Analysis

  • max time kernel
    146s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-08-2024 16:47

General

  • Target

    c36ba95556dbf734fc3599d316a52737_JaffaCakes118.html

  • Size

    77KB

  • MD5

    c36ba95556dbf734fc3599d316a52737

  • SHA1

    36f5d46fe36197f193e66f37a8c8321a24edeee1

  • SHA256

    946769ca74f2ef38bdd495a0a88d18a325cc91ab39979c00b8bd29f16b684f26

  • SHA512

    fc45126e187c5898b8a0f1712f4057d5e0008fa09954c863a27dbd277927178ac5886977fcfd8472abd1b184a2e8a4756d8c464be633ee850d7ae6cf24ebb626

  • SSDEEP

    1536:sD2TO+q9oOpCORSwYnvvoygy2ODB2fnaCWdK//Fs+B4YBabffy1klh:sD2anpCORSwYZgy242yCWdK/ds+RBcwg

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c36ba95556dbf734fc3599d316a52737_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1372
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c78546f8,0x7ff9c7854708,0x7ff9c7854718
      2⤵
        PID:880
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
        2⤵
          PID:4996
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3660
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
          2⤵
            PID:3512
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
            2⤵
              PID:2912
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
              2⤵
                PID:5092
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
                2⤵
                  PID:2216
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
                  2⤵
                    PID:4424
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
                    2⤵
                      PID:2140
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
                      2⤵
                        PID:812
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:8
                        2⤵
                          PID:996
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4176
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1
                          2⤵
                            PID:2308
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
                            2⤵
                              PID:1132
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
                              2⤵
                                PID:3876
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
                                2⤵
                                  PID:4304
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6193481219183246073,7115427104935515272,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4948 /prefetch:2
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2776
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:2412
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:4160

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    9b008261dda31857d68792b46af6dd6d

                                    SHA1

                                    e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

                                    SHA256

                                    9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

                                    SHA512

                                    78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    0446fcdd21b016db1f468971fb82a488

                                    SHA1

                                    726b91562bb75f80981f381e3c69d7d832c87c9d

                                    SHA256

                                    62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

                                    SHA512

                                    1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    96B

                                    MD5

                                    6adad780d73a02a4e5fdc2a7ef9fa3c7

                                    SHA1

                                    ca58987b95b379ff10264511f5c7458428f1c69e

                                    SHA256

                                    ab4adc7d34d3960964da0fae0d6f767cd7c0c40cc1b9d4505ea56c6f5cd3fa53

                                    SHA512

                                    da7749da69e9351d6e54854321df985904543d8b6ea5cdc8dd763c89e92f09789e6c9d22a9bd2714c5a16bc347cac669195ec26ba637a8989b3c3e22992fedab

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    120B

                                    MD5

                                    2035658502d65387576b7719b9a9d62a

                                    SHA1

                                    4ac4fd855bf73a384bd23b18037b78b32d5a505a

                                    SHA256

                                    e436d5298a8bdeb0a4c36153cd9ace189277996c8a1523dd372120a15d74b47c

                                    SHA512

                                    7eb5ffbbe620036bfe32d9bab32939dc63d8a91cad2fc86ab79bd7ac0a5f3a5bac064da872ed9de7e230f76c3d9934fa519c537ef040b4f00c40b21571ed4a93

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    2KB

                                    MD5

                                    152da278a3e4d6f8651e02df8799f07f

                                    SHA1

                                    d46733e7a5a97ed93050f7f7da2bced7b8060b7e

                                    SHA256

                                    0cad476afdc97c31e522217ced08d4c155cd84874bf6dd8c4e13ed6da54d4a0c

                                    SHA512

                                    b1e47877a1fc9cce8cc290880a9ab8a5046b82f8e3994002d26d611b719652a5a81b3ef5d3996d4c4e409bfa8858d928272039773c48d1bf716becc26a72679d

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    2KB

                                    MD5

                                    5642fbb055b997e25406afea67fafeed

                                    SHA1

                                    5711dc05d0ad19e7da73581915ce29aee6b9461a

                                    SHA256

                                    d9504c41ff9be4d3c8eb55f342b0e1288d006a191f61d14b0f9b803b746e378a

                                    SHA512

                                    5d991978f17aca5651f27d25e3f435ec43d2bbddc0ed34229f32f955b43548b91cc0e15e02a1b800bd534153e1b97c692899c8e20655eed30a8c688eeecc725a

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    5KB

                                    MD5

                                    9353d264836dbf84716f62349563dad0

                                    SHA1

                                    d92f6ec5a25e932584994498945ad2fa9c08abf4

                                    SHA256

                                    5e5c0826aadc8037cfbf506cabae353c7491a6fcfd9bfd5f5ea9072b9f912f49

                                    SHA512

                                    f74e91ba2b3837d209c018a2e35957e591a31bcab41af5435129df3dce0f2c336395acd75018e5fc1bf09337a23a1511a35c771e58ba509f1a25a499ef7f3a84

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    7KB

                                    MD5

                                    c368e124db06bd28ec332b7c233bff80

                                    SHA1

                                    99b8c9ea3a238209bcda26c007423eedf3048814

                                    SHA256

                                    8b0563e44e4ef1e9af6343f3199057a39a7678cc3a591a78d3091645c121f661

                                    SHA512

                                    cf84143c81a5f4181c263e6f4f59ae88ca680bff76088561cc6ffc3db910637a673eb73536c417764a076de3f95c7e33d364206b1a588efea47cd88089336fe3

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    7KB

                                    MD5

                                    85ef62bd6f36e729b9a1a597da10a788

                                    SHA1

                                    c1ebfa6e2d0a5139f692ef8f058d0555a074a4e6

                                    SHA256

                                    b6ee72bfe42c29d937e4b33f9fc88f52f76781aec1616358a612a062ce6acf2e

                                    SHA512

                                    1ffc3d0c91f723a9249ffc835aa8e43ee33316eb228c259e5fdf1441e523cedf72714613ab76992d8e22e4d76adc2c9b98fb8dad9de798b8b15faa45f48be7fd

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    578e4d77f1750b009f8aef67a8a14ea2

                                    SHA1

                                    3f26822e7ad0707b5a757f8e02ba27dfea75a301

                                    SHA256

                                    525c8b2b658e6c8e1917c5be78f8fcd4f3bb180dad383a8344cf033fea316432

                                    SHA512

                                    3ca6dbaddede9a8a6ee8075adee1b2a3ac9f2d436c034b7ab1257ab6426a107b3d441d7b7d52ab91337b979d1e7d3958aaf13e36bc2d0d37ec2de840fac72582

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                    Filesize

                                    537B

                                    MD5

                                    18f9f6ffb2f6fb606e4b6d56e8e5cb99

                                    SHA1

                                    31fe879c7cefedbcd1aed2a0db4b71be97d67ea9

                                    SHA256

                                    7fbd431942fc758b272b846c899011575c35a2955ad1bd1cd9efe5ab9b805cd0

                                    SHA512

                                    e7a9213929186d0c72b0dc5dc2073cadbd320a0ccacbeaf8aaae2bfa8a52ee995234b7256e29f74e8969b9fb30f1d767ef62a0d83546ce77f2e5b7efc5c10794

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582c99.TMP

                                    Filesize

                                    203B

                                    MD5

                                    e7ac3205fef20b3f7e7f73335818eecb

                                    SHA1

                                    63b9c256c32d11ba4cb7897f6a9aef830a1fb8b0

                                    SHA256

                                    72593557ebe43931b05b3ff7e3011e0ef377e19bc75285840937acea78fdf152

                                    SHA512

                                    1b83b7dee4ce4e8f8ff0f7f24f18a3b48d602521c5e94ea9cf2eb31275d526db2a15fb2f092027d63a098a6ba0d5f54dadc686a34924a214e4babe2fbf0a86b8

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                    Filesize

                                    16B

                                    MD5

                                    206702161f94c5cd39fadd03f4014d98

                                    SHA1

                                    bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                    SHA256

                                    1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                    SHA512

                                    0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                    Filesize

                                    16B

                                    MD5

                                    46295cac801e5d4857d09837238a6394

                                    SHA1

                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                    SHA256

                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                    SHA512

                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    10KB

                                    MD5

                                    ee17fbe0d80532750b9384776ccf3750

                                    SHA1

                                    d365f640485bd0b19526b47c054e47ff74bf2975

                                    SHA256

                                    d0974335ecff33620ebdb9c1538ad030931801322b093f79cec732b35f089787

                                    SHA512

                                    5e0b8c7aa517e0b96ffe21c77ac99c98ba4f44a9753744e1e9522d5407834f1660702c097cc4181b906d7ecd17beaf20be4be7b4141a87c97fdb059a40334e12

                                  • \??\pipe\LOCAL\crashpad_1372_GNRJIQTJVAQAGELY

                                    MD5

                                    d41d8cd98f00b204e9800998ecf8427e

                                    SHA1

                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                    SHA256

                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                    SHA512

                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e