Analysis

  • max time kernel
    31s
  • max time network
    39s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-08-2024 22:40

Errors

Reason
Machine shutdown

General

  • Target

    c1bcb09a17d4700f5b6763ab2953a4ce_JaffaCakes118.html

  • Size

    59KB

  • MD5

    c1bcb09a17d4700f5b6763ab2953a4ce

  • SHA1

    76b290f4c7bfe10bc49a3e9cd16dc7265febedbe

  • SHA256

    483dfb7e275ee569ca2f76af7c9e2a6eaab9dd99a556238be8d025c278d3bafe

  • SHA512

    d38567535a68a6a0912b717991ccc4d064868709e4caec63cc8e99d27f60becd60d87ddb599a19ee0c93e01a16aa449093e3026c62f321c1241eeea551e8a1f6

  • SSDEEP

    1536:OV8I1RVg298pIMmaPkvyou5iFBD3yQdtV:OV9nVg2GB6FBD3yu

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c1bcb09a17d4700f5b6763ab2953a4ce_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2064
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffacade46f8,0x7ffacade4708,0x7ffacade4718
      2⤵
        PID:5072
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,7195676445692033665,7904069809298591300,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
        2⤵
          PID:2452
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,7195676445692033665,7904069809298591300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2492
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,7195676445692033665,7904069809298591300,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
          2⤵
            PID:1060
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7195676445692033665,7904069809298591300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
            2⤵
              PID:4148
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7195676445692033665,7904069809298591300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
              2⤵
                PID:4332
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7195676445692033665,7904069809298591300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
                2⤵
                  PID:1992
              • C:\Windows\System32\CompPkgSrv.exe
                C:\Windows\System32\CompPkgSrv.exe -Embedding
                1⤵
                  PID:848
                • C:\Windows\System32\CompPkgSrv.exe
                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                  1⤵
                    PID:3856

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                    Filesize

                    152B

                    MD5

                    ff63763eedb406987ced076e36ec9acf

                    SHA1

                    16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

                    SHA256

                    8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

                    SHA512

                    ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                    Filesize

                    152B

                    MD5

                    2783c40400a8912a79cfd383da731086

                    SHA1

                    001a131fe399c30973089e18358818090ca81789

                    SHA256

                    331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

                    SHA512

                    b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                    Filesize

                    96B

                    MD5

                    95c7549d2d32ebcaf44f8e20bf8a4546

                    SHA1

                    a1906481bcca1404c04594fc03ef539a70b3c46a

                    SHA256

                    d4d1764411c300f3f38577021d2165d5849113992eff485a0476fd65ae94d072

                    SHA512

                    c42751b77add70722438af54c283b1e53f86d82deea89bcff779616252bf12fd249cd884a2c2fcfdb11c8f8d0f888891cf63adf794a529e4ee63371669994b79

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                    Filesize

                    5KB

                    MD5

                    31163faf814a71a8a1b358793b716ff2

                    SHA1

                    20276f2fcd9396722f3cf60e0787d5d9437c21bb

                    SHA256

                    ea434fef461b0cbc793a8a8a9f48956a6c6667d1041bc39bf3730b8d0a5a554b

                    SHA512

                    00a94fce54c92d984c968723a05bacdb25e81b8a6a97e532f1aa2250aee79f91f8d09dd5aecf99bcf815ccbdb15dc782e5e605e4f37cac9f4edb6a6e267b9879

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                    Filesize

                    6KB

                    MD5

                    b60e96761ec7dbfd90b9ec2bfe962ee4

                    SHA1

                    60a98771cec2901f05fb9fa6e0a2653387238f4e

                    SHA256

                    6911de214e8b3ac55eb37507c4f513385674d37dbfa675418d787013e3ddb4e9

                    SHA512

                    e41812097fb39c8e2936eb5371d2cd480c13380bf6bf5378f2e38cb8ca25dd2aa332b85d086773b3c649b506295ba299ad8d328e64b4e60787798e685a674957

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                    Filesize

                    10KB

                    MD5

                    ccd7bcd7bf270cbe9d5d5a12fd11a4d0

                    SHA1

                    412ef20d8664987b8a3c02a7448bf1efc2451fbd

                    SHA256

                    fd1181853d519d6218f92ddd9407a3722bb89d63ad7dbdedefdf15e7262cae9a

                    SHA512

                    2c378c83d52c0e18b0589670556f529749034f7ae9dda3adf17315da65af405521c0cc4b9aa728160bf5e2fb8dfa32c1ad00ba6381e5923a106bb0aebd5069ad

                  • \??\pipe\LOCAL\crashpad_2064_APTKZZCOMBAQCVOH

                    MD5

                    d41d8cd98f00b204e9800998ecf8427e

                    SHA1

                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                    SHA256

                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                    SHA512

                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e