Analysis

  • max time kernel
    145s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-08-2024 04:03

General

  • Target

    c451ef2d82fbe2998af9c0c166cacfcb_JaffaCakes118.html

  • Size

    143KB

  • MD5

    c451ef2d82fbe2998af9c0c166cacfcb

  • SHA1

    4871f04c245df8b3f84347bd352d2bcae8f37640

  • SHA256

    5e9ba34688a74540ac9f9349ac20f14972f2e9e5046731871ba7d24c665a0732

  • SHA512

    d56523a3db4568c86c705aa2a9d9726d1c8dabfd8163d0b24a722f3445a8ebaccc558f7729436850c2a4676e78b35fc52b0e2386e488029282351dedf07628d5

  • SSDEEP

    3072:xUAcXmNRSN1yyiAt06RWiKSsu6TOk9+ouCPt8QoHW5iDI65BIrv4LrFFw:UXmNRdh6E

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c451ef2d82fbe2998af9c0c166cacfcb_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:668
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc603146f8,0x7ffc60314708,0x7ffc60314718
      2⤵
        PID:3212
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2268,7117986941298218789,6166615102500906804,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:2
        2⤵
          PID:224
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2268,7117986941298218789,6166615102500906804,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2124
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2268,7117986941298218789,6166615102500906804,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
          2⤵
            PID:2456
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,7117986941298218789,6166615102500906804,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
            2⤵
              PID:4780
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,7117986941298218789,6166615102500906804,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
              2⤵
                PID:2372
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,7117986941298218789,6166615102500906804,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
                2⤵
                  PID:1476
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,7117986941298218789,6166615102500906804,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
                  2⤵
                    PID:4040
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,7117986941298218789,6166615102500906804,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
                    2⤵
                      PID:2588
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2268,7117986941298218789,6166615102500906804,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6176 /prefetch:8
                      2⤵
                        PID:2972
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2268,7117986941298218789,6166615102500906804,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6176 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4076
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,7117986941298218789,6166615102500906804,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
                        2⤵
                          PID:5080
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,7117986941298218789,6166615102500906804,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
                          2⤵
                            PID:376
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,7117986941298218789,6166615102500906804,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
                            2⤵
                              PID:5276
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,7117986941298218789,6166615102500906804,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
                              2⤵
                                PID:5284
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2268,7117986941298218789,6166615102500906804,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6248 /prefetch:2
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4820
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:4948
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:3588

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

                                  Filesize

                                  1KB

                                  MD5

                                  55540a230bdab55187a841cfe1aa1545

                                  SHA1

                                  363e4734f757bdeb89868efe94907774a327695e

                                  SHA256

                                  d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

                                  SHA512

                                  c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                  Filesize

                                  328B

                                  MD5

                                  4875361c2024a0af6b603d333111a35f

                                  SHA1

                                  e114e1dad288885b6944d96081a7112c87f62f55

                                  SHA256

                                  f17f21c11ff49aa654995dc47beed1ad75d9d65d8403efb671f01c28ead5d3cf

                                  SHA512

                                  c96d1ab9af6600fcaa704b2463a2d6ed4798b66e3a9c740a23fbe60f29c8bb83ba790e1685068787eee75d79928d2f259372698ca646a141cd46e3b5726bfc87

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                  Filesize

                                  328B

                                  MD5

                                  57fa97821d960db6c13e5b4d15f94707

                                  SHA1

                                  28cafdfcf024add5e694b794fc559e322bf2f581

                                  SHA256

                                  9039553c69908f61c473d7f3e10af6b8d296e57441be0826ee5add4d1fa9df06

                                  SHA512

                                  8e238b012fb37e13c1875e8992659245d4511d5c72a5ae3f6f9aa22f2b543de19ed9b60f62d9d381d2a2f94d2ba91ce635ef7addc67fd8286225d5756840bab4

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  111c361619c017b5d09a13a56938bd54

                                  SHA1

                                  e02b363a8ceb95751623f25025a9299a2c931e07

                                  SHA256

                                  d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

                                  SHA512

                                  fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  983cbc1f706a155d63496ebc4d66515e

                                  SHA1

                                  223d0071718b80cad9239e58c5e8e64df6e2a2fe

                                  SHA256

                                  cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

                                  SHA512

                                  d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

                                  Filesize

                                  45KB

                                  MD5

                                  aa6a698d1c7fc6d35265b10af5570e9c

                                  SHA1

                                  00da372ad4964a5d5b8afff7fe1b207ff284f232

                                  SHA256

                                  02f6ae7bda59fb1a20d3386021fb972ced348bf724fea42157225d416f9f049a

                                  SHA512

                                  f5b2f732e899cc0fed577e1ef1c51c154ede5d206543e8ac7c1fabb182901f8e93e137b63f12cbb87b3f570a283a368bfb1b9d637cc5b1c4f1669ff5cfbf306b

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  96B

                                  MD5

                                  6680e4d18c4daac71ad2c0b26232bac1

                                  SHA1

                                  77aca33bb7ec5f0ba59d243586d3aaa9c00e72ce

                                  SHA256

                                  9b9ac885caab6dd767967d42b1702f8d8e0f546be945bd5a479e9069f2402a8f

                                  SHA512

                                  ed96e0f1da0ad6ff435c95d41a5b1d78a34018cc4583e40e072c7d37de3718281be5867a3c2fa0d9f70eae55c0cadb963f87aeb39479fc2e136866e720844d8f

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  2KB

                                  MD5

                                  72d8a8264e202ddf3235f2bf995d9eea

                                  SHA1

                                  ef609d4e784100644d4a5492fcf2241107058ba1

                                  SHA256

                                  950ec36b0af077bfe5c6877a7275e6a1bdca43e99c133746ca2260a5770964a4

                                  SHA512

                                  59125f7524aae2c484f278f15454d37f21898561472f5f441d77483441a358e3caf9816ce61a21f192eec97fb156ed7f4f5364f071be03097b24b5e6e665f661

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  5KB

                                  MD5

                                  a550bc876ab32b92af479f73c11ba87c

                                  SHA1

                                  13b81a365823d3d1b98a5297f9cbf5f64bbba0ba

                                  SHA256

                                  4352867329ab1102b93f3b57197ed64eb2e4b11326f38626a376240900ca1cc3

                                  SHA512

                                  9c3160470d2b3b12e3db230f5882e53c6996531b728f47ae2a9c0131afec43ccefee9dc15fcd12e64a274bd3a476250206a6aa5334e9a216b46442ec82f91cb5

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  7KB

                                  MD5

                                  6f8173f9945517ef4fadd8c604c2cd03

                                  SHA1

                                  b213b9ab3ea7181f5e7c48959f057182ee3dbac3

                                  SHA256

                                  d1b6f1af13560c678a772476c0b48623256c530451b7e6bb2c534ee7fab9138a

                                  SHA512

                                  fb52631cc761140fe05bdd565117dad1e66e10b0c513ec1051060987a7617b3ec587b61bc0639a704838eccb91c79a500260ecdea1517c4bfe9bb6bdff248a09

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  7KB

                                  MD5

                                  99d5837ddbdc7d7ab31ae7744a2bbca0

                                  SHA1

                                  d8f5491ff250955d387d0d48cb7467ad91122a9d

                                  SHA256

                                  7d7ef335f4b6356022306a4c2e7e0f444166738596102da2ff842c6c5c44da97

                                  SHA512

                                  214acedca11c62f2a3db79e0f96272f009782e27019838788639f581ceaf33293df99d5a7d01da5513aef4791cdf04b79694c84c97ea2c1aa9d8ed73f9585874

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  6752a1d65b201c13b62ea44016eb221f

                                  SHA1

                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                  SHA256

                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                  SHA512

                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  10KB

                                  MD5

                                  3c5bd0fa9c4da2997a31fceeb825a703

                                  SHA1

                                  ae3350075fa19777bb9d72140896f383e34a381d

                                  SHA256

                                  f8d16caf1c6a431409c2899ba956eef8fc198c8a5571480a1c42631be6daf05b

                                  SHA512

                                  d9c7905caf518663259e8bdb338ebe151594ffd129fe6b33902c37f22b952cb8245f5cd1afdb881632974d85a452f2e43746487965d58e9c21947a38ca8822f5

                                • \??\pipe\LOCAL\crashpad_668_CQQPTLYSJQZCJUOZ

                                  MD5

                                  d41d8cd98f00b204e9800998ecf8427e

                                  SHA1

                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                  SHA256

                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                  SHA512

                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e