6f152d4094f95552ce1dbbd916b5c4533d63701c22aa5a65f81d15fef0dc7f47

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-01-2025 23:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_47daa604778c86f2149f6cf9dd5b662d.html
Size

140KB
MD5

47daa604778c86f2149f6cf9dd5b662d
SHA1

78b25a475e693a8bf21e8ce97ae9c5780f28304f
SHA256

6f152d4094f95552ce1dbbd916b5c4533d63701c22aa5a65f81d15fef0dc7f47
SHA512

8bbaa24b9b101c908eed7f3a83069e5d332f735db42ace1cc07077d8be044d209dfa0064ce99a3c561f29ec97479fcf8c2909ae6988a7e283aa0838a530dc66a
SSDEEP

3072:PVMpui8xLrqDoRCo+xuTB+OO9wTHodkh5OK66kgZK:9MpuH3q1o+xuTB+5

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
964	msedge.exe
964	msedge.exe
1992	identity_helper.exe
1992	identity_helper.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe
3456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 4564	964	msedge.exe	83
PID 964 wrote to memory of 4564	964	msedge.exe	83
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 380	964	msedge.exe	84
PID 964 wrote to memory of 3240	964	msedge.exe	85
PID 964 wrote to memory of 3240	964	msedge.exe	85
PID 964 wrote to memory of 3132	964	msedge.exe	86
PID 964 wrote to memory of 3132	964	msedge.exe	86
PID 964 wrote to memory of 3132	964	msedge.exe	86
PID 964 wrote to memory of 3132	964	msedge.exe	86
PID 964 wrote to memory of 3132	964	msedge.exe	86
PID 964 wrote to memory of 3132	964	msedge.exe	86
PID 964 wrote to memory of 3132	964	msedge.exe	86
PID 964 wrote to memory of 3132	964	msedge.exe	86
PID 964 wrote to memory of 3132	964	msedge.exe	86
PID 964 wrote to memory of 3132	964	msedge.exe	86
PID 964 wrote to memory of 3132	964	msedge.exe	86
PID 964 wrote to memory of 3132	964	msedge.exe	86
PID 964 wrote to memory of 3132	964	msedge.exe	86
PID 964 wrote to memory of 3132	964	msedge.exe	86
PID 964 wrote to memory of 3132	964	msedge.exe	86
PID 964 wrote to memory of 3132	964	msedge.exe	86
PID 964 wrote to memory of 3132	964	msedge.exe	86
PID 964 wrote to memory of 3132	964	msedge.exe	86
PID 964 wrote to memory of 3132	964	msedge.exe	86
PID 964 wrote to memory of 3132	964	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_47daa604778c86f2149f6cf9dd5b662d.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb6b9246f8,0x7ffb6b924708,0x7ffb6b924718
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,16603686261764514553,14195368662808627053,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,16603686261764514553,14195368662808627053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,16603686261764514553,14195368662808627053,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16603686261764514553,14195368662808627053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16603686261764514553,14195368662808627053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16603686261764514553,14195368662808627053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16603686261764514553,14195368662808627053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16603686261764514553,14195368662808627053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,16603686261764514553,14195368662808627053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,16603686261764514553,14195368662808627053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16603686261764514553,14195368662808627053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16603686261764514553,14195368662808627053,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16603686261764514553,14195368662808627053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,16603686261764514553,14195368662808627053,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,16603686261764514553,14195368662808627053,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5160 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
91f62b38f1468d34b1d3fd0b441e40ed

SHA1
94cd53e7a47e5178d095d6b254f3d5d1067da369

SHA256
c7761102a8d0653b7a3827063f69fe0d443fdb0926c4fd5d6a92915912bfa829

SHA512
ed3c61ff7aaadab39db482710ebb3f92a2d767337a298138dfa68f2f31b9b18286fb0ee1eed517bf1db82b988227f7acf72becdc8040e4b7ad716e5959f89e92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8ca31d9beff53c966fe4120aead297db

SHA1
57ecf39b239c460fe46290c122dff0e119346ac8

SHA256
9bfda510b35177a9459ee367e2888a935d922da3247a4b95196cf57c1b2afbf8

SHA512
4eefc2c00bb5d7c7821134630f73e4dda7cc30aa942363335d2f59714a866e50db4325a23b348f38277b97d217ad068653e63258427e22f9791f3af957fd7330

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
58f24081177ad5d1f214671b6e6ee65d

SHA1
2754effa0657027c97b0268011b34f89c973a61b

SHA256
b03e65d3f7aa43ead586f2cf5280953135d995fba6e576bd1aad231814f3535b

SHA512
2730de06850b898b3c07de4192afeade3d232d81439b9bbb449a66395e8647ba202bffb856aa7abd74f947fd390653c9c58977418b4bad2bb05a6de3ba8bc4d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ae8f6013d19cdda55a81f115324d9578

SHA1
16000ccdbc7ee8c3467daa20702cefeb10f795c4

SHA256
da2da428d4e2be405f705a8caede2b008ebf8f75d549f98a7b0433e8d0cfe2cd

SHA512
c3807ce5537b59395be94e9fc813a7a885629e1b5ce10bb601bdf59f488a36b78f6da1c44d92e4829e8a20c59c68eb4b642b4d94268e6cd62df38dc277e42cbd

Download Submit