6fdecf633f4b4e8381b3580244f31f9b0f2fbdf97184784244e297389bd4fd52

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-01-2025 08:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_525deb906c5dba4016a99a73cf075864.html
Size

124KB
MD5

525deb906c5dba4016a99a73cf075864
SHA1

2922dfffede40b0c80c4000095ac9d4889f2326f
SHA256

6fdecf633f4b4e8381b3580244f31f9b0f2fbdf97184784244e297389bd4fd52
SHA512

eaed8fd64753c1b70599ec58667a1286a8342e87e22d7998a6f6668723077587248619c058f874402de10e502fcaee1881ca6bb24064dea1aff2ce0ac63cd782
SSDEEP

1536:6yJEEJXFRn1eCDrnDD9BVZfkj/f5w4w+ic:6YJXvn1eCDrnfVZfc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1652	msedge.exe
1652	msedge.exe
3664	msedge.exe
3664	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 2428	3664	msedge.exe	85
PID 3664 wrote to memory of 2428	3664	msedge.exe	85
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 4596	3664	msedge.exe	86
PID 3664 wrote to memory of 1652	3664	msedge.exe	87
PID 3664 wrote to memory of 1652	3664	msedge.exe	87
PID 3664 wrote to memory of 4912	3664	msedge.exe	88
PID 3664 wrote to memory of 4912	3664	msedge.exe	88
PID 3664 wrote to memory of 4912	3664	msedge.exe	88
PID 3664 wrote to memory of 4912	3664	msedge.exe	88
PID 3664 wrote to memory of 4912	3664	msedge.exe	88
PID 3664 wrote to memory of 4912	3664	msedge.exe	88
PID 3664 wrote to memory of 4912	3664	msedge.exe	88
PID 3664 wrote to memory of 4912	3664	msedge.exe	88
PID 3664 wrote to memory of 4912	3664	msedge.exe	88
PID 3664 wrote to memory of 4912	3664	msedge.exe	88
PID 3664 wrote to memory of 4912	3664	msedge.exe	88
PID 3664 wrote to memory of 4912	3664	msedge.exe	88
PID 3664 wrote to memory of 4912	3664	msedge.exe	88
PID 3664 wrote to memory of 4912	3664	msedge.exe	88
PID 3664 wrote to memory of 4912	3664	msedge.exe	88
PID 3664 wrote to memory of 4912	3664	msedge.exe	88
PID 3664 wrote to memory of 4912	3664	msedge.exe	88
PID 3664 wrote to memory of 4912	3664	msedge.exe	88
PID 3664 wrote to memory of 4912	3664	msedge.exe	88
PID 3664 wrote to memory of 4912	3664	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_525deb906c5dba4016a99a73cf075864.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbfb6146f8,0x7ffbfb614708,0x7ffbfb614718
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,10650683367596383667,8996996828537642263,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,10650683367596383667,8996996828537642263,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,10650683367596383667,8996996828537642263,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10650683367596383667,8996996828537642263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,10650683367596383667,8996996828537642263,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,10650683367596383667,8996996828537642263,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
af6922ba8207aedb7d40c3c4ad157ad0

SHA1
50523264cf8104dd654ea788009884a5630efca8

SHA256
5586c089cfc904a3965ae4c318db51fc4ee840133acd48ca3aa4dc3b98d648ec

SHA512
72fa4fb3a9f7d6775dfb8dddabdc88db815761b8ba6514213131db75de649c96d6c4b9764049def2b47e728fe68150a466d6b1d5baa1f63fe26bca66dcd6ba6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
154d9b85b66928dc7ef2757fe9d3468b

SHA1
8276400e2d2317a4b8bf2f40d2a2a8d2ad297b53

SHA256
3cd441ffde579b08019cb960c8d94489d4f6c2d4dcd0ac579c9a0ad12d4ad03f

SHA512
6121a8807de96e500cd2a8d224275193b875d2eae63ba9c58c9bd3701a5006e2f0ff438603f4d6a15379625953956e37686ffbeeb062169d6efbc812e1d6efa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c10589cd2071b97beed3b37c64dd15d1

SHA1
9cd9ef2693babd7f268d020b0526e2eb3917be7c

SHA256
c672da36366b9cc562b8a5ba6ce0783e9aa4d50571f814883841beddc6316e05

SHA512
52025c58f2c47d0e1c23b404b6fa7601abb7ccaaa3e689b668d77a4f6f45aa48a98e11413ca339edf2f07f61355963d63d3f1ad4f6681580e372b7d2864fc70f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ff59d54a9717ebe5bdfa056c5f10be6c

SHA1
a1bb26e30e919de68d405d955986d9f7655d2022

SHA256
cb497a21b8a56cd83b3192a855f810fa277df4fe0dde5f5bdd2df6f9d1563e19

SHA512
ba799291eb668154b6e22304731bf45243908f4665caf7f5f71eab9ac3f1428a1d6e08758fefefa00349222fe7c9118d235a0f3b227ceac8be2ccd5eb9a0f6e9

Download Submit