Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240910-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/09/2024, 02:09

General

  • Target

    fd97e9de8624e9940c9f48b9ed130d45_JaffaCakes118.html

  • Size

    19KB

  • MD5

    fd97e9de8624e9940c9f48b9ed130d45

  • SHA1

    79a4acc0c5c352bbe4c4515469e3329682ceec7d

  • SHA256

    2587c279db00a0205e95cc5c7b89e887a64a1f16edabf7277f8e04d7446101d8

  • SHA512

    6c5b432b066875fe8a766e9adfbe9dfe9abc90309391ebfc935dee8d2a7dada9a7c6d4182943a1bd80dbebaa9b0581d63e950fbf0361daacf76f9bab899d9640

  • SSDEEP

    192:SIM3t0I5fo9cKivXQWxZxdkVSoAIm4yzUnjBhWo82qDB8:SIMd0I5nvHRsvW7xDB8

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fd97e9de8624e9940c9f48b9ed130d45_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc84f46f8,0x7fffc84f4708,0x7fffc84f4718
      2⤵
        PID:2896
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,3856005281451740657,43999557435600008,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
        2⤵
          PID:1840
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,3856005281451740657,43999557435600008,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:184
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,3856005281451740657,43999557435600008,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
          2⤵
            PID:216
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3856005281451740657,43999557435600008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
            2⤵
              PID:1884
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,3856005281451740657,43999557435600008,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
              2⤵
                PID:4860
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,3856005281451740657,43999557435600008,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 /prefetch:2
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:1444
            • C:\Windows\System32\CompPkgSrv.exe
              C:\Windows\System32\CompPkgSrv.exe -Embedding
              1⤵
                PID:4876
              • C:\Windows\System32\CompPkgSrv.exe
                C:\Windows\System32\CompPkgSrv.exe -Embedding
                1⤵
                  PID:2796

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                  Filesize

                  152B

                  MD5

                  7006aacd11b992cd29fca21e619e86ea

                  SHA1

                  f224b726a114d4c73d7379236739d5fbb8e7f7b7

                  SHA256

                  3c434b96841d5a0fa0a04a6b503c3c4d46f1c4e3a1be77853175e5680e182814

                  SHA512

                  6de169882c0e01217c4ca01f6ead8e5ebb316a77558e51cd862532dbf9147d9e267f8db667ff6e9fa33164243724f5e437cb882392382f3cae1072dadb762c1d

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                  Filesize

                  152B

                  MD5

                  b80cf20d9e8cf6a579981bfaab1bdce2

                  SHA1

                  171a886be3a882bd04206295ce7f1db5b8b7035e

                  SHA256

                  10d995b136b604440ac4033b2222543975779068a321d7bddf675d0cb2a4c2b1

                  SHA512

                  0233b34866be1afd214a1c8a9dcf8328d16246b3a5ef142295333547b4cfdc787c8627439a2ca03c20cb49107f7428d39696143b71f56b7f1f05029b3a14376a

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                  Filesize

                  5KB

                  MD5

                  0860b558457faf189b2942e27463fb89

                  SHA1

                  78e08e2edf64eadb8d1e3829fa05bffab27b22ca

                  SHA256

                  cfdde09ddefb27b56e1883787c129457436d42ca28095ab6792cba7e635d07ae

                  SHA512

                  53746a5f854588d150fe1ba31d31c37d8eec935fb52547616488a0f1d30c80e730f25d4f5b8e47971d6718afaf0c8e966ddcf5e4014c5917a25c87b5330d1932

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                  Filesize

                  6KB

                  MD5

                  ec9d2408d64cc16347fda0d76938adf2

                  SHA1

                  534b744a8a7df961b49013a2ca8c74c6ba03462e

                  SHA256

                  814ed0ed48e0c6c73f29124982074c2079cdb653bae08892eb2ed891273642ea

                  SHA512

                  c5df70cd2e64c304171822bcb0a93e7cf05922bc3ff72a70124a2b0f47baec0d20c1dd5898cd8d62b46563f37bb10fe3741159e2e1e4ed338b6ec4db783c433b

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                  Filesize

                  6KB

                  MD5

                  b4a9b06f01261bfb35baa20c904d2cd8

                  SHA1

                  852f6417a96617d9534667d440d28937ea25afea

                  SHA256

                  3b4053b03a99273f118656209bb5869d5243f582e58ab7eafcf96e2517cd654c

                  SHA512

                  1b89e0c0e3c38a5ce7f92f2482c1c09b2a736f33e0c14155469fbcdda6ca114568ad54815e34c7649bf9b51b15250ec8788673f72a94f40588be9af7126c1646

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                  Filesize

                  10KB

                  MD5

                  b8c9bef07e701f1a41be5abe64339eea

                  SHA1

                  4f5a3b44ee6dbe1613245c545bdfb1c3ee23ff2c

                  SHA256

                  bddce874c4a45c70372acf63bd7cd516ff5dbee57814f48226e48827f44f07d8

                  SHA512

                  f7921d5ccccdf7deaffb1a43cdcab331e265d97590491261b8c1f43a46eb0f684d22f5ab5d087ab7e1f361b58ab966d1016907bae2d6d1baf99168717c41e387