Analysis

  • max time kernel
    145s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/10/2024, 01:50

General

  • Target

    54d23e630e425e64c6ec85740697093e_JaffaCakes118.html

  • Size

    11KB

  • MD5

    54d23e630e425e64c6ec85740697093e

  • SHA1

    2af7cb29b05e4c7c1a87ac334c4236f4d032d316

  • SHA256

    7431284b417d1ea93d1ad2a3047eb4e5c3984ac6acf8bbedee623f6085c42a8f

  • SHA512

    11406538e5ecf2cf6adaac88d6990453244c2b947e31598efaf35fe87598a5298f24d721c795d00d1fe105dd14947567bdb75afcf62b14046ae9a943e278fa8e

  • SSDEEP

    192:2ValIsr0r57M4MxapT8IM/w1wvqVkt1kHauBuLbdU8d:salIcIQ4MxaBM/g8WaguLZ

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\54d23e630e425e64c6ec85740697093e_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95aa946f8,0x7ff95aa94708,0x7ff95aa94718
      2⤵
        PID:3120
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,4116237503396055764,18012455644551314554,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
        2⤵
          PID:4008
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,4116237503396055764,18012455644551314554,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1396
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,4116237503396055764,18012455644551314554,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
          2⤵
            PID:1432
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,4116237503396055764,18012455644551314554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
            2⤵
              PID:3648
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,4116237503396055764,18012455644551314554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
              2⤵
                PID:2924
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,4116237503396055764,18012455644551314554,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
                2⤵
                  PID:2368
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,4116237503396055764,18012455644551314554,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 /prefetch:2
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2728
              • C:\Windows\System32\CompPkgSrv.exe
                C:\Windows\System32\CompPkgSrv.exe -Embedding
                1⤵
                  PID:4040
                • C:\Windows\System32\CompPkgSrv.exe
                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                  1⤵
                    PID:3044

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                    Filesize

                    152B

                    MD5

                    8749e21d9d0a17dac32d5aa2027f7a75

                    SHA1

                    a5d555f8b035c7938a4a864e89218c0402ab7cde

                    SHA256

                    915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

                    SHA512

                    c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                    Filesize

                    152B

                    MD5

                    34d2c4f40f47672ecdf6f66fea242f4a

                    SHA1

                    4bcad62542aeb44cae38a907d8b5a8604115ada2

                    SHA256

                    b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

                    SHA512

                    50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                    Filesize

                    168B

                    MD5

                    3677a65a642d90fc1d527762970d0726

                    SHA1

                    9aba3934e02a035e2d14ad67e47d8af04153d949

                    SHA256

                    45bd89379723f1c9c540153264897c831ad082a84106e470391da81bce519cb1

                    SHA512

                    075dbb328b38c48b4dbd476bb84a9af9b6aaf971e2ea5c0bda8486d5770f17a256b9784ecc652032c096b0e63e770041ee4ef1bd38f6fbc19713be80e002149c

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                    Filesize

                    144B

                    MD5

                    86d073cfb2f4ecb520ee3c19a801cc68

                    SHA1

                    e058550cbfc46b831884d8daebb14c58417dbc89

                    SHA256

                    b7f3954266a8fcbd798d5148d8f615a0058d087d48245a5dc884abdb04eee928

                    SHA512

                    b1bce4e025421fd54a3c7cbbf31fba33604b6121807d7d2a18d236d3144acbc70e7dbbc5e9d9b862c3f75fad0cc1d3c44f4670848126b764c60efdc497d80eeb

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                    Filesize

                    111B

                    MD5

                    807419ca9a4734feaf8d8563a003b048

                    SHA1

                    a723c7d60a65886ffa068711f1e900ccc85922a6

                    SHA256

                    aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                    SHA512

                    f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                    Filesize

                    5KB

                    MD5

                    c636cb55f317a2a48bfada5f87174a6f

                    SHA1

                    1bbb2ea446d69d1b8eefcae047754da642dcfb25

                    SHA256

                    2e6a9128d3f2823231e402eb15daecd186195fa93992699180295dd706738e62

                    SHA512

                    8bfb286fb32f95ed50d74e1844b6cb9dec19c24ed9acc40a685e54681b7ab9ff53c3d9d693c150d0dcac4b68007aaa67c1e7d6aee9e33dd36ead6f696888a447

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                    Filesize

                    6KB

                    MD5

                    44c532d9948a327559a800334194a897

                    SHA1

                    2d1899ce996921cdced3c715247fe80072036b80

                    SHA256

                    a4ebbeb8627b34447044ae5cfe18433a1c364c033a193e64a761383c5c75288f

                    SHA512

                    f7b10642eab2e16d87fb469a893f9aae7c36a166979624399e2696504d1f75a2df36b45fb5355d0b079d7714c03c3322fa20370cd6518e83f8b5859dec0a6094

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                    Filesize

                    10KB

                    MD5

                    db566f7b82108597a673428084a142c5

                    SHA1

                    27d17957e3d32402f29eb6d5e9a3a9a94eea2c9a

                    SHA256

                    f575cb5cb594fe65e10c95f3c8a581223db63a6aefa34eb0b50da7f2bc78b9c7

                    SHA512

                    bb2b57ea4c52f2394998cbd0ae43e883696e06779e7be6199cd5dfe0ac1aee6c24bb007993e522035d8fc9fa2352fee3496f531075d8e23a658a950119d6d552