Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-08-2024 00:36

General

  • Target

    c4158cde4006bdabc91c683587d4377c_JaffaCakes118.html

  • Size

    116KB

  • MD5

    c4158cde4006bdabc91c683587d4377c

  • SHA1

    0e7bdbd2a145cafeff4a26e6b3131df9e83d7c7a

  • SHA256

    93c2787a64439fa9ffe4946574ecfd2cc524e280c0c80f9a303234dab2c91d6e

  • SHA512

    ba42ca4e6624a259d535ce36ac8e0c88e3ecadde7bd4aaff7062749ea6f0bafbe6e8bd7399056959d13a6dec43d2f44e910db027a1a08b8fc2d39e71a76c3bba

  • SSDEEP

    3072:6Lqvj40MZEPjLpUxAfYxslxNcl8CLcXmNRS/1nt0X1nT8CalKw+Q7+cRHqjlyy:6sjXmNR0CalKw+N

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c4158cde4006bdabc91c683587d4377c_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3740
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80c1846f8,0x7ff80c184708,0x7ff80c184718
      2⤵
        PID:440
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4247890234104619929,6660817752759514467,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
        2⤵
          PID:760
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,4247890234104619929,6660817752759514467,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4976
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,4247890234104619929,6660817752759514467,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
          2⤵
            PID:2364
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4247890234104619929,6660817752759514467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
            2⤵
              PID:1548
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4247890234104619929,6660817752759514467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
              2⤵
                PID:3724
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4247890234104619929,6660817752759514467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
                2⤵
                  PID:1064
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4247890234104619929,6660817752759514467,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
                  2⤵
                    PID:2216
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,4247890234104619929,6660817752759514467,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3048
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4247890234104619929,6660817752759514467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
                    2⤵
                      PID:4016
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4247890234104619929,6660817752759514467,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
                      2⤵
                        PID:1960
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4247890234104619929,6660817752759514467,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
                        2⤵
                          PID:3376
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,4247890234104619929,6660817752759514467,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
                          2⤵
                            PID:1696
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,4247890234104619929,6660817752759514467,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3316
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:4704
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:2652

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              e4f80e7950cbd3bb11257d2000cb885e

                              SHA1

                              10ac643904d539042d8f7aa4a312b13ec2106035

                              SHA256

                              1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

                              SHA512

                              2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              2dc1a9f2f3f8c3cfe51bb29b078166c5

                              SHA1

                              eaf3c3dad3c8dc6f18dc3e055b415da78b704402

                              SHA256

                              dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

                              SHA512

                              682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

                              Filesize

                              23KB

                              MD5

                              33a83c16527e4531fbfca2631f653674

                              SHA1

                              87a63514c262ba4bffc52d2ceebb3ca14353507a

                              SHA256

                              1156bb50a264543f6a9dc8922dd2c65d444c8bb11b3b18be95d5adff840b33b4

                              SHA512

                              f1dba28d0f81aa0894436ae7b4ba76a2e635f002f666d17d31b8b21500dc2321d7862ca8dcfd22e44aab4d1f33112c076dc95191c889546a40f9c6197cccbda3

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              96B

                              MD5

                              1c4bb32981384b99c69925447124d201

                              SHA1

                              1f088f3fc31d1c2ec9cd8b92dbc604d1e98efcd8

                              SHA256

                              a2f82cb5a3beeae506815558e22b0689cb01bb4060e101dfe977f871e554de4a

                              SHA512

                              485b772eb853e57a7a550fd5db6296a7ed31270f9363969de5a158baca0ea77ec36b09b7f5de9dbce9166c952c0d2a5c18d864a2dfb4fd5a7ff8df26246f2541

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              144B

                              MD5

                              311c52a64de53165bdf045ff9a8bfc9a

                              SHA1

                              b5e08e1700129499c0ff28c8ceef2b42129e1694

                              SHA256

                              97baadcbf51ef3b1b894f4f2a358a66b8492b1d9791881366f3ab1312386a5b0

                              SHA512

                              26bde7ed59e4129848747474825b6e97529d2abcd6f51a69464eb58261be644f1795125ef93e0228358929b1876ac2e7cb8bd77d4f736e8d525a867932593c6e

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              a073c8c2f1d0a21247335ace8c73b679

                              SHA1

                              6748697d285fc6421c6edc95b7661e1ce7bfe227

                              SHA256

                              c9c43cb13084f3914d1f566c7732eb7f9221adb1dc29953bb6910ded83ca5425

                              SHA512

                              c9d3619eae427562ac35d96377cd9fe3f547f80b791afea4a01e41e0aacb132ce474e7f528341dc27bc5c6f25370c5ba03a2a1ef49bc00a92a509bac7b9433ef

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              03bee3b96aa97658a428f9db8039aa71

                              SHA1

                              accae064594f4aa22f38111ce1787fcc2beec6ff

                              SHA256

                              cfadc09c3ecb7d22bbe06a11f76f2a4752d815959c78e96a89413d0d1a34933e

                              SHA512

                              73519b6689f253bf3d884705a4e4d2d2acf9f08dc9dae72460f69e67417d350e979fbba24854b6a01ff9e1203b389fec9ccb98cefdd23e9c48c12abb42a2ed92

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              40bfcf20f2f402935eeac60bd6164714

                              SHA1

                              e152f3d362a609f85ba896fd4319e5a2792d4a6f

                              SHA256

                              a5f0665e42791d2c5a05705fc8eeba6771fe5847a7b1e1dbcf8fab447682abd0

                              SHA512

                              7fb2a1c2adb68e1e9a437530edb2e8eab7c660f1654e22ae1ac27f14f8d755e41c25ff48b99cfb228ea2118e828a50b903f11d8b396ff6012e18a96f6160a9ab

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              7KB

                              MD5

                              fa89854a13c4d98a006eab8bebdbf071

                              SHA1

                              da5234cce5fd9702e0e198625439777591fb534f

                              SHA256

                              46a1f1d0b7c3d8b9adf7aef4376b092d55dc38254673849168a0b3ba42635876

                              SHA512

                              3e22959f413aeab0134a577f7f1b38f4ee54e5d3728bad42dae70b0268ddc967a90f332a35646d2b98dde3beefca89e49f6103b8b06fd1f6398439ccc7b7218b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              7KB

                              MD5

                              e5a1d54ee483f9577c5034097ce70a2b

                              SHA1

                              d2048b470eef3d788b21d1f09484210c83dce368

                              SHA256

                              68f0a8c69843fb00550cfa3315f68134a18a9ce390c45ab806c987e036410d0f

                              SHA512

                              36e68c3c2d4012f5fd9a3e985dec617aef09368a2d6726e80b92517b0df6b662b7ea89f258030b2c9fb38f769c4e110297efbf58f8c8cd86681326d81b69eb90

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              4610c358f49e4f8a6815f81ad730dfd6

                              SHA1

                              9ae8507beb971509a07eddb0489322e61a8e96cf

                              SHA256

                              4a498693bb3dfb4cd248a2c3b4371665e9ce662f8acbda8d1b90037b824b4e82

                              SHA512

                              9409138195eb4458c2b2dc99b69da383b53fb1aa3a2058182300c298981f2044790c503860058f73bdfdc8b691a4efcdc66ec48b4a33a360eb2c3ffbd6d1867b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              10KB

                              MD5

                              4e0d0cd0f8350964aa6514a710bd062f

                              SHA1

                              631b34aad1a4993dde2a73c13ec0d886fbb3ad65

                              SHA256

                              7b4f85043845466173e3a8696fbcc189f748388f085720a3c3ef7c4e173b3b7f

                              SHA512

                              915ff16e027728f246a61b010f74ffa92b9e0634aa92d1fe9cc385c345ce2877631da7d0808cb7d675e1e809aa6a033ba77dda6c7a65b88c306ea109cadc4c53