Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-08-2024 12:47

General

  • Target

    c307479c08857ba00268cfd629df3d54_JaffaCakes118.html

  • Size

    282KB

  • MD5

    c307479c08857ba00268cfd629df3d54

  • SHA1

    bcd3db0b7c2ea7bb8f0203ade292aee7b44fe1a8

  • SHA256

    bb3d68e1ba2be38a63d37653b722bae6699ec370fd89e99e2c741b32e1eff41b

  • SHA512

    cc61ce2c25eaf98545f16c385bfd15c9ce809829da26e8301c5ff21c91e19b680975e8ee4bed15cb5e655420e919bbee5b01fb2377e7f9e980fa2e6ec935d97e

  • SSDEEP

    6144:q3UmZbXbSbsoIcMg+mAdgTDCsVGCiTD/1yEMgEhb5lKFK:gUgbXbSbso1Mg+mAdgTDFVGTG1lUK

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c307479c08857ba00268cfd629df3d54_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2448
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ff9023646f8,0x7ff902364708,0x7ff902364718
      2⤵
        PID:2288
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,9716655243642859602,10710339835839924580,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
        2⤵
          PID:3576
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,9716655243642859602,10710339835839924580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3012
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,9716655243642859602,10710339835839924580,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
          2⤵
            PID:1728
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,9716655243642859602,10710339835839924580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
            2⤵
              PID:1996
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,9716655243642859602,10710339835839924580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
              2⤵
                PID:1948
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,9716655243642859602,10710339835839924580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
                2⤵
                  PID:4428
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,9716655243642859602,10710339835839924580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
                  2⤵
                    PID:4360
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,9716655243642859602,10710339835839924580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
                    2⤵
                      PID:760
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,9716655243642859602,10710339835839924580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3044 /prefetch:1
                      2⤵
                        PID:2516
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,9716655243642859602,10710339835839924580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
                        2⤵
                          PID:3816
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,9716655243642859602,10710339835839924580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 /prefetch:8
                          2⤵
                            PID:3664
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1992,9716655243642859602,10710339835839924580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1600
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,9716655243642859602,10710339835839924580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
                            2⤵
                              PID:2240
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,9716655243642859602,10710339835839924580,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
                              2⤵
                                PID:4380
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,9716655243642859602,10710339835839924580,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
                                2⤵
                                  PID:4472
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,9716655243642859602,10710339835839924580,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
                                  2⤵
                                    PID:3900
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,9716655243642859602,10710339835839924580,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5964 /prefetch:2
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:1884
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:3036
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:524
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:520

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                        Filesize

                                        152B

                                        MD5

                                        f9664c896e19205022c094d725f820b6

                                        SHA1

                                        f8f1baf648df755ba64b412d512446baf88c0184

                                        SHA256

                                        7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

                                        SHA512

                                        3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                        Filesize

                                        152B

                                        MD5

                                        847d47008dbea51cb1732d54861ba9c9

                                        SHA1

                                        f2099242027dccb88d6f05760b57f7c89d926c0d

                                        SHA256

                                        10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

                                        SHA512

                                        bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\36e94b1a-b8e6-4dfe-840f-5b994ed8dd0c.tmp

                                        Filesize

                                        1KB

                                        MD5

                                        bd2c7738f7f21a92c08ae47683bca287

                                        SHA1

                                        7f0cebf6dada6d3cf31fdbd2811c9b6157c6b64d

                                        SHA256

                                        b3c2122f110b65efc852afac8aabc8b08bcccef2092e32f7d9a6a20f63afbb6d

                                        SHA512

                                        d0c5bed08a4ea733189d585c328ccc051b888ba6e8bcb308983d477d9c3e2809d02acd6175016d6840e3eb6db5320f875bd58b5b03d70d68a2c8b624ae3b4ac8

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                        Filesize

                                        216B

                                        MD5

                                        f4ca26b38efda087b17c7960f593c56a

                                        SHA1

                                        c7bcc1c09afadcd098f14d48324a5e9896b382da

                                        SHA256

                                        27002dc37c746b854438ee5b19d0e46c55f67f0f9a4fecf79d168f621f5752aa

                                        SHA512

                                        442b8a6e25db248ba6c6806dceb893f51931882e15cef0ff9b0df58ce1cce7deebc450ba49eb0d56ec1cbd5a6286fefe55141eb4836c222bcafce0fecd4e228d

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                        Filesize

                                        3KB

                                        MD5

                                        615c0eb0c24ba6d3b1c0c301292375bb

                                        SHA1

                                        a13cc9e56987bcfcc37f576f467176d669587e1f

                                        SHA256

                                        d6fca91e6905804d30b48a1ed719f251324160ad7d069be4ab4522b5e1e5a8a3

                                        SHA512

                                        3ef41bb9140ebdeced464a74ba47f99abe6d234944b53d657ee6d63a136f7ce1830be395e871b76fe651bb36ad99d0a98738673a431032c22dc5c700bea201eb

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                        Filesize

                                        4KB

                                        MD5

                                        1cdfe1d938da24967964ad36360fdd17

                                        SHA1

                                        2cee9491bb89e0acbdca0d57156d0905ae67ff02

                                        SHA256

                                        1b540f6e512a5b02ce136a31c784a16003efc0f73005d4c513f7c59e17b5babe

                                        SHA512

                                        44e39c782456b69d1ff425919c633adb3365683dbbb57699e021f5a1ea700ffd861e499863d282e8a872bcb39c80930f56cace9a16312c3be88c8a3dac11ed8c

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        6KB

                                        MD5

                                        f56ab1449be5531522145dd7a5dacbc3

                                        SHA1

                                        99b64f0bb274d99844c7ed8c2c8c7a5d6d7ef604

                                        SHA256

                                        e044d1e1f7cdadc69e8a98389e4379949e6548cc0862fab44559c445659b5254

                                        SHA512

                                        770612749844adf50049a1c56f23d0ca95fe0aa5d432303c95f32ea80be846a4e35444f147a4ad5ce7c44a77a052e22ebfa4b573baa7780b432d5052e4e0cce1

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        5KB

                                        MD5

                                        a958aacd72daa7f4717c168be4fed764

                                        SHA1

                                        caae8f6e52bc3fbce9de22e2557d728c6a9eb5ee

                                        SHA256

                                        385ed09bc87ab41eb2f0e6d9060899176b7fe1e47ba757bd83ac915a40c7b9ad

                                        SHA512

                                        72bdc791ee044633dc8cce90d592e46737867121a625cd42ba19501dd44356294d1af4b4b42cf99972c2853c06f5573359ac5efed789376bc4b0ff71f9fedb9c

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        8KB

                                        MD5

                                        5fe8eead46688fac62d21f7918eddcbf

                                        SHA1

                                        df6f057389ac224d2a11478e80b36d0e143e749f

                                        SHA256

                                        cceda94d1d7a8c55a86749c7b784bdc8f1aa59d057821b700367cd820fab413b

                                        SHA512

                                        26105e3b16f860940d6ceaddafdd12009e4faceaf850c4ca419ecf9293b09161a59a39142cdf7e34e4613a3ff3ac190a8b697beaef801922520e857664dd205e

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        875B

                                        MD5

                                        748c373424d0defca8b925fac4560303

                                        SHA1

                                        5c4c4e685cc731db927d15b9b6f0d5edfebe03f6

                                        SHA256

                                        f4358083eb176fb3a257b06ada6b3b0fc01cf5edd45627ecc97d87974487b38b

                                        SHA512

                                        60aea10568900383629abf9b29bc91ae0477fee74235152a6c6d9f99d79b05a0e4322b5509c086c7ab39ac630cfeec749781d24d0a5d9950c79b8ad368afa3cc

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                        Filesize

                                        1KB

                                        MD5

                                        2aa3d4ee981c17938c487d80c83ae6f4

                                        SHA1

                                        e111f27089329d27d023aa0e5bcd085c2735442f

                                        SHA256

                                        48d419950f2f29f9a94067ce59a71e85b74b16e38968c38b8d32af0e99c62d2f

                                        SHA512

                                        d69808164c02e031fb30410c0a4e17d0e351f1825605ac971f6840e2a6ed583ef254914b4271ed19d9fa5bdd8a7c841e85b79da6dc2096a9724b4d8547afe20a

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fef1.TMP

                                        Filesize

                                        372B

                                        MD5

                                        b82b9cd2d50f6681683a8c5c724ab9c9

                                        SHA1

                                        8f36e5b792d9cff376c507763a18c4eadffcbd9b

                                        SHA256

                                        4738c16624d5d7274a8c713172c91b593dbbfa77ec13bdba059155f17b0a9f87

                                        SHA512

                                        7cbd1432cd3fe806c36cd5535a25c83ba2e4ee657789ed25f99d1c7d134ecfec18b52435952f5db2fb47729dc9eff0b8a5e7a81fd62ca8c2b0a37ed51c871e0f

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                        Filesize

                                        16B

                                        MD5

                                        6752a1d65b201c13b62ea44016eb221f

                                        SHA1

                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                        SHA256

                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                        SHA512

                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                        Filesize

                                        10KB

                                        MD5

                                        8ab4cfc6e88ddf038f432327c2f12eb0

                                        SHA1

                                        60e02ab51c0ffe75f9d4751a332441c1e1599d33

                                        SHA256

                                        c61f3aecf9006f9cc307facd359b2223adbfc23d13ad7196c47bd4494a56d076

                                        SHA512

                                        18900870303c9d581a0f89782d409f7dee64428d52b35d2182d33d97aea9b5e8bfab24d71927a14bb88b19b7411146a82d72bf6b21df77514afb969278240a20

                                      • \??\pipe\LOCAL\crashpad_2448_RICVCLZJQIEAYXKE

                                        MD5

                                        d41d8cd98f00b204e9800998ecf8427e

                                        SHA1

                                        da39a3ee5e6b4b0d3255bfef95601890afd80709

                                        SHA256

                                        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                        SHA512

                                        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e