a05b0aaa5ece53ffb705ea1e10b158e6a41278a40db85054f12569aeaa540279

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2025 18:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_14d1269cb2e08dc9fd308c2f89020684.html
Size

35KB
MD5

14d1269cb2e08dc9fd308c2f89020684
SHA1

fc403376136de1871585fd3c4be56fdc95d0254e
SHA256

a05b0aaa5ece53ffb705ea1e10b158e6a41278a40db85054f12569aeaa540279
SHA512

41fac123d92ea2927ba70d0b99935188221007db7c99bdf9814b741038453e0cb631d7ce4f04df24703685e656f2c32605609009a41ffd3258c4fe861a2c4a47
SSDEEP

384:SLG+PDxVkXYqc/OW2QZhggKgS/hDm6PjG8/VLxBawoKoQcCFx0JI9dkc:SLGoSXYqcKH/hS6P9/TBzR70JI9dkc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
1672	msedge.exe
1672	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1372	1672	msedge.exe	83
PID 1672 wrote to memory of 1372	1672	msedge.exe	83
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 2016	1672	msedge.exe	84
PID 1672 wrote to memory of 4908	1672	msedge.exe	85
PID 1672 wrote to memory of 4908	1672	msedge.exe	85
PID 1672 wrote to memory of 3648	1672	msedge.exe	86
PID 1672 wrote to memory of 3648	1672	msedge.exe	86
PID 1672 wrote to memory of 3648	1672	msedge.exe	86
PID 1672 wrote to memory of 3648	1672	msedge.exe	86
PID 1672 wrote to memory of 3648	1672	msedge.exe	86
PID 1672 wrote to memory of 3648	1672	msedge.exe	86
PID 1672 wrote to memory of 3648	1672	msedge.exe	86
PID 1672 wrote to memory of 3648	1672	msedge.exe	86
PID 1672 wrote to memory of 3648	1672	msedge.exe	86
PID 1672 wrote to memory of 3648	1672	msedge.exe	86
PID 1672 wrote to memory of 3648	1672	msedge.exe	86
PID 1672 wrote to memory of 3648	1672	msedge.exe	86
PID 1672 wrote to memory of 3648	1672	msedge.exe	86
PID 1672 wrote to memory of 3648	1672	msedge.exe	86
PID 1672 wrote to memory of 3648	1672	msedge.exe	86
PID 1672 wrote to memory of 3648	1672	msedge.exe	86
PID 1672 wrote to memory of 3648	1672	msedge.exe	86
PID 1672 wrote to memory of 3648	1672	msedge.exe	86
PID 1672 wrote to memory of 3648	1672	msedge.exe	86
PID 1672 wrote to memory of 3648	1672	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_14d1269cb2e08dc9fd308c2f89020684.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff409346f8,0x7fff40934708,0x7fff40934718
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,17987244599580295157,11853964515602544013,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,17987244599580295157,11853964515602544013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,17987244599580295157,11853964515602544013,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17987244599580295157,11853964515602544013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17987244599580295157,11853964515602544013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17987244599580295157,11853964515602544013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17987244599580295157,11853964515602544013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,17987244599580295157,11853964515602544013,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1300 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
86f5c44b702e1329a3e19b6ad6da0239

SHA1
6c25a8e48bc9542d6cc4f4bd5f2f8c93ac049d6b

SHA256
d4e546a69b01f9e3b3f743672f742eb2cfffc3f5afc2d03e506420299fc00c8e

SHA512
c0aecf4e8f9e94b05a6eaabdaefa48a537df61dbafc5bdc244470a06d1edeb32d8d4d3ffea064131cac74dcdc01565bd49a703af8f7b7287bc5c78c1897c8cdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
288d1b21a081c5f4d8bedb0b85d542be

SHA1
0303404c85c4e4a876af64dc32016b5438e3405d

SHA256
c4e2bb417d0a43b9967b1c27a3d4b42ebbe8e12299da3855389f3aab82de785a

SHA512
fa0efc68edf396eb10544597ddb2c22028066db7920fdab65bd195659f6bf7d83c1ab3daaf26a311ebd662326828630e57d267c777d793b3651dafced0ed97c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7c4ff70b555e8b43bda8cf5f6a722c3c

SHA1
91fe03a6482ee9f9be4c78078d849275c49aab64

SHA256
26cd66ee4789e4548539726b49c4e9bc12bfe1e5d71945ac995dcf046b0b820c

SHA512
5883625a26e54edee927cdcc3d20b1cef6ef8be0920f795591f390cd576f6884531f81d8b603d0ece71189f291c07d3e892de872f1f51789ed4538fcc1a87071

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d93203b18318fa1ebcc7b4649eb931fe

SHA1
aede2f24ba0ca5f5e7e889350d6f7a1c1a3fd731

SHA256
2b93e0c36f185abc6f35e90050245fbe9e5ebd677b859c416a84a1d28cb1e8f3

SHA512
b5b2ab11e7d58ffc74de7a438ae617897a772e58da55c663d9528e195544be868439748bec6211455ef0b70f0858467b8368f707c2a0a69c27bf33b02efb1acb

Download Submit