Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/06/2024, 05:07

General

  • Target

    a3eb2d8a8c60b41a0fa772835dd57796_JaffaCakes118.html

  • Size

    18KB

  • MD5

    a3eb2d8a8c60b41a0fa772835dd57796

  • SHA1

    42d89c0d775577b44178aa3e825a6eb9d4938a00

  • SHA256

    fb3392f6df3122d060205badd8360138d38d9e5183369a0e39c0e459a106bb95

  • SHA512

    afe68984a802e2aa7d1d8be6bac9a91eef3fb53020b5660799b3c55f22e7ae171a947f81e19d72bae0a76e517f2c23e02338d0053e5e0de10810391d253ab257

  • SSDEEP

    192:SIM3t0I5fo9cKivXQWxZxdkVSoAI84MzUnjBhQq82qDB8:SIMd0I5nvHhsvQpxDB8

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3eb2d8a8c60b41a0fa772835dd57796_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4628
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff94a3546f8,0x7ff94a354708,0x7ff94a354718
      2⤵
        PID:2456
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,1540606653997564044,4669152885977419604,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
        2⤵
          PID:3132
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,1540606653997564044,4669152885977419604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1980 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2920
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,1540606653997564044,4669152885977419604,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
          2⤵
            PID:4676
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1540606653997564044,4669152885977419604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
            2⤵
              PID:4172
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1540606653997564044,4669152885977419604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
              2⤵
                PID:5004
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,1540606653997564044,4669152885977419604,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3024 /prefetch:2
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:624
            • C:\Windows\System32\CompPkgSrv.exe
              C:\Windows\System32\CompPkgSrv.exe -Embedding
              1⤵
                PID:2812
              • C:\Windows\System32\CompPkgSrv.exe
                C:\Windows\System32\CompPkgSrv.exe -Embedding
                1⤵
                  PID:5084

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3c261215-ee45-4f98-8b8c-fb1b3976d89f.tmp

                  Filesize

                  11KB

                  MD5

                  e773b9a2febd58e69f9b2eb4f22ebf0f

                  SHA1

                  dea6f92c558518c5358055a4d8273f227b75dfd0

                  SHA256

                  20cabd9cb6837718392c7c8c3051cdf0bfb00190e54f8b2982833875d924c452

                  SHA512

                  c863556f5119b56f6f2a5b780274851a7d8b77113feb36644a4584a9c578168cf7f83b3de4bcaaf6f17a719293b90b6b371b08a977094f8c3161fb11d78883b9

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                  Filesize

                  152B

                  MD5

                  dabfafd78687947a9de64dd5b776d25f

                  SHA1

                  16084c74980dbad713f9d332091985808b436dea

                  SHA256

                  c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

                  SHA512

                  dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                  Filesize

                  152B

                  MD5

                  c39b3aa574c0c938c80eb263bb450311

                  SHA1

                  f4d11275b63f4f906be7a55ec6ca050c62c18c88

                  SHA256

                  66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

                  SHA512

                  eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                  Filesize

                  6KB

                  MD5

                  92afc00e773a2c2b590cb6db61de4000

                  SHA1

                  f297e32e303ea805e261b98f2ae1e6085c33e4e9

                  SHA256

                  56097c9f4bce54cf8e36676c162456a8ad1aad221d828c925319de5e09d8aefc

                  SHA512

                  cf3c006793d81c99e480f7dd814e79877278feb20a24c4b5a16f53473892ab86679d0ac99991fa576ea777be561a3646b38ba8a740d6323b3a0ebdaabdf53621

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                  Filesize

                  6KB

                  MD5

                  7de0f0717b30d13893f6482030e2717f

                  SHA1

                  d028bc164be6957d82bbf10da1f809137f8f5661

                  SHA256

                  c041ad7464b42dbc75710cad41390769bc6ed4220276ad39bf081d65e4ef5959

                  SHA512

                  97810398de85df71db3d4b646df6b5d610ffcfc3e4e3ddaa717fc7d1818cc057f0a1aadbdde4ed6a78e27524911eb1ada8b1d90c1cfa1eb752fb18645c06de60

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                  Filesize

                  6KB

                  MD5

                  6c462fdab83c4a1d4fca5a444bdf40c0

                  SHA1

                  605cdf4cc54780a157ba8668279ad91d743b6a09

                  SHA256

                  c5d0a79ba09006bfc7c59ffee96ec90f70d04aa00c518111886edf3a306f22ac

                  SHA512

                  731d220e86b72592b068fd1338e0521029f90b4596fcae0fc76cbd898d39336cd9675c366e1b11a07463ef39215cba3cb5c9f64e73033eb8c007e559d120187d