec137c7a5aff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
260ada881bf36b08b28c4ec4111d5b59

SHA1
7a4d586bde767c8df05cd533582256ecd8a581ae

SHA256
a658bae434e7d5d1a4554973c0a809ba9698cee896c2a59d29e0543aa2cac7c3

SHA512
de1e1a4754a5df869b285b3759235e0e7dd41ca0924044d2ef33ceb847cba4479fdfa0b3ff7a5c6ee5fcc686f9fe6960e3c045b2a50e881d8cc481349fb85929

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
90f048c6113cbe85e0d3c35b9db0fc38

SHA1
e06d507d17ba08d7167ac64b69d996ba4283f2f5

SHA256
fdd63468ff1f885113dca0c0af90aec743df3eb02403af95e8891fd9f2ecdd5f

SHA512
e07b205b9e98e1cf21cf9c5b3f5516b9d4cb858d0e05d0da27bc759b47c766340e2914687ce4f4aa749cfe31a5fd5dba876622793e272e2ddf9eddf664b9b4f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1f147c1c683da2a84da620b9bdbf371c

SHA1
7321ee6963946c9a2feb9a866cbe7c3ee142e554

SHA256
61c3034f1d2ab331c3a445bb86e9fedc3958e44239f56682353ac1def3a523d6

SHA512
807f44155fe247d7c0582cbd6999b90bc09eb67a17c342f5cb4b5e377453d56510d0d10b8f0d2a4476066ffcbfb75489109471becb190539be91b9854bc3a7fa

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads