Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 09:40

General

  • Target

    a4e4d391b70a09990df95de9d6edb581_JaffaCakes118.html

  • Size

    57KB

  • MD5

    a4e4d391b70a09990df95de9d6edb581

  • SHA1

    0a784c01ea81a953843c67ef938c3eec1bf5a040

  • SHA256

    a42b7c4be15ef2b86652b0ac8e4c17feb95e9641132dcab71f127d4dad305ba9

  • SHA512

    13e384ee8fa123a49fb55e149f8ecf6f427e083d51a726d1f15ee6eea30edf07fa14f60862c81d3b0226e5e0264f5487a2cff05fd54506cd70ad5d805430b091

  • SSDEEP

    1536:RngGywopB2Ht+JFs8C+xZ4yZTnnxzkiZ6ohLhT:iGyXpBzFs8NxyyZTn1kiAohLhT

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a4e4d391b70a09990df95de9d6edb581_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffc604c46f8,0x7ffc604c4708,0x7ffc604c4718
      2⤵
        PID:4736
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,4814114606824710135,18332090127673238233,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
        2⤵
          PID:1652
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,4814114606824710135,18332090127673238233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3380
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,4814114606824710135,18332090127673238233,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
          2⤵
            PID:4748
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4814114606824710135,18332090127673238233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
            2⤵
              PID:5112
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4814114606824710135,18332090127673238233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
              2⤵
                PID:4580
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4814114606824710135,18332090127673238233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
                2⤵
                  PID:3192
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4814114606824710135,18332090127673238233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
                  2⤵
                    PID:4076
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4814114606824710135,18332090127673238233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
                    2⤵
                      PID:3224
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4814114606824710135,18332090127673238233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:1
                      2⤵
                        PID:448
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4814114606824710135,18332090127673238233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3512 /prefetch:8
                        2⤵
                          PID:1148
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4814114606824710135,18332090127673238233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3512 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3520
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4814114606824710135,18332090127673238233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
                          2⤵
                            PID:4360
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4814114606824710135,18332090127673238233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
                            2⤵
                              PID:2276
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4814114606824710135,18332090127673238233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
                              2⤵
                                PID:4080
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4814114606824710135,18332090127673238233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
                                2⤵
                                  PID:3384
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,4814114606824710135,18332090127673238233,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:2
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4012
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:3880
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:3000

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    c5abc082d9d9307e797b7e89a2f755f4

                                    SHA1

                                    54c442690a8727f1d3453b6452198d3ec4ec13df

                                    SHA256

                                    a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

                                    SHA512

                                    ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    b4a74bc775caf3de7fc9cde3c30ce482

                                    SHA1

                                    c6ed3161390e5493f71182a6cb98d51c9063775d

                                    SHA256

                                    dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

                                    SHA512

                                    55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

                                    Filesize

                                    40KB

                                    MD5

                                    aa12ea792026e66caab5841d4d0b9bab

                                    SHA1

                                    47beeba1239050999e8c98ded40f02ce82a78d3f

                                    SHA256

                                    65fe153a832452e97f5d484440a7047e314d3a83cb61ad2508fed48a820e1de1

                                    SHA512

                                    0b2b1bb8851c60c9d4ab1d039b990a4de5799c97c50b45f64e36a21849c14e785f69196f674ac225b1419d7f501338054074cab6203d041361a4fa1ed8802b27

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    240B

                                    MD5

                                    3fdefe9fa48159391987eda35d18306d

                                    SHA1

                                    8e299ad6bc0ddf5b87b466b212164abd196b754d

                                    SHA256

                                    9d32809955426b1e0923c59db5a4873762d5dc57c5876510df79fc4a6ce9fb01

                                    SHA512

                                    ff344516b3d02a03563af309634bca0b010ef23e039790935d37966b5e2f658e71141ec6eb584b1620325c35dbdb58f4f8ee0dae83324f380f89ddf649193b84

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    144B

                                    MD5

                                    6f7755da5ff216b4407becd457c87d23

                                    SHA1

                                    22eafa81bdcb330c0c378e4be8dd21019426f01d

                                    SHA256

                                    a1b12624f6ebbb5f369b4ac18f12866eebf7f8394430fe5651a04e330fce2c11

                                    SHA512

                                    9906e1fd9f518c60bddb66dcdf7f0c1eb036fd4864810da4a190727ee266b0f004799a999da9c7222c0008f84acfbad871b8ca387a903af5192ee4708c3c1470

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                    Filesize

                                    3KB

                                    MD5

                                    5888720a18fd20bc1c413e40afd36c8e

                                    SHA1

                                    9a23bf607a6088e4202191c78af85f06cc311cdf

                                    SHA256

                                    b6197b0eee521f6c0deaf524728d4affab6b57a0a36dc2d7dffc4012c6b3689c

                                    SHA512

                                    d1ce9dae39433e9dcfaeba38004c953f6ef6b4d9e6f7a242a36038731e8bc4ff28c28fae5f49953cbae7085d610dbb0aed800724b86b489d14d31739777e75d9

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    cd95107c91a85410a6f1c76361a1a6fa

                                    SHA1

                                    d6defa557ab1084514b97d2e526470216c96bb20

                                    SHA256

                                    35fd817c3b33dbc3cc2601a4ea141485170ebfd56218e185e050c6c9c72b0421

                                    SHA512

                                    b0d9a5e408048839529f999527bf15869a9c402251d8d16be8a0f6efa8280d04ae1c883c035cba6517804223a92a30454138ae35973639188b172ae184a297eb

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    7KB

                                    MD5

                                    373ec42bd6a55ce39985d4c866d50185

                                    SHA1

                                    062ed745259eef49578f219a345a2ad01b59013a

                                    SHA256

                                    7d4c58a6193f8e9d4c6224e10ad32606d63900ea40cb55071c22e9eec8521efc

                                    SHA512

                                    fafccdee513fd3d3aaad2cb1e6806358e61be9e9415d2d43f537778227b03b366bcbd2abee3000d0792c12332f3b61d8b1ab5125198209c17472739f8bf99e75

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    8KB

                                    MD5

                                    4cce9a3e5c95b449208ee69e1e1557e7

                                    SHA1

                                    ab3a448d88ba0e2476c060af277106f7aa404add

                                    SHA256

                                    52dfa0884f734967494ea656977a77f766753930b9994e8903da477731a6d429

                                    SHA512

                                    4159cde709a1532569121dd9bdf1a145bc8b9be365c41651ff6ea38b89be8601bec7d6e9ef32c0dec38737423846829983c3578b0f94a32f3f2b20ca8ebed99d

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                    Filesize

                                    873B

                                    MD5

                                    9834654d3e80646cf546d6d59e460ec4

                                    SHA1

                                    3092e194e0b835bb3a472c83d277296fa58e96b2

                                    SHA256

                                    b7849aef9c5b87f18750d9e90f9929d06ca7504f3da5b68139a0e35108c1d034

                                    SHA512

                                    abdfc0b92035e053a4dac59ba1c8f920843b2ad6df8d5ebc97eef6d8a93dbb433558068c457eb68dadd8d25f1febf5a4fa68abf758627b79d687a5718b4b8976

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e493.TMP

                                    Filesize

                                    538B

                                    MD5

                                    8cc5e4a93713fd7be1ff1956634e1c94

                                    SHA1

                                    3e06ab6f375e8e911b3eeedba3a6c5c7c47a3d79

                                    SHA256

                                    5c0ec0e72ac7257f05d4a4d7a662cbb6793bc39959067edb107f27a41077a171

                                    SHA512

                                    3e055412b4b518d306838b4aec5a0e3ef464a384ebe7aabcc9d271df7e9802a58747b69d9a872c94d2c89dfd8ebeab3d5c4f224dbb00a918db671241c784d929

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                    Filesize

                                    16B

                                    MD5

                                    46295cac801e5d4857d09837238a6394

                                    SHA1

                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                    SHA256

                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                    SHA512

                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                    Filesize

                                    16B

                                    MD5

                                    206702161f94c5cd39fadd03f4014d98

                                    SHA1

                                    bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                    SHA256

                                    1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                    SHA512

                                    0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    11KB

                                    MD5

                                    9f305bd031d73a4fd61b6ed84a5ecc13

                                    SHA1

                                    e507bfe8d41f84f8f410472ce4c0256fef214957

                                    SHA256

                                    f9fa931a596fe4660b619cdfb8562e1b5b61bda48a1179a24570a43cdc37830d

                                    SHA512

                                    3c00687ba1f27abecdb1acbfe1468b9db661216e19eaa94454daed49e1a800eea10fc72c5122ff7507fac96a789e84ea245fdb78b485713c53ec2739ddd1c1d5