9c49604e6de8fefe9e6f8862baaf05ce9ed25491629f773b388e598f70b4590e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/01/2025, 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_eefdc19301f5aeab7e18e65780cb2517.html
Size

382KB
MD5

eefdc19301f5aeab7e18e65780cb2517
SHA1

c5563364a36606ac913abe3bb1e8ea870abc1083
SHA256

9c49604e6de8fefe9e6f8862baaf05ce9ed25491629f773b388e598f70b4590e
SHA512

a3969959b26f156b78afe2cbcc9fac5a9cc3fb6b384220ae3c18557354d879ae36185c9c06971bd4dc55d03ef2fc7f2f5f8765539b9e670f727109139ccb4022
SSDEEP

3072:3qwnJ2L8KlofBXS1pyRcWFR5dCSH9+tjZ4t2ayyTp/OkVX6MGmC70VXdpcT+E:pJlKCfsyRBo8te9mC70VXdpcT+E

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
3576	msedge.exe
3576	msedge.exe
3020	identity_helper.exe
3020	identity_helper.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 2100	3576	msedge.exe	84
PID 3576 wrote to memory of 2100	3576	msedge.exe	84
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 3452	3576	msedge.exe	85
PID 3576 wrote to memory of 920	3576	msedge.exe	86
PID 3576 wrote to memory of 920	3576	msedge.exe	86
PID 3576 wrote to memory of 4540	3576	msedge.exe	87
PID 3576 wrote to memory of 4540	3576	msedge.exe	87
PID 3576 wrote to memory of 4540	3576	msedge.exe	87
PID 3576 wrote to memory of 4540	3576	msedge.exe	87
PID 3576 wrote to memory of 4540	3576	msedge.exe	87
PID 3576 wrote to memory of 4540	3576	msedge.exe	87
PID 3576 wrote to memory of 4540	3576	msedge.exe	87
PID 3576 wrote to memory of 4540	3576	msedge.exe	87
PID 3576 wrote to memory of 4540	3576	msedge.exe	87
PID 3576 wrote to memory of 4540	3576	msedge.exe	87
PID 3576 wrote to memory of 4540	3576	msedge.exe	87
PID 3576 wrote to memory of 4540	3576	msedge.exe	87
PID 3576 wrote to memory of 4540	3576	msedge.exe	87
PID 3576 wrote to memory of 4540	3576	msedge.exe	87
PID 3576 wrote to memory of 4540	3576	msedge.exe	87
PID 3576 wrote to memory of 4540	3576	msedge.exe	87
PID 3576 wrote to memory of 4540	3576	msedge.exe	87
PID 3576 wrote to memory of 4540	3576	msedge.exe	87
PID 3576 wrote to memory of 4540	3576	msedge.exe	87
PID 3576 wrote to memory of 4540	3576	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_eefdc19301f5aeab7e18e65780cb2517.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa048146f8,0x7ffa04814708,0x7ffa04814718
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14325474581824692032,8292605630622157045,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,14325474581824692032,8292605630622157045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,14325474581824692032,8292605630622157045,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14325474581824692032,8292605630622157045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14325474581824692032,8292605630622157045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,14325474581824692032,8292605630622157045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,14325474581824692032,8292605630622157045,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14325474581824692032,8292605630622157045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14325474581824692032,8292605630622157045,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14325474581824692032,8292605630622157045,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,14325474581824692032,8292605630622157045,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,14325474581824692032,8292605630622157045,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5164 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
185B

MD5
41e210007766d75809399406805bca47

SHA1
398b063546cdaed5c03409b1dae5e8f30401dc38

SHA256
69167b82665097a0d22662160f989ec7d21aaeb987f5acdb1516f562c2ec5e9c

SHA512
96847cb2c55a27397d376c2bf173e9003ad280be43937a20052f5ed2c91d1fa8cb455eadefa562ad4b3d562ee3e046e795131c3b5fe1d5383f4f60c82b34ead5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
01c4418b7108b55743e426d20a281fd9

SHA1
0b650eb2a26ec8e9479938026baa73d7cc7afce2

SHA256
78d0c046262e59f632ac9d2570dd1d04e7484dfbf9f9930dbc78a39ad08aeb4a

SHA512
11dbef498a13531a06d645ca72070601cb948cd0486e2fa16911e590d6eb23b1e98df3b1894ea0ab65d90ccc67119fdb0f7f47c5cde52569e2e0ef07131f7997

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1a7120a1277793c3b87605b20fdea081

SHA1
0f3d6c58c5564290f08e1efa1db5da238061656d

SHA256
c11eb6d52e7339c525e32d5293b0730181d21dfdcad58d01e6003b36ca596da7

SHA512
521ba2f3c49c7f1891f40743a110f5de8bc6e2c70af55987c12a094db0458767dabc826103570769e19ab9a501e1545dc0515296cc6b2afc8470154ff7e785a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
535b1284e9546ec15f044db54cfa197f

SHA1
8ce845199dc333d91ff764964dfb3f3bb76acdaf

SHA256
6b03ec798e0f27c7632ce3a27a55bceee31fc43f78f3315c8053bd49f14f1e7a

SHA512
a35930e377108c0906b72c6b3541195f5fa99f27a3bf4486f011b120d8dcf8e74a66ff6a81af0ff67c63786939a277abe38aacd9e66d78a3ab069d010d62aade

Download Submit