Analysis

  • max time kernel
    100s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/06/2024, 05:05

General

  • Target

    a3ea2c3375eab736ab7e8bfa9b63fc31_JaffaCakes118.html

  • Size

    69KB

  • MD5

    a3ea2c3375eab736ab7e8bfa9b63fc31

  • SHA1

    3b95674ab6aadfd60f45d5b9508b97cdb63bd62e

  • SHA256

    d60f1a79b3f11847e15de4e2402463932a99543c93a970e829dfd03487298f72

  • SHA512

    871007736f184521996b8d84b8e2ee35af0dfe08f5e449b8237e0c77f32094053787330abaeca9a64dbc5c4497dca0e246302f20701d361644ec655df44e09d7

  • SSDEEP

    1536:eIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZOzD:NOzF/OIEFEQbYmISPA

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3ea2c3375eab736ab7e8bfa9b63fc31_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4956
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9db446f8,0x7ffa9db44708,0x7ffa9db44718
      2⤵
        PID:772
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,16581347143649863217,3678086734870201553,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
        2⤵
          PID:1116
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,16581347143649863217,3678086734870201553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1540
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,16581347143649863217,3678086734870201553,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2468 /prefetch:8
          2⤵
            PID:220
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16581347143649863217,3678086734870201553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
            2⤵
              PID:3020
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16581347143649863217,3678086734870201553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
              2⤵
                PID:1008
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16581347143649863217,3678086734870201553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
                2⤵
                  PID:4184
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16581347143649863217,3678086734870201553,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
                  2⤵
                    PID:4352
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,16581347143649863217,3678086734870201553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
                    2⤵
                      PID:4656
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,16581347143649863217,3678086734870201553,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:548
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16581347143649863217,3678086734870201553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
                      2⤵
                        PID:4468
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16581347143649863217,3678086734870201553,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2292 /prefetch:1
                        2⤵
                          PID:4212
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16581347143649863217,3678086734870201553,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1
                          2⤵
                            PID:4460
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16581347143649863217,3678086734870201553,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2080 /prefetch:1
                            2⤵
                              PID:436
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:3172
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:4252

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\340251b8-0dd0-450a-95b5-8f0b7d1237f7.tmp

                                Filesize

                                12KB

                                MD5

                                33bd66df1c0ad88afc565c808113a55c

                                SHA1

                                fa52b4e7de3004f885599d6a549176c0f698d2c5

                                SHA256

                                885fca6a0e2485e88e7a7d9f55fb2961940e8d2cc014e168572e5e3dbc3c7928

                                SHA512

                                f020d0167d95d213cbb8fc4c42a42f91a1c90d7623873e5507edc3ad5992d6b6b1de219f2a78176698e2d2e8a0bb65ff14ba7ad1ab11256fbd09ddd0608680ef

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                81e892ca5c5683efdf9135fe0f2adb15

                                SHA1

                                39159b30226d98a465ece1da28dc87088b20ecad

                                SHA256

                                830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

                                SHA512

                                c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                56067634f68231081c4bd5bdbfcc202f

                                SHA1

                                5582776da6ffc75bb0973840fc3d15598bc09eb1

                                SHA256

                                8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

                                SHA512

                                c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6559e571-e723-4d41-b0f4-62d7f160e7ae.tmp

                                Filesize

                                6KB

                                MD5

                                192fa574ffc2c6b444ba8cb714c833d4

                                SHA1

                                78a81b6fbdca7661068898bc916ffc32a49a8fb6

                                SHA256

                                e65697185836af1078a4a199460376577033c3f40606fc5aff38e6525f0f8923

                                SHA512

                                837c18022205b0993d9c0eb103c33820f4a0739182a4ed7c56bc042ad788f9e6f06ac73c676c49ed21d12b4f322ca735d2a59a43aa1942c3663ba48346113e39

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                Filesize

                                308B

                                MD5

                                7d562803a44843ade775cbf9802b9fe2

                                SHA1

                                cc4cbc0bab1b7999b0defcdc116c3c99c4ae70a2

                                SHA256

                                1f51695a55975399c7496d079ed4d1cf8223ec1833bf90e4890f2b47e982a8ad

                                SHA512

                                20e8666971e3faf8745749cf7ce1d68b43809ceaba16f722a01795b33b1066c48ae733eec6bfc4e8173fc82ead57f512bb2ad52cd5847983f82e9697f8a93085

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                3ad03bf8f272ee140674819a75f4c1b9

                                SHA1

                                140f6a19b68977f111c5d99680756cfb16a8a124

                                SHA256

                                5b5f16312469bb1eefc80ef6ece2ca5b4e1f01afda132499691356d63e9f6882

                                SHA512

                                05f00753f62c19d8233a57ae0060d6501e1182a4f35561d29b0f144ca2c717a976dbca8d8e59bd536642883ccf89e63581ed83e14c63e43dd47f7f13d428dbb0

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                947fcdbf37439c3ad3722991402f7471

                                SHA1

                                22547acc7e5ee30ce18db3ab3003f1add3b3ba48

                                SHA256

                                d46b8297941dec4d97941d41470df9ceda3f5ed12827d1647153a6e4ce61a648

                                SHA512

                                855e0bda747b2acea1f575acfa86bddd7d66b73e08e189d9a7d0afa6e9d4735e495f990e769e8c719ceb0d967e17d5c341c3ee49782e7fd451364ddb191bfc4b

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                6fd22e22bb4cbd952a6590ed1069eb67

                                SHA1

                                734f7534080740edf6dc5c388de1244897600358

                                SHA256

                                045aa4ed9d0e4937a84878f463357add9eaa03ac354cea42a869818fa2d80b4f

                                SHA512

                                09c6a37897df4dc62c06b9324424d568bbd95edb3aa9c200609ec4b64c5f4c69d719259b00f3c16d4ff2118543b9e45f055b9c48fec405367da5436a7d7c855a

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                Filesize

                                16B

                                MD5

                                6752a1d65b201c13b62ea44016eb221f

                                SHA1

                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                SHA256

                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                SHA512

                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                Filesize

                                11KB

                                MD5

                                547f0807f6a769d2ef30b82ed750e78d

                                SHA1

                                a982b301f632c1be641626e8921e8635957d3af7

                                SHA256

                                20f5113c55ffc48e7ab56b79ca2440d5b2482ab16c7ecaba728b06c3bd0fc542

                                SHA512

                                3efe1a6b3db3cb1242ffa6799713a6cf227ad41818ce87c123915be3b82e181fa2f2d6f21206708b2b7926c91420ab188c5447f1bd2c7a28fd45944e4ae0a80b