6981e8ec54441242ae60d120fe44769957b2b3276d1391d052b87b12f94dd0ed

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/01/2025, 09:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_e2ab28a1c73430898593dfb7ed24fbb7.html
Size

10KB
MD5

e2ab28a1c73430898593dfb7ed24fbb7
SHA1

55b25a94b284348938610e70fd37ae726c28433c
SHA256

6981e8ec54441242ae60d120fe44769957b2b3276d1391d052b87b12f94dd0ed
SHA512

a52a41497d4e35f05ae471feac3c3bd3be3e2e46d7e817ed6dea5ba53d6392509273b937f6340d8668d1b0d7eedd1cfb6e1fd50c06c1d5fe4616e8a3da70d768
SSDEEP

96:uzVs+ux7wQdLLY1k9o84d12ef7CSTUKGT/kEppSOR8lYR8dlR8cyblVHcEZ7ru7f:csz7fdAYS/7+LSCSfS1PHb76f

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2460	msedge.exe
2460	msedge.exe
372	msedge.exe
372	msedge.exe
4640	identity_helper.exe
4640	identity_helper.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe
372	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 372 wrote to memory of 2356	372	msedge.exe	83
PID 372 wrote to memory of 2356	372	msedge.exe	83
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 3512	372	msedge.exe	84
PID 372 wrote to memory of 2460	372	msedge.exe	85
PID 372 wrote to memory of 2460	372	msedge.exe	85
PID 372 wrote to memory of 4036	372	msedge.exe	86
PID 372 wrote to memory of 4036	372	msedge.exe	86
PID 372 wrote to memory of 4036	372	msedge.exe	86
PID 372 wrote to memory of 4036	372	msedge.exe	86
PID 372 wrote to memory of 4036	372	msedge.exe	86
PID 372 wrote to memory of 4036	372	msedge.exe	86
PID 372 wrote to memory of 4036	372	msedge.exe	86
PID 372 wrote to memory of 4036	372	msedge.exe	86
PID 372 wrote to memory of 4036	372	msedge.exe	86
PID 372 wrote to memory of 4036	372	msedge.exe	86
PID 372 wrote to memory of 4036	372	msedge.exe	86
PID 372 wrote to memory of 4036	372	msedge.exe	86
PID 372 wrote to memory of 4036	372	msedge.exe	86
PID 372 wrote to memory of 4036	372	msedge.exe	86
PID 372 wrote to memory of 4036	372	msedge.exe	86
PID 372 wrote to memory of 4036	372	msedge.exe	86
PID 372 wrote to memory of 4036	372	msedge.exe	86
PID 372 wrote to memory of 4036	372	msedge.exe	86
PID 372 wrote to memory of 4036	372	msedge.exe	86
PID 372 wrote to memory of 4036	372	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e2ab28a1c73430898593dfb7ed24fbb7.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff87d4646f8,0x7ff87d464708,0x7ff87d464718
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,9674353271996566129,14503431983204130576,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,9674353271996566129,14503431983204130576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,9674353271996566129,14503431983204130576,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9674353271996566129,14503431983204130576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9674353271996566129,14503431983204130576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,9674353271996566129,14503431983204130576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,9674353271996566129,14503431983204130576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9674353271996566129,14503431983204130576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9674353271996566129,14503431983204130576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9674353271996566129,14503431983204130576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,9674353271996566129,14503431983204130576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,9674353271996566129,14503431983204130576,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
47e93ab0d2ff172150be896f399b5cd4

SHA1
fdf76a6b0049d5befa47c1c9e6f73dce1cf56bbd

SHA256
a3e8e6b0f08a476f86ad3143e9b244f6e06c16ebd6f0d19370c875d6fc671d0d

SHA512
45dc0fe7510f212d06499c0661d9359bd950cd9cc3f4854c8eb2c788f6d8c1a9c56c16e8b96afce25a0f3f6e80b672b000c31ff27dbcdd56a081db0e2eaf7e6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e741e91f439ef4f85fc64a29d3daf1de

SHA1
51714d91ddac2a38cdb70a4cdecb9a9e0a4e0b15

SHA256
84591c4db12ebf964a87c17e642c6ec3956da3a7ecf99bdb7562eebb090203a5

SHA512
e1337afc8a9df07f7fc7a56fae83094745802a3382f75bb3a587a71a4e7f6107fa785db45dfc7b0178d8e60963f8dee00faf568bc37d8f663143ae0d4c0fc516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3a1b10648f906c97818df48944b1f402

SHA1
fddda953d36449644f4a0b2c2fb1321e68ffa07d

SHA256
b8bee6884f4b9930f2682b64d18a54a0521c92f01f5fa9e2d78e965961009379

SHA512
15ec1475a19ef5ae51244cd57bebb752e6d62cc7420aab25e515243f0a4ebbee001bc8e1c755f11e722f4ac6f7545ce8c10c4c4fce838ad0bbc68432bf52d1d0

Download Submit