Analysis

  • max time kernel
    145s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-08-2024 00:49

General

  • Target

    c5fe32fb5a61f48e7723d7bb98a068ed_JaffaCakes118.html

  • Size

    82KB

  • MD5

    c5fe32fb5a61f48e7723d7bb98a068ed

  • SHA1

    6fefedd58073a1ab68789c81d777699f85878e7b

  • SHA256

    bf9928b4d70dee334ba80b8af6df89a02febdb1ca60de566f50b73ae06dca584

  • SHA512

    b0781c7c977dd351a023c62edd1baae1a668262fba32021cadf5c46c3a839d8bed5e88299602748d67a8676aed1e9872a8f4d9f5e37532d0c9bbfb9fcc0f9f3a

  • SSDEEP

    1536:DLNCGEx04IfE63rqggVtx06n46xQJL4t8hqVjswlqTbjeJd:DLNW8V3rqggVtx0S4oQJL4OqVjAbjeJd

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c5fe32fb5a61f48e7723d7bb98a068ed_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2928
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82fc046f8,0x7ff82fc04708,0x7ff82fc04718
      2⤵
        PID:1656
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,11809257199584456128,2289128497703431267,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
        2⤵
          PID:3792
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,11809257199584456128,2289128497703431267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1932
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,11809257199584456128,2289128497703431267,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
          2⤵
            PID:2140
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11809257199584456128,2289128497703431267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
            2⤵
              PID:1864
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11809257199584456128,2289128497703431267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
              2⤵
                PID:464
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11809257199584456128,2289128497703431267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
                2⤵
                  PID:4140
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11809257199584456128,2289128497703431267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
                  2⤵
                    PID:1544
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11809257199584456128,2289128497703431267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
                    2⤵
                      PID:4944
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11809257199584456128,2289128497703431267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
                      2⤵
                        PID:2816
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11809257199584456128,2289128497703431267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1
                        2⤵
                          PID:3168
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,11809257199584456128,2289128497703431267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1680 /prefetch:8
                          2⤵
                            PID:4900
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,11809257199584456128,2289128497703431267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1680 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4260
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11809257199584456128,2289128497703431267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
                            2⤵
                              PID:400
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11809257199584456128,2289128497703431267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1
                              2⤵
                                PID:4600
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11809257199584456128,2289128497703431267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1
                                2⤵
                                  PID:4060
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11809257199584456128,2289128497703431267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7088 /prefetch:1
                                  2⤵
                                    PID:1812
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,11809257199584456128,2289128497703431267,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 /prefetch:2
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4932
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:4836
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:4808

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                      Filesize

                                      328B

                                      MD5

                                      644308ffd27e90ce831fc2f9d8bd48ac

                                      SHA1

                                      cded950375361612e7ab730553787fd8023620a1

                                      SHA256

                                      879686ae89a0656d394c49ffc7a1c3692527198bedf2d5d35c15be12a172d3e6

                                      SHA512

                                      9c60ed611b30e5a7689e241b6b833d9afea6e8962b380d0e23a49191e0d0a740db7541911682c094ab43046ea4a8acf00b92f0f15257141f8a3567f20e336c7b

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      d7114a6cd851f9bf56cf771c37d664a2

                                      SHA1

                                      769c5d04fd83e583f15ab1ef659de8f883ecab8a

                                      SHA256

                                      d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

                                      SHA512

                                      33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      719923124ee00fb57378e0ebcbe894f7

                                      SHA1

                                      cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

                                      SHA256

                                      aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

                                      SHA512

                                      a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

                                      Filesize

                                      96B

                                      MD5

                                      25b568664b5ff3e8149c2a8fcc9b5a42

                                      SHA1

                                      335d7c53bc9ed4ef30bd170cfb4c270173c6a5a2

                                      SHA256

                                      80fb6f84537d152f56aa320d9a1f101877c961187bb8725f3b0ff1b7621f7845

                                      SHA512

                                      ea1f744aebf2e1604d5006a05d81cb2e7076b433c502e74601509d828c7da86c88a6d7cc007aebf530cb35ac6a5ca130fcd080cadc4db75769b4e085b07a14c8

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      1KB

                                      MD5

                                      be1bfe033e4e4e7da0317b2ceaa7a641

                                      SHA1

                                      2354de5a6fba2d46fdccad508d9d97937ccc25c7

                                      SHA256

                                      df473fdc23dcd65ae9c9c5bd5f08c6e08bfe1ce73bf7459a973d98c5c03da77b

                                      SHA512

                                      7c45c11ab97804961d2c274c4cb179659192b5aaff5f7c76671fa6eccd1a386a0b346f479a472abefa7d7bb3022fd451c6a2e096eb6781fe45baec01ff66411b

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      fdf6f8042b87184caa2d4a6bbbf3b1a2

                                      SHA1

                                      b47a5d77cd57d9fe17877f3fa60e077b8deeec49

                                      SHA256

                                      8e343545200579d4194ddb029d3a861bd10bac803dd8129479312e0f7a6484e0

                                      SHA512

                                      3decd81711e02db5cf2081a443f4d1a594c388c4e2701e7b32fcf1aef0b47506af04d72539ed5992cb630708edd03b3de940c3f713edf34b33e7120920ef9c56

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      56145e9af04e20f9650e2ee3d158b516

                                      SHA1

                                      03f4d96863b222a88383310f0f56b9d24758566b

                                      SHA256

                                      a426c34ceb5eca4ac7e73eaaf8fe34af103275163ddf04edd96fa8674824ddaf

                                      SHA512

                                      65c1b04f635f8c57ead7b6423fa771a45dcfe9335dc28d3d1f5743eef9d88fb137c09354b33c3f5b94b1c3b757d9c4926f9463215813a73c9a60941df4be0ee6

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      3a3a73a117fc8f56fe674ce8684d1ef1

                                      SHA1

                                      6a26b50b02895498b08a8eb435dd4b21e8def3a5

                                      SHA256

                                      5773e7e2d261f17ea76af9442766121af24127d8f1c32546acbb4cf97d0c8e9f

                                      SHA512

                                      c343fb2d7d121c00d1e739aa2b6b2cca7119375c6c625e9093ac93fffbc65519c8215bc2f479293b0443c704c5d8908c825990f5144a8cfdd64951b179ee9dcf

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      204B

                                      MD5

                                      066edc96d8f913c5349d87a243ab69f6

                                      SHA1

                                      555ad8f7e60f18d4967977d5585c838a0455bd30

                                      SHA256

                                      e6667cd02e09d68fc7b994ab230aa8f34d005b8bb9de0bcc85ae22828dc37896

                                      SHA512

                                      c3ae1ea9ddb39ca541e82de16d9f4247c6e734ce3a66562ea8bbd3c69ad449edce5aec653f446c043716650c215ab54699ced8796ca689949b7f96b5c5fa6307

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fc52.TMP

                                      Filesize

                                      204B

                                      MD5

                                      8994eb133a3136616ca6300132d70c44

                                      SHA1

                                      1dcdc63c351c4c6801706bf666a099ccf08d1477

                                      SHA256

                                      29573621179d6a900dea87eba360ab2e05a90f0defdd2c3af680fc32a6a4b675

                                      SHA512

                                      7d64edb4c33d976d950b20a9ff20a657f1981cb4b156c1778682e114f35619faee621767b8845a560979471d22c9aac6db7241fe81ec3555a2f88898c8eac4c1

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      6752a1d65b201c13b62ea44016eb221f

                                      SHA1

                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                      SHA256

                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                      SHA512

                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      10KB

                                      MD5

                                      25ce9e224c26c642326d69b5dfb9b85a

                                      SHA1

                                      47450770f22bbb49060a6ff11bab28df2d596388

                                      SHA256

                                      c0ec210ce2f1a14a619ad0ab594cef788532c656c0856c1cc122d2a04021a48d

                                      SHA512

                                      47ae93ff4846f2c1b53b7a6d98cfb065e35ff0d09ae6f747b5ed86ffd4de88568b8d03548c70851f5053f243fdbb28157b054fa3c3584cbd9a992544b615ed24

                                    • \??\pipe\LOCAL\crashpad_2928_OYINXECHENKDJCWN

                                      MD5

                                      d41d8cd98f00b204e9800998ecf8427e

                                      SHA1

                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                      SHA256

                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                      SHA512

                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e