8cf8380512587fed02c8f5ad9bdaa5b62b5ba622643220cfe4a9cd66046f1c70

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2025 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_7ce8ed59157bb3eab8385c039ae98220.html
Size

155KB
MD5

7ce8ed59157bb3eab8385c039ae98220
SHA1

9db67f863e9d77a58f33039c1593eead6eaf6df5
SHA256

8cf8380512587fed02c8f5ad9bdaa5b62b5ba622643220cfe4a9cd66046f1c70
SHA512

ed2f6ab66b1a8bd058948eaee2486742a7b8502819cc6f55cb121084824d8d8648326c19c820fc0ce797364b83fe1a9284dd2e3deddcf135a6505b0415be2fd1
SSDEEP

1536:SGI2f2xyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9w:SI2xyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
4856	msedge.exe
4856	msedge.exe
3064	identity_helper.exe
3064	identity_helper.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe
4856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4856 wrote to memory of 4620	4856	msedge.exe	84
PID 4856 wrote to memory of 4620	4856	msedge.exe	84
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2648	4856	msedge.exe	85
PID 4856 wrote to memory of 2680	4856	msedge.exe	86
PID 4856 wrote to memory of 2680	4856	msedge.exe	86
PID 4856 wrote to memory of 2532	4856	msedge.exe	87
PID 4856 wrote to memory of 2532	4856	msedge.exe	87
PID 4856 wrote to memory of 2532	4856	msedge.exe	87
PID 4856 wrote to memory of 2532	4856	msedge.exe	87
PID 4856 wrote to memory of 2532	4856	msedge.exe	87
PID 4856 wrote to memory of 2532	4856	msedge.exe	87
PID 4856 wrote to memory of 2532	4856	msedge.exe	87
PID 4856 wrote to memory of 2532	4856	msedge.exe	87
PID 4856 wrote to memory of 2532	4856	msedge.exe	87
PID 4856 wrote to memory of 2532	4856	msedge.exe	87
PID 4856 wrote to memory of 2532	4856	msedge.exe	87
PID 4856 wrote to memory of 2532	4856	msedge.exe	87
PID 4856 wrote to memory of 2532	4856	msedge.exe	87
PID 4856 wrote to memory of 2532	4856	msedge.exe	87
PID 4856 wrote to memory of 2532	4856	msedge.exe	87
PID 4856 wrote to memory of 2532	4856	msedge.exe	87
PID 4856 wrote to memory of 2532	4856	msedge.exe	87
PID 4856 wrote to memory of 2532	4856	msedge.exe	87
PID 4856 wrote to memory of 2532	4856	msedge.exe	87
PID 4856 wrote to memory of 2532	4856	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7ce8ed59157bb3eab8385c039ae98220.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa461946f8,0x7ffa46194708,0x7ffa46194718
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,1494607217236502847,8035301220008299056,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,1494607217236502847,8035301220008299056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,1494607217236502847,8035301220008299056,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1494607217236502847,8035301220008299056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1494607217236502847,8035301220008299056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,1494607217236502847,8035301220008299056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,1494607217236502847,8035301220008299056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1494607217236502847,8035301220008299056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1494607217236502847,8035301220008299056,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1494607217236502847,8035301220008299056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,1494607217236502847,8035301220008299056,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,1494607217236502847,8035301220008299056,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3936 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\56b87506-058a-4711-8e5c-394a15ef987a.tmp

Filesize
10KB

MD5
00b220ac0b32721fbdb870c8a7ef7bf9

SHA1
e489396fc5d86919c772cf69a982b495de07df09

SHA256
6be0402a0156b2b486cecd092835e5cbcc1f8b6b0871030c39dc2ff8d67bd7b7

SHA512
ceaa1e0c80d3938f1a1816e6d409a1c50f3c5738adcc18af8f526ce3cc36fdfd77f08d7559ae8354f60b96dd411ea314498f92b111c04019c52441a34cca826a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e91bfd82b5902544f7814babed78b8f3

SHA1
c6f0e734e2217959e03cda9bf2f5800b48e6d602

SHA256
30e63fbd8c9fd1b5a05b58e402e58d6dd93cc000373f5d5a4a9dfb99c2802cc2

SHA512
0c0f45e5ea0d860e1f5a1ff183a021d3d3c70f380d156a5124f85790e145c8fe82f625fab83abc94a08263c560bdb3215958cb93c4a3837ad079f0285a0d6dbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f82cce154b9ab93f3b41b27213775579

SHA1
e7330658611a29e31cd00a83b497ec703810f1cc

SHA256
db2795bd975c049c3a984a14c03f3c5bfde61903a797fe0e276e767438244f4b

SHA512
18d6546e1c4ef7b14856cfe6c9647bda6fc9f034ed6b7030a8c94466aef84d5ff54d425024add12208822085105a063c388705502bbe364e56cdf69813895390

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit