Analysis

  • max time kernel
    145s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-11-2024 05:05

General

  • Target

    b4e9a031716b1cd3ab7b0d4fc575cc29_JaffaCakes118.html

  • Size

    113KB

  • MD5

    b4e9a031716b1cd3ab7b0d4fc575cc29

  • SHA1

    b80b1cb9eb9aab0931e5c13dc180ecdd3eaa5353

  • SHA256

    7f2b29a529583b7587d0bf6cf16ebaacff9bc295cddfa3241e3f7e91bb9cf789

  • SHA512

    918b2e1753ec8aa2957339c7ddb1a29668508f53bd6bd8befefb84095fa249a41e84127380b362fa18a47300faf7db96e8eb02d9257c1bbeb709610f16d723ac

  • SSDEEP

    1536:nyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsQSz:nyfkMY+BES09JXAnyrZalI+YQ

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\b4e9a031716b1cd3ab7b0d4fc575cc29_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff003946f8,0x7fff00394708,0x7fff00394718
      2⤵
        PID:2328
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,11601701959323961057,16692231116881078198,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
        2⤵
          PID:2868
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,11601701959323961057,16692231116881078198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:936
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,11601701959323961057,16692231116881078198,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
          2⤵
            PID:4876
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,11601701959323961057,16692231116881078198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
            2⤵
              PID:1452
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,11601701959323961057,16692231116881078198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
              2⤵
                PID:3088
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,11601701959323961057,16692231116881078198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:8
                2⤵
                  PID:3952
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,11601701959323961057,16692231116881078198,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5100
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,11601701959323961057,16692231116881078198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
                  2⤵
                    PID:4044
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,11601701959323961057,16692231116881078198,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
                    2⤵
                      PID:4948
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,11601701959323961057,16692231116881078198,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
                      2⤵
                        PID:3256
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,11601701959323961057,16692231116881078198,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
                        2⤵
                          PID:4884
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,11601701959323961057,16692231116881078198,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2628 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4200
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:4888
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:4616

                          Network

                          • flag-us
                            DNS
                            720.dommohouse.com
                            msedge.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            720.dommohouse.com
                            IN A
                            Response
                          • flag-us
                            DNS
                            720.dommohouse.com
                            msedge.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            720.dommohouse.com
                            IN A
                            Response
                          • flag-us
                            DNS
                            res.wx.qq.com
                            msedge.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            res.wx.qq.com
                            IN A
                            Response
                            res.wx.qq.com
                            IN CNAME
                            reswx.tc.qq.com
                            reswx.tc.qq.com
                            IN CNAME
                            jxt2rgi0.ovslegodl.sched.ovscdns.com
                            jxt2rgi0.ovslegodl.sched.ovscdns.com
                            IN A
                            43.132.64.188
                            jxt2rgi0.ovslegodl.sched.ovscdns.com
                            IN A
                            43.132.64.190
                          • flag-us
                            DNS
                            75.159.190.20.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            75.159.190.20.in-addr.arpa
                            IN PTR
                            Response
                          • flag-us
                            DNS
                            149.220.183.52.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            149.220.183.52.in-addr.arpa
                            IN PTR
                            Response
                          • flag-us
                            DNS
                            172.210.232.199.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            172.210.232.199.in-addr.arpa
                            IN PTR
                            Response
                          • flag-gb
                            GET
                            http://res.wx.qq.com/open/js/jweixin-1.0.0.js
                            msedge.exe
                            Remote address:
                            43.132.64.188:80
                            Request
                            GET /open/js/jweixin-1.0.0.js HTTP/1.1
                            Host: res.wx.qq.com
                            Connection: keep-alive
                            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
                            DNT: 1
                            Accept: */*
                            Accept-Encoding: gzip, deflate
                            Accept-Language: en-US,en;q=0.9
                            Response
                            HTTP/1.1 200 OK
                            Last-Modified: Fri, 09 Aug 2024 21:20:00 GMT
                            Server: nginx/1.8.1
                            Date: Fri, 09 Aug 2024 21:26:36 GMT
                            Expires: Sat, 09 Aug 2025 21:26:36 GMT
                            Content-Type: application/x-javascript
                            X-Verify-Code: 4c4c43d9ebd51c499d14288680c13045
                            Strict-Transport-Security: max-age=3600
                            X-Daa-Tunnel: hop_count=1
                            Cache-Control: must-revalidate, max-age=31536000
                            Content-Length: 9442
                            Accept-Ranges: bytes
                            X-NWS-LOG-UUID: 9684643552256037193
                            Connection: keep-alive
                            X-Cache-Lookup: Cache Hit
                            Access-Control-Allow-Origin: *
                            Vary: Origin
                          • flag-us
                            DNS
                            95.221.229.192.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            95.221.229.192.in-addr.arpa
                            IN PTR
                            Response
                          • flag-us
                            DNS
                            188.64.132.43.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            188.64.132.43.in-addr.arpa
                            IN PTR
                            Response
                          • flag-us
                            DNS
                            133.211.185.52.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            133.211.185.52.in-addr.arpa
                            IN PTR
                            Response
                          • flag-us
                            DNS
                            50.23.12.20.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            50.23.12.20.in-addr.arpa
                            IN PTR
                            Response
                          • flag-us
                            DNS
                            206.23.85.13.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            206.23.85.13.in-addr.arpa
                            IN PTR
                            Response
                          • flag-us
                            DNS
                            172.214.232.199.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            172.214.232.199.in-addr.arpa
                            IN PTR
                            Response
                          • flag-us
                            DNS
                            43.229.111.52.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            43.229.111.52.in-addr.arpa
                            IN PTR
                            Response
                          • 43.132.64.188:80
                            http://res.wx.qq.com/open/js/jweixin-1.0.0.js
                            http
                            msedge.exe
                            830 B
                            10.6kB
                            11
                            14

                            HTTP Request

                            GET http://res.wx.qq.com/open/js/jweixin-1.0.0.js

                            HTTP Response

                            200
                          • 8.8.8.8:53
                            720.dommohouse.com
                            dns
                            msedge.exe
                            128 B
                            230 B
                            2
                            2

                            DNS Request

                            720.dommohouse.com

                            DNS Request

                            720.dommohouse.com

                          • 8.8.8.8:53
                            res.wx.qq.com
                            dns
                            msedge.exe
                            59 B
                            161 B
                            1
                            1

                            DNS Request

                            res.wx.qq.com

                            DNS Response

                            43.132.64.188
                            43.132.64.190

                          • 8.8.8.8:53
                            75.159.190.20.in-addr.arpa
                            dns
                            72 B
                            158 B
                            1
                            1

                            DNS Request

                            75.159.190.20.in-addr.arpa

                          • 8.8.8.8:53
                            149.220.183.52.in-addr.arpa
                            dns
                            73 B
                            147 B
                            1
                            1

                            DNS Request

                            149.220.183.52.in-addr.arpa

                          • 8.8.8.8:53
                            172.210.232.199.in-addr.arpa
                            dns
                            74 B
                            128 B
                            1
                            1

                            DNS Request

                            172.210.232.199.in-addr.arpa

                          • 8.8.8.8:53
                            95.221.229.192.in-addr.arpa
                            dns
                            73 B
                            144 B
                            1
                            1

                            DNS Request

                            95.221.229.192.in-addr.arpa

                          • 8.8.8.8:53
                            188.64.132.43.in-addr.arpa
                            dns
                            72 B
                            129 B
                            1
                            1

                            DNS Request

                            188.64.132.43.in-addr.arpa

                          • 224.0.0.251:5353
                            562 B
                            9
                          • 8.8.8.8:53
                            133.211.185.52.in-addr.arpa
                            dns
                            73 B
                            147 B
                            1
                            1

                            DNS Request

                            133.211.185.52.in-addr.arpa

                          • 8.8.8.8:53
                            50.23.12.20.in-addr.arpa
                            dns
                            70 B
                            156 B
                            1
                            1

                            DNS Request

                            50.23.12.20.in-addr.arpa

                          • 8.8.8.8:53
                            206.23.85.13.in-addr.arpa
                            dns
                            71 B
                            145 B
                            1
                            1

                            DNS Request

                            206.23.85.13.in-addr.arpa

                          • 8.8.8.8:53
                            172.214.232.199.in-addr.arpa
                            dns
                            74 B
                            128 B
                            1
                            1

                            DNS Request

                            172.214.232.199.in-addr.arpa

                          • 8.8.8.8:53
                            43.229.111.52.in-addr.arpa
                            dns
                            72 B
                            158 B
                            1
                            1

                            DNS Request

                            43.229.111.52.in-addr.arpa

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            d7cb450b1315c63b1d5d89d98ba22da5

                            SHA1

                            694005cd9e1a4c54e0b83d0598a8a0c089df1556

                            SHA256

                            38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

                            SHA512

                            df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            37f660dd4b6ddf23bc37f5c823d1c33a

                            SHA1

                            1c35538aa307a3e09d15519df6ace99674ae428b

                            SHA256

                            4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

                            SHA512

                            807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            4791aa2c18674e5aac4daa32704d4c76

                            SHA1

                            cf57c897792fe2089342ef21a61865c0cd271229

                            SHA256

                            7ce675fa2c4289fae40624899cb68ce470689e4ecc0276ca718bb21f0664897e

                            SHA512

                            2da3c5e67bd59a80e8387044e4c1f8f1c5347f1b26e3bec56601cbcce0d208c60d1e3199cbe8ba1d25b14b8e35dd65ed73613c256b35fd40eda944c66f324d95

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            c4cee29e2eb3a74d34e34ea2f59bf6fe

                            SHA1

                            f34472ccef87a8a90c58adb637e9909652ad3ea5

                            SHA256

                            a58eacc0b2d1b5a9056ae9b3f505a5c0e51eb7edf09e202ce423e3da231d3b9e

                            SHA512

                            4ac4e18c5f831b8c5cb4da3ea722ec543dbee60ebb75c435d90125b2397812a80dc61ec2cccb95711432c91958c01ee91e28fc6d042c35216525bad1d1552f93

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            6752a1d65b201c13b62ea44016eb221f

                            SHA1

                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                            SHA256

                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                            SHA512

                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            10KB

                            MD5

                            5f09dd239499b9c8d086a59f1c11b456

                            SHA1

                            ed8034c524481c1523bbcad5ca0262ac3a27d20d

                            SHA256

                            f6f75066ef5e568dd55133c6e21273d9c5f582591216104ed74add60058a59f6

                            SHA512

                            21e2bf0a55fd0a3385aa313e680ba03c94a12050c5ffe2789cb4af3b5c401b7819782df470fa428c713996f1c5740b112ab267bc9a78404840b3b1dcd8c139a3

                          We care about your privacy.

                          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.