Analysis

  • max time kernel
    145s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/09/2024, 05:01

General

  • Target

    d9a8fcaf78f10578728e717842cb07b2_JaffaCakes118.html

  • Size

    261KB

  • MD5

    d9a8fcaf78f10578728e717842cb07b2

  • SHA1

    d0315a61f1c46356f400666dec52d0657f850ed3

  • SHA256

    204e885a61fcdf0baa2e660418d2db492b51bb49de440f6783fd1a3fb2e7e973

  • SHA512

    a365c68fbe2877da7884a9ada21e1d78a0399f39465d2e0af80a00f3011d05ad060d26e800ce00fa3162223148a2063c9d1e0b8966b9232f4f3deb14011a3038

  • SSDEEP

    3072:OkBkcl/ekoJhInWSq2k2dwUAw04lsBa4kLHKHM4lvDt9DpCk2I1lfOHWXT9cX5fO:nkcl4JI6DqNHA5MuvT1

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d9a8fcaf78f10578728e717842cb07b2_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82b1346f8,0x7ff82b134708,0x7ff82b134718
      2⤵
        PID:4408
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,589299628447290079,4245824447826670756,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
        2⤵
          PID:2944
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,589299628447290079,4245824447826670756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1428 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1188
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,589299628447290079,4245824447826670756,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
          2⤵
            PID:872
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,589299628447290079,4245824447826670756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
            2⤵
              PID:4844
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,589299628447290079,4245824447826670756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
              2⤵
                PID:3512
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,589299628447290079,4245824447826670756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
                2⤵
                  PID:3592
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,589299628447290079,4245824447826670756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4524 /prefetch:1
                  2⤵
                    PID:2780
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,589299628447290079,4245824447826670756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
                    2⤵
                      PID:3116
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,589299628447290079,4245824447826670756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
                      2⤵
                        PID:4204
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,589299628447290079,4245824447826670756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
                        2⤵
                          PID:1568
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,589299628447290079,4245824447826670756,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4356
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,589299628447290079,4245824447826670756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
                          2⤵
                            PID:1100
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,589299628447290079,4245824447826670756,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
                            2⤵
                              PID:3936
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,589299628447290079,4245824447826670756,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
                              2⤵
                                PID:3156
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,589299628447290079,4245824447826670756,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
                                2⤵
                                  PID:4084
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,589299628447290079,4245824447826670756,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6360 /prefetch:2
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3324
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:5008
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:3220

                                  Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                          Filesize

                                          152B

                                          MD5

                                          53bc70ecb115bdbabe67620c416fe9b3

                                          SHA1

                                          af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

                                          SHA256

                                          b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

                                          SHA512

                                          cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                          Filesize

                                          152B

                                          MD5

                                          e765f3d75e6b0e4a7119c8b14d47d8da

                                          SHA1

                                          cc9f7c7826c2e1a129e7d98884926076c3714fc0

                                          SHA256

                                          986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

                                          SHA512

                                          a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

                                          Filesize

                                          23KB

                                          MD5

                                          a0423f1305547bb6b8f5a4fb1a9fc2d8

                                          SHA1

                                          092dcf1fe57e6bb53821eb754e04188ee70602d5

                                          SHA256

                                          6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8

                                          SHA512

                                          b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

                                          Filesize

                                          23KB

                                          MD5

                                          33a83c16527e4531fbfca2631f653674

                                          SHA1

                                          87a63514c262ba4bffc52d2ceebb3ca14353507a

                                          SHA256

                                          1156bb50a264543f6a9dc8922dd2c65d444c8bb11b3b18be95d5adff840b33b4

                                          SHA512

                                          f1dba28d0f81aa0894436ae7b4ba76a2e635f002f666d17d31b8b21500dc2321d7862ca8dcfd22e44aab4d1f33112c076dc95191c889546a40f9c6197cccbda3

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                          Filesize

                                          240B

                                          MD5

                                          0ab047d65b5437a5f2c5673bdbef9279

                                          SHA1

                                          ce4ccc3b39b1896479777a390309c7e6c807c753

                                          SHA256

                                          78086fbd81b180000af8dcf93a11ff8468014f0821c2457aa028728f3e07198f

                                          SHA512

                                          f279494e925c9d1f6e5159ce94d3e896ae573deab262c376644cc2771239ed3876436f5608d3f91170396769eeb09c022d1e72dc6154e29ab60746dbbf3e345c

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                          Filesize

                                          216B

                                          MD5

                                          1bcdac0055c52b512ff9cc5a20ddce16

                                          SHA1

                                          1658fa54e23df3a84b86584b57b410015a5b307d

                                          SHA256

                                          8005a762bf81088ef6c71a24dccbd0ad714fc1ee048dd0a7488f077694e270de

                                          SHA512

                                          6ca0bc1ca95b3ea22cb03d5479ad064aa3814619f83500b5ae4e83ca597762e37483cf9bcbfe374fac0e95efeadd5be4f34978e3007df3987149cb1c61787839

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                          Filesize

                                          96B

                                          MD5

                                          c4ed1700b90ce669b1d355012b433716

                                          SHA1

                                          efc50757aff73dff34dcd9961b237acd64a1bf79

                                          SHA256

                                          75094d530f492d9ce4f4d889ac34f8f8fa3d1f8bdde126b9e57e21448ab4fcbc

                                          SHA512

                                          4bb060c6358d4c7013315ca1a4c1b7914055d742d6920e78ffe722cca13a098eb8efdb7f28cd7328f06a07e96b800db300c7ce14a1b439a4e5347db103b4e696

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                          Filesize

                                          2KB

                                          MD5

                                          7b344ce416f7f4e7d561f19450d30bb0

                                          SHA1

                                          60b8c9ed39375bfb7526c6551a60f3fcfbb223d7

                                          SHA256

                                          bc3cb18efab4c41be475eff00df9353c5a18ae614d5de9dc1a8a0ebf13ed4ba8

                                          SHA512

                                          57c2d566f4a229474da6fb13212940db62f3ea3c4742bdbebe28a7aaed43cc4467adece3ff6d650bff3537af8fce33604ac0a6dcedf5a8bf21d764643ffad458

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                          Filesize

                                          2KB

                                          MD5

                                          5e576c75670f96f14fb85b3d47f1d638

                                          SHA1

                                          369ac10b4bf523380995138b3ec96cf494c75133

                                          SHA256

                                          bb9c8f288dce157fd3832e26869bf48fe867dbe5e86e22726395210c6073635a

                                          SHA512

                                          d68d11fb705bd2daad76dc94f9658811727bffc10ce0f040b2b2e16fa282e68e3350754ddd97e14f24e502f0b97da77839321b16a5984c0b4f7e29a73980720d

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          7KB

                                          MD5

                                          8ece4a2bbcb3c739b08b31a388185353

                                          SHA1

                                          78f662723f7b7fdc3a900e7a0ae04624989d5838

                                          SHA256

                                          04da6b2eda4eefbb5ef9d34dbb3c625ad6003254397ccd5cba162017537b4d1d

                                          SHA512

                                          4907fee11d5f87d3003b1bfb0ad3a2cfa4c36888d09b6d0820116c890a06608d1c7bbc71c9dbe955a9c42480c05fade4db4751d3539e8c2a4051582db417a663

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          5KB

                                          MD5

                                          d6233bf77fc14814c493b757df0bca78

                                          SHA1

                                          5d2f8685035092a7066c8d73dba5705e1d5b3978

                                          SHA256

                                          8c20957f6ec12d6f63c14d0a8590ebf8fba7d539317521c80f08ebcf3782b125

                                          SHA512

                                          969ca0d08535084c6d49e96b9300e567909426b19e1694d37a1a065e840c1cee69ebbddf14e48fbe130deea834d00d4edf746f1a6a57174906121fe2bf78f400

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          c3858e599f91f804952584ff1bb66640

                                          SHA1

                                          1ce662b55ea82e28ff5f833e5078104db4647963

                                          SHA256

                                          8527dfd1a351dba1b86b1f5e9a01ee3ec931d2b1e7ee94ff9d8c803496bde3f4

                                          SHA512

                                          717def2bf2ca6293b252173e6bcc39ff7e4a724f6d3ce80ffdf41d31f1f6a1ccb63839139f4d4657a1bfa592a4b5909f980ea00b7f44827fdaa2f73b5446d61a

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          7KB

                                          MD5

                                          ab62cd8f2af8276945b3d899ef460bdd

                                          SHA1

                                          11dacd3424adf0f9943dcbc7f683c1388f014d03

                                          SHA256

                                          82cc3625d9914a6caeb2edc4b110b992bff1b3542b0c53a44270ef1c220115f7

                                          SHA512

                                          c664acde9d8b7d63ea4f21b7c246e815e3334cddce923b2817e1b1a037cf331768d28ff5bc0203ee982a6b083781b87d76416c30305eec8737f75a24c166e475

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                          Filesize

                                          16B

                                          MD5

                                          6752a1d65b201c13b62ea44016eb221f

                                          SHA1

                                          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                          SHA256

                                          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                          SHA512

                                          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                          Filesize

                                          10KB

                                          MD5

                                          404fbf7118b3ef0065a74cbe2dab2c65

                                          SHA1

                                          163f401a152f9ca90f4ccbc226e33ce402f89f57

                                          SHA256

                                          801f195e6744b45c9d35fddad81edca43dbfaa4c2ffc3af249ca83c93b10483e

                                          SHA512

                                          feb336e0fa05fa85776f166b567521635eed3dede94964cfe0dd667de21f74a01e8ecefc5d4b15756fb0dfd9064ca62da681447930d6fe853aac66552972b8cb