Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 07:33

General

  • Target

    a4716f952b5e1580d7f60e64ebaf0ee4_JaffaCakes118.html

  • Size

    137KB

  • MD5

    a4716f952b5e1580d7f60e64ebaf0ee4

  • SHA1

    dc069605578845a68ec92618ddcd9d35d74dcf86

  • SHA256

    8295b32b5129c22c34cb6514298240105a28aa55173ea62e04d97a28f46931c3

  • SHA512

    69371cf1a03db32003c6fdbe7af2f8fbae8ddc507f18da59c85830cd7cf70574dcb1b659426476a9edaf17709c30ded118ee50967b50d9d20db02c3e16dd5c46

  • SSDEEP

    3072:tT3IQz1uKecU/7NvO4ebe57hiZ7bYUeTbsPtQRqxmUqNbrZSZqC:C6z

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a4716f952b5e1580d7f60e64ebaf0ee4_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2312
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffabdd646f8,0x7ffabdd64708,0x7ffabdd64718
      2⤵
        PID:1888
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
        2⤵
          PID:1560
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2056
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
          2⤵
            PID:3208
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
            2⤵
              PID:3104
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
              2⤵
                PID:3468
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
                2⤵
                  PID:3704
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
                  2⤵
                    PID:4476
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
                    2⤵
                      PID:4660
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
                      2⤵
                        PID:2680
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
                        2⤵
                          PID:4084
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3744
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
                          2⤵
                            PID:3832
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
                            2⤵
                              PID:1000
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
                              2⤵
                                PID:5040
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
                                2⤵
                                  PID:4392
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,6066281401744458038,10500518433232717591,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1776
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:4132
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:856

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    dabfafd78687947a9de64dd5b776d25f

                                    SHA1

                                    16084c74980dbad713f9d332091985808b436dea

                                    SHA256

                                    c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

                                    SHA512

                                    dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    c39b3aa574c0c938c80eb263bb450311

                                    SHA1

                                    f4d11275b63f4f906be7a55ec6ca050c62c18c88

                                    SHA256

                                    66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

                                    SHA512

                                    eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    96B

                                    MD5

                                    317e13fa77aa3e3cfe8036e8e486c8b4

                                    SHA1

                                    421f228ba2ec46d2ba56361cb9964db0223a89c4

                                    SHA256

                                    e75402656ccb392f3a374d60bc5cf66b27d6d5c678d64a5fefa087983181f321

                                    SHA512

                                    cea4a07b0d6a5965829f4fffaea36e66a8e58d1d849e66321f3c23cc630d7c7c327741b8a700e89415d0c3311b9ddaa57068fe9d70d15557ad8e574736b41e3f

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    2KB

                                    MD5

                                    1577aeb8223b688aaf76e1498b380974

                                    SHA1

                                    2a0424c6d99cbbebd3926c2e0c197a4293064d63

                                    SHA256

                                    742dcc8aacbd768a544eb59f8e019b7919cee551ec6551199ee39f1d33a5b12a

                                    SHA512

                                    9c123e3eeebd8d790828aaa9bff2135104ddb92de21455dc89ef59a83ee89ab76ffbd1554f9364b36c5633bcf7e7390bf76466e6cd99bc6cd1f2a7544cb81fa9

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    99366f6e426a29d84e8914d53d553300

                                    SHA1

                                    a6f0b4c5bc569d1aae91510ee85ad0385df99f5f

                                    SHA256

                                    d552211d679713145b00983430bb218b95e86c8cb93f10315a61b06845ead3a5

                                    SHA512

                                    6ef976a49b3a1927c6bf3be5e5e18a2ef8bc776f556b7f0f3ac0566dfbe6849008430c9023488857ac72e38f6e79460a1c3e26a5aba0c4e4ede650e12bdbad7c

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    7KB

                                    MD5

                                    d22ece27aef364c926bd25e3d6d88e6f

                                    SHA1

                                    12bd926b8eb53932dd85eab3c554344b85d58ef4

                                    SHA256

                                    8d66b8523ba43d40a896b1011337c82aa62854e9d57b97bd4c9bc4773ace4b30

                                    SHA512

                                    492105c95084154b05a333bab113324adf58f1fcbb6f2a003b44f10d2fcc90d243def910e327c48b1db3ea7d8466f81287c00fa153b59fbfa4651cbaaaa31e47

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    7KB

                                    MD5

                                    02b5eacb0b06229d154a7602bc3cce9d

                                    SHA1

                                    48213ac896345bdcfc9d3a1bab8d3b4e7cbbe1f8

                                    SHA256

                                    e4c9482cbd148fe49e10bacebe73afcf519126e31803d7ffc388d73b4726d54b

                                    SHA512

                                    3035be9ad8f422f453ad144859b970dfe010e3a73ce30fb8ed1b68bf469706053928aa0633e1a29c613dd82b0fcc685e28a97de0dbeacbffbfa6ea700335c2a2

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                    Filesize

                                    705B

                                    MD5

                                    bd3a7820ad6b67e9fe2de9a9827f57f4

                                    SHA1

                                    9e71ab95e15beaee10dffe95a08169102ffbd74a

                                    SHA256

                                    2b5b3a23f40b43ff76e25dbcba06567341f028dacfec38a3bbefdfa28e5d6b67

                                    SHA512

                                    f0269c40753770a353d3eeea824fb5f6602ae97eed0c53787f9d69665a2eafbdce14a7841c61869dca2441c68a1afc561495d11243f35072934742f98eb8034f

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c505.TMP

                                    Filesize

                                    705B

                                    MD5

                                    a2c6c4a6db7c658a83f6e4d1e905dd34

                                    SHA1

                                    8f047a7949b4d38d38d096d8a703ee062259ad0a

                                    SHA256

                                    8b1da0988bc34e85d851130756e3382de46c9907ca9dd31a4f9185a8197ed328

                                    SHA512

                                    df6fbb2a371fd84abe5d82f0cdc260c261e5b5a705554a6fc4f7a2dd74ff5ac18fb1d36cce641c626a25bfbce1c5434ac33f3e5368866ad1bb4e42acfff57d13

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                    Filesize

                                    16B

                                    MD5

                                    6752a1d65b201c13b62ea44016eb221f

                                    SHA1

                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                    SHA256

                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                    SHA512

                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    11KB

                                    MD5

                                    9b63adaf5d944e06f10f75bd8aebbdab

                                    SHA1

                                    d77546ed8c0f5faaf958432b9f5d4d27baf2ccb1

                                    SHA256

                                    d61b89db28a7d33d35f78d44c75bbfd1d6dd0550f4e8c4ed2232ad8202b500df

                                    SHA512

                                    6659ee1c07a00061417913f98aab6b7ad49711304035bed19e2c4877178257db507da0ed17b9f73d38bff92eb590be6aed07916ab54e95dec13525845ce7ddef