6f85e6bdc9d4ff01ee5acaa19a302f1436cb4d9243151540e6104ac9c77b5c58

Analysis

max time kernel
107s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-01-2025 17:52

Sharing

Copy URL

Twitter E-mail

Reason

Task went missing from backend

Report Analysis Logs

General

Target

JaffaCakes118_41f0fa5ce212623af63f43fbeda3c063.html
Size

153KB
MD5

41f0fa5ce212623af63f43fbeda3c063
SHA1

13f0b9da8e9b753ee2538f4fb09de5c820c19d66
SHA256

6f85e6bdc9d4ff01ee5acaa19a302f1436cb4d9243151540e6104ac9c77b5c58
SHA512

da278bc13a5309a1abfa079e9fa6c442c1068479031c62f25869134170b0d3ffc741c4ae677618f449c0014a05a692007bd142a201d3c49f7eeb20cac5f6ccd4
SSDEEP

3072:1t2iEw026YRGLXEi+uziL6+aT1S91pi+y1ow3godvhCX19tBN3hoc:b2iEw02lM+uzi++aT1S91Y+ozM

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe
2552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2268	2552	msedge.exe	82
PID 2552 wrote to memory of 2268	2552	msedge.exe	82
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 740	2552	msedge.exe	83
PID 2552 wrote to memory of 1368	2552	msedge.exe	84
PID 2552 wrote to memory of 1368	2552	msedge.exe	84
PID 2552 wrote to memory of 724	2552	msedge.exe	85
PID 2552 wrote to memory of 724	2552	msedge.exe	85
PID 2552 wrote to memory of 724	2552	msedge.exe	85
PID 2552 wrote to memory of 724	2552	msedge.exe	85
PID 2552 wrote to memory of 724	2552	msedge.exe	85
PID 2552 wrote to memory of 724	2552	msedge.exe	85
PID 2552 wrote to memory of 724	2552	msedge.exe	85
PID 2552 wrote to memory of 724	2552	msedge.exe	85
PID 2552 wrote to memory of 724	2552	msedge.exe	85
PID 2552 wrote to memory of 724	2552	msedge.exe	85
PID 2552 wrote to memory of 724	2552	msedge.exe	85
PID 2552 wrote to memory of 724	2552	msedge.exe	85
PID 2552 wrote to memory of 724	2552	msedge.exe	85
PID 2552 wrote to memory of 724	2552	msedge.exe	85
PID 2552 wrote to memory of 724	2552	msedge.exe	85
PID 2552 wrote to memory of 724	2552	msedge.exe	85
PID 2552 wrote to memory of 724	2552	msedge.exe	85
PID 2552 wrote to memory of 724	2552	msedge.exe	85
PID 2552 wrote to memory of 724	2552	msedge.exe	85
PID 2552 wrote to memory of 724	2552	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_41f0fa5ce212623af63f43fbeda3c063.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce88746f8,0x7ffce8874708,0x7ffce8874718
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,13649181898093341128,417594531860605661,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1932,13649181898093341128,417594531860605661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1932,13649181898093341128,417594531860605661,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,13649181898093341128,417594531860605661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,13649181898093341128,417594531860605661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c811afec89fd404a47f3c6a10381dac1

SHA1
ba44d3b076c6bc33d548e99346c815b7c495c382

SHA256
ae345c398e96bee026b6cd4acdf2133054ead0295a06b3ac447a12abf7e10873

SHA512
6be31895eeefdc2132339e67e09de5600b1928243aa981ab6414da083fdb8bd947552f03a25c89f0f5a932933dc8b2f80859efa3128da338c904e9f55e076f0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c9ed9a44e4b50fba38084089e54157ed

SHA1
4af83a792c640328361f4b0e5467c847364a4c88

SHA256
ca2ce8e4b6896195f02d5fce2df73d4a048df64a7d2673dcc6276bf1969b6341

SHA512
bb91f1f5ced36efa2672a45526e4df25d1e8e7ecf2224a003644c2f34d6c938c34abba1bb2079dbdf17faea1a27a72b8a001e15cd557e7afe727571196aab1e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
96090ad018dd4be573138361e2b0ffb5

SHA1
3171f3dc40a20e53e6ada0567989a182d5ecbbbe

SHA256
11dc2468d965be46dcf3c79e982053b76b018556741e7f932203ee839cf4d3f7

SHA512
3d922c21fedc0af33a003219e228bafaf896882505dc568aa297fbf758b2cb0311c79d46844336c6d102843f022015b6c63f905e2618b0251981182977248d1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9ea1979a1804100f558922878a7bb7f9

SHA1
63b61d5784ee8c2686f1027270b90dbfe7e36e7b

SHA256
69e4187ba888fc4d1867a1747ecb55706d062e72c41f567744eaa50e6d994829

SHA512
3aedbc201e1dc107b7b2d4672b61179e71952c201bce9dd229d897ca03818f9813f3a18324cc6cda920a8c16db327f29db592670a96773578ff3e739bfde5a87

Download Submit