90a1df83950715f364556a71ece080ae0a457614520e2b3e33bc35dad0dc9417

Analysis

max time kernel
0s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

991ada56a7f427e47f83ebea7ff06fa0_JaffaCakes118.html
Size

3KB
MD5

991ada56a7f427e47f83ebea7ff06fa0
SHA1

074b8624a5bf7c92f3c334fe533bd1cc05f42b7b
SHA256

90a1df83950715f364556a71ece080ae0a457614520e2b3e33bc35dad0dc9417
SHA512

414b4c45423280254b1882515b1fc4323ca9080ce808c3b51145ab56a8ed3a65de26236028f0e0f4a274c1fc610aade661b4819e2c8db0afd1728951318f6b03

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 4344	640	msedge.exe	81
PID 640 wrote to memory of 4344	640	msedge.exe	81
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 4916	640	msedge.exe	84
PID 640 wrote to memory of 1920	640	msedge.exe	85
PID 640 wrote to memory of 1920	640	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\991ada56a7f427e47f83ebea7ff06fa0_JaffaCakes118.html
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3fa246f8,0x7ffd3fa24708,0x7ffd3fa24718
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,5612138687092488978,18120077832543368696,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,5612138687092488978,18120077832543368696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,5612138687092488978,18120077832543368696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5612138687092488978,18120077832543368696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5612138687092488978,18120077832543368696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,5612138687092488978,18120077832543368696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,5612138687092488978,18120077832543368696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5612138687092488978,18120077832543368696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5612138687092488978,18120077832543368696,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5612138687092488978,18120077832543368696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,5612138687092488978,18120077832543368696,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3976 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,5612138687092488978,18120077832543368696,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2
  2⤵
  PID:4412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
32ba3623f5df0d0187bf41956b702417

SHA1
8828494e3d2fa906fc6b02fb12f960d0b4f1d5c6

SHA256
c7946e0c0d6625ab635e666adfdb99238cee282099b8afe03dddea950b2a8faa

SHA512
a1ab62c552b33eef48e68ec2eb6fb3df58f9d334123ea1db2a49f1b3b96fb0e4b3ce84a0f58ef1b28dd878a986276c202c13a43221f9460c048280c8ccc0806e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4c833033cfacb6d158635d15d714c9e8

SHA1
bf6b0984f17b9d9d0675d36f63ddd908c51826b3

SHA256
7bed64e6dfb62422e69d5e269e332b9273086e3689c831b0eff6788c326d2e7c

SHA512
36ffb66873fbcb227330d124450575ed13657d3886d05a406c48b035b4a7f6a1e7989d3d6ddf82e2a38330da2b7f363fdf929df48b11c3f92e62a5f0d8fb27ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fabf872b4b9799ca76a00a99c8bc252e

SHA1
67d00b8a6d4af3501898b371ae3b8b30f36d0cc8

SHA256
16eb987e298f867913e33934525ced8c2c90520b91239c455e9f9201d9552151

SHA512
c47a8f3a62bdd71618646b01d1768b4665ffe7fa5055980a69ba0bbe4604169bb69beef38d4c55946527e0512c0de3c595d3ec11bd740f3adc36575dcf8f0193

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads