Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 01:18

General

  • Target

    a35441be4f7e7c08d767c5320cefee75_JaffaCakes118.html

  • Size

    32KB

  • MD5

    a35441be4f7e7c08d767c5320cefee75

  • SHA1

    aca3d6b4346500378a2b2c81c46029406750a213

  • SHA256

    b02a6c2da9411d5fbf048c22fad0ac64e668d83823e65c94e0bfbab9777f2616

  • SHA512

    c79b1b468e91c4b4483cf5fe822d9f19bcdd8ffd503d9c74ef0019ab695a0ef084fcca8cd367d27bcbbfa90da40bb93cd3e444ec7a7768fcd156032618553de6

  • SSDEEP

    384:K1EyYgdxck4kpyP1OcC0LK/veujaVd4L5N60cQQuIfuBxkrazREqNKKX:K1vYgbtveitLC0cQQffuBxo6rrX

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a35441be4f7e7c08d767c5320cefee75_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2132
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7fff6fcb46f8,0x7fff6fcb4708,0x7fff6fcb4718
      2⤵
        PID:4628
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15144422646953895736,7143671103403874646,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
        2⤵
          PID:2968
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,15144422646953895736,7143671103403874646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4100
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,15144422646953895736,7143671103403874646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
          2⤵
            PID:3392
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15144422646953895736,7143671103403874646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
            2⤵
              PID:4884
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15144422646953895736,7143671103403874646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
              2⤵
                PID:4576
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15144422646953895736,7143671103403874646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
                2⤵
                  PID:1488
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15144422646953895736,7143671103403874646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
                  2⤵
                    PID:4624
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15144422646953895736,7143671103403874646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
                    2⤵
                      PID:3428
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2124,15144422646953895736,7143671103403874646,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=4820 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2748
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2124,15144422646953895736,7143671103403874646,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1788 /prefetch:8
                      2⤵
                        PID:2684
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2124,15144422646953895736,7143671103403874646,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5044 /prefetch:8
                        2⤵
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4140
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15144422646953895736,7143671103403874646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3024 /prefetch:1
                        2⤵
                          PID:5072
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,15144422646953895736,7143671103403874646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6856 /prefetch:8
                          2⤵
                            PID:3664
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,15144422646953895736,7143671103403874646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6856 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4840
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15144422646953895736,7143671103403874646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
                            2⤵
                              PID:1208
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15144422646953895736,7143671103403874646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
                              2⤵
                                PID:2560
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15144422646953895736,7143671103403874646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
                                2⤵
                                  PID:3560
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,15144422646953895736,7143671103403874646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
                                  2⤵
                                    PID:3324
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,15144422646953895736,7143671103403874646,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6676 /prefetch:2
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:1704
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:1548
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:4596

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      dabfafd78687947a9de64dd5b776d25f

                                      SHA1

                                      16084c74980dbad713f9d332091985808b436dea

                                      SHA256

                                      c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

                                      SHA512

                                      dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      c39b3aa574c0c938c80eb263bb450311

                                      SHA1

                                      f4d11275b63f4f906be7a55ec6ca050c62c18c88

                                      SHA256

                                      66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

                                      SHA512

                                      eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9ee6661e-b07e-4100-95bc-fd5db816dd84.tmp

                                      Filesize

                                      8KB

                                      MD5

                                      d457ffcfbc635d804433939c5cd12d55

                                      SHA1

                                      f6e2707144161c54980bdfe8bae03ea0ae528cfb

                                      SHA256

                                      da9ffb4f9fa28fb95afcc63332b287139535317c9852b8ac84f6c0af0f370644

                                      SHA512

                                      58954222aba392b34bcda25d95415baea5501d9aad90f82c1e0b9229564b5551bb51364ac81bcffb448ffa6150cc1bfdd555d75c97a06077de6eebca7713855c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

                                      Filesize

                                      23KB

                                      MD5

                                      e1c71f7c04be834f5587230db2ad24b3

                                      SHA1

                                      f3bab9cb99d9f343bf7ed3981aaa7450515d2424

                                      SHA256

                                      9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899

                                      SHA512

                                      205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      144B

                                      MD5

                                      e7cd7d0541a0ee897c5951bf4733b00a

                                      SHA1

                                      8eb1a160778368d82c1497317f0ffce2cdd67600

                                      SHA256

                                      2660dd63de706be8123abc1199b57126dec42c79ba712cf2eff8f128faedc1d4

                                      SHA512

                                      1d32de3e515b035f5fbb83203697a4654be546a3f3bdc3012082397a497ffa8ddf4cac04f8cac19e911eca3d2fd9c60612c80b875f5483089bcbd6c49f5eeff2

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      120B

                                      MD5

                                      649741d59f066dd601bbddb9eb9457c5

                                      SHA1

                                      883ee11aebd1d30cc2f313f6530e18351d8a922c

                                      SHA256

                                      a704375af17657c5cfca40ea73ad2d35bb0467b8503f96fb735078ed9f75d753

                                      SHA512

                                      699d1f96de7d9415047ec5c39ac688ebedd4d79a26f81f469b0916b278290c4b5202a7dd6f024807c847d8b5c820080fdfb8264262b653556e650de08e866d30

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      1KB

                                      MD5

                                      b553c62a6e780b17ec5449683748a7b4

                                      SHA1

                                      3dbba908a5429cbc8697274f9b2a7a768740f3bb

                                      SHA256

                                      6d9d798286a660a5ccbe9eace244cde23610903f2eb91801c3cb3693acb57f1a

                                      SHA512

                                      372bba2cf229d87abc1431f57b0a2b73cd9e0802f1651824fbbf8c96d41d9048878fa6c9667e1619ff1628da5760ab16160acda2ed0f33fc556240a97ed75392

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      1KB

                                      MD5

                                      aa8cd5bee75fe257c54d75cdbe92591f

                                      SHA1

                                      76059ff0e4722385eb09edfb5289e3ef84447715

                                      SHA256

                                      60bc396ebf98be4ae7bf238980fdd1f6429af8aad8e59a67ee4cdf282befba5b

                                      SHA512

                                      203c97fcdba15da00790f52cb79bb4c06a423bea7b2d079d2bc7de5aae292629dc9858d2a0c93261f3b7e85584fbe4331252b1ba3df533f28e51fbe6c83668f5

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      fb3eb413cea64613ff004a9cccb08e0d

                                      SHA1

                                      68f701becf5119521e8110654650651138dca3d2

                                      SHA256

                                      a340d8863fbcc7e2266c0aa467f08644dba3d5952495cad300a6ec988c31414f

                                      SHA512

                                      d54d7fd39a9c94f803baa04b81b6f69f9e127250ab28b2c24dfa737be7e68c6d2f9a6a8c7e8bc4c09ad294a8194f7c3f43d2f7549ed5bd17e4a66a6cad6eefca

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      d5ebd13cf8abcc9b44efe8c110a9039c

                                      SHA1

                                      38ed6cf8963f472aa2d5b0ffe34e516cf8d2551f

                                      SHA256

                                      1eabcd51bc38d8ff80d65be309541b5adfa8c240fbac5fcef2b5e3cbe70c0412

                                      SHA512

                                      8858d825fa42c3c6d43d4c62e00e0fc00ea74c3713736ae4860896807e45a5a33ed3e89cc91c4f2e05537adc095f870dc5827016dad2772b734c43ada20ade8f

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      6752a1d65b201c13b62ea44016eb221f

                                      SHA1

                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                      SHA256

                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                      SHA512

                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      7759325b96dfc6cd8323aa1a1e34705f

                                      SHA1

                                      0834783b75ff015917818f37d4809604f46e1b82

                                      SHA256

                                      cf6abb6f0531ecf700145541a298222c7afc427791854f5931809505a79cdf5a

                                      SHA512

                                      0787da6272500605a7fe4b77700d67bb31b85a7fe066893a1ef1ac4b9ba32899352967d9d38321af2ceeeb0d193368b1dde67502761d57cc1fc1539daef65d37