Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2024, 15:37

General

  • Target

    a12dd5513caac4d485996d83729eef24_JaffaCakes118.html

  • Size

    142KB

  • MD5

    a12dd5513caac4d485996d83729eef24

  • SHA1

    972df74b9a1b1583cd5a46251ce62aeecb72b978

  • SHA256

    58b2fb6f92297993088548d955316a1e9408477dc8b0b6ab2d56133c1c3ec04e

  • SHA512

    b833bcf39465354f71555dd772659e131ff02d0145c01eb6fb9f6423ce235dc5d1ff5b6493991c5f61955a0503af2d9fe2fc1f8baa06f9b5a6a4f6aa4db5a4d1

  • SSDEEP

    3072:T0zzIpBWcWQUGqL/viu2WZt3TmvKygrOtV+fZFmHjf:MzIpBm3DZF6P

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a12dd5513caac4d485996d83729eef24_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4784
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffdab7846f8,0x7ffdab784708,0x7ffdab784718
      2⤵
        PID:1032
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13709404477664232571,13226221597237750243,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
        2⤵
          PID:2508
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,13709404477664232571,13226221597237750243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2644
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,13709404477664232571,13226221597237750243,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
          2⤵
            PID:3472
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13709404477664232571,13226221597237750243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
            2⤵
              PID:3992
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13709404477664232571,13226221597237750243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
              2⤵
                PID:408
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13709404477664232571,13226221597237750243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
                2⤵
                  PID:5652
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13709404477664232571,13226221597237750243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
                  2⤵
                    PID:4260
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13709404477664232571,13226221597237750243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
                    2⤵
                      PID:2384
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13709404477664232571,13226221597237750243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
                      2⤵
                        PID:4980
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13709404477664232571,13226221597237750243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
                        2⤵
                          PID:2804
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13709404477664232571,13226221597237750243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6660 /prefetch:8
                          2⤵
                            PID:2312
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13709404477664232571,13226221597237750243,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6660 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5948
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13709404477664232571,13226221597237750243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
                            2⤵
                              PID:4068
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13709404477664232571,13226221597237750243,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
                              2⤵
                                PID:3960
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13709404477664232571,13226221597237750243,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7132 /prefetch:1
                                2⤵
                                  PID:3988
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13709404477664232571,13226221597237750243,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7116 /prefetch:1
                                  2⤵
                                    PID:4884
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13709404477664232571,13226221597237750243,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4872 /prefetch:2
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:668
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:4408
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:5380

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      db9081c34e133c32d02f593df88f047a

                                      SHA1

                                      a0da007c14fd0591091924edc44bee90456700c6

                                      SHA256

                                      c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e

                                      SHA512

                                      12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      3a09f853479af373691d131247040276

                                      SHA1

                                      1b6f098e04da87e9cf2d3284943ec2144f36ac04

                                      SHA256

                                      a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f

                                      SHA512

                                      341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

                                      Filesize

                                      23KB

                                      MD5

                                      e1c71f7c04be834f5587230db2ad24b3

                                      SHA1

                                      f3bab9cb99d9f343bf7ed3981aaa7450515d2424

                                      SHA256

                                      9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899

                                      SHA512

                                      205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      240B

                                      MD5

                                      126ce6a7f8ba24ffd1812a0b9e954e29

                                      SHA1

                                      e3995528b09574ddf0449f8effa4d84da8569807

                                      SHA256

                                      16ef221d4e0f38ef16e353294e06081a1a2a03df7f0d47a9fec024282745b359

                                      SHA512

                                      0e32ce5084547078f41194133aa61f103aa3430b4322e802010ca6d19edc030221c91b6eba8882e6d43304cbd7f9284c89a6a081499d47696a9b4c4fef281ca1

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      264B

                                      MD5

                                      10319cf5383b3825144ea007d308a8a6

                                      SHA1

                                      9abfa1c4c1de6349f1298632fc18cdefb2afe1ed

                                      SHA256

                                      b4a0267121d67f4f4a7393e87c44c2a92a61877e887fd332353e6c4f21ab9748

                                      SHA512

                                      5fb3b430794747248ac167aeaab6318f7150547befb92cd52e9b3aed9501cdca85a3d4ec6d5cfbec364b3271501356225b03eea2b644fd0832b1506d66191268

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      216B

                                      MD5

                                      d8fb3cd1be160c68f217fddc4c199f78

                                      SHA1

                                      f3959d301b6cec7061ced5dcec09e8c9d28cb152

                                      SHA256

                                      9dc368bc4de166c0deb040f872b627284784f6ecd29d52761a0036f5d5cc8217

                                      SHA512

                                      b32a19f43546893b9381cfb48a6a3c3ea8be4049efdb4ee53c469a8e3df145dcbb6e2d2406b3f9dd82d029715c4dc7f55181e68888298194c50d51f86e133c6e

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      4KB

                                      MD5

                                      6faa8e921704caf1c26620d8f022f383

                                      SHA1

                                      74bbe21a09c3b29ed680ba209458f108499a78ba

                                      SHA256

                                      30dec25cdef059b85c004473ac70a88e8ee18c95c7aaba9a47149376185cdb26

                                      SHA512

                                      83c841bf1b88fd6132df86ab12908d06c37dcb70f8c39bbff773e72bd6e0003da32edc4649ce5bfe6872de9da280b63e0820f3f23a42e8f7ef3f392b2b3e65b1

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      c97a25813e957f9327979de5e6772dfe

                                      SHA1

                                      793698a305cf6d87de560aa5d32eafbd903d698f

                                      SHA256

                                      2189a6f85daa3b906960dbca0111f25ca5062d09008745f33c196d094ec736c3

                                      SHA512

                                      f6eeeaa54a69663099b7f10a33489533aa5e3631a9f8c90084167d72e924dc994fa438a8618763216e9944f0deb3bae3bb0b9d6b68d22f502103644f59494361

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      8KB

                                      MD5

                                      0bb0a811347f88922ce4b4bb7d1040dd

                                      SHA1

                                      7d472ca06df7678ff437d0b858d05884601f9d94

                                      SHA256

                                      550f1b35fc1c0c0c02986f768a26453a13156836809a7bde7594035d45809642

                                      SHA512

                                      d59122b8db10de6409d6709c23459109bb3d1dd04b9c1ba8522acf92e1f28a2570714515553fa305bcade81d0ef3c6dfb9daaa31d146ec6c1972a3985a332346

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      8KB

                                      MD5

                                      4ad9b38542c5861e943ab76306c0b028

                                      SHA1

                                      b95ef801da8939c242a3b5ef1e52a5b5379e4c68

                                      SHA256

                                      6eb0b82e059284138b4a6d1e00ba385539756129c5766ba8266f3212bb2305d5

                                      SHA512

                                      903e3c273e6c3b3ee1dcd9fd377c12659bae0296dcc1c70f4c9545b3451c86f5a655bf1ca8dbae925165770c216db5665523d5a08848b1bff46718385f396fa7

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      8KB

                                      MD5

                                      a81f06ba6b8b6eaa6dc55331831eea76

                                      SHA1

                                      7902f0175abd866b7b5f935a9ec98e6d0eebcf52

                                      SHA256

                                      a601eb0070dee0076f97e46a6c801b45d0eb91d0dcf1a53962cf78a0b4a6703e

                                      SHA512

                                      1d97a9a45830a5b65c09eac3de626f218a2f81b23327bbd6dcd39e09a0c98decbb895713111670e477422f7a6869996c2b9d4738801c2e2dccd92914a6731729

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      6752a1d65b201c13b62ea44016eb221f

                                      SHA1

                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                      SHA256

                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                      SHA512

                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      165f481115b046fdf8ceea17232c0e38

                                      SHA1

                                      cc955ab76534242c0b156e421d0741d7bad3260f

                                      SHA256

                                      6ae3858c4db3444875c0677cabca8eff1ff3a8e2d8cac9d649444fc512ba239b

                                      SHA512

                                      f87cf910133098921f9bdd9517129ade3c1290de3a4ea83d18b3d0e4d9d3336a17dff59aaf59fe86f214645b0c62321bd7d20946de323c9d24a9dd7e5bef1930