716916eac0411ca67aefe187782fe67f46a0292b4424706a42dea8559bde22af

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2025 09:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_e2bb4f1580dbeca4a350924e2c956777.html
Size

64KB
MD5

e2bb4f1580dbeca4a350924e2c956777
SHA1

6db51a5b969480b1858a35751ed9c951ebef6a68
SHA256

716916eac0411ca67aefe187782fe67f46a0292b4424706a42dea8559bde22af
SHA512

bc1949808bf8c0b8af10073f67d6faec860c8a0492e5d9175222ad703090ea8fb73994cf7e5b7be5b6ed396590302106c570fc692e6567cc63cb077c55e0db6d
SSDEEP

192:mDiZimQ/wmk2hzZdKJsMkkzZIA4iXByLSw3PMer03rmpOd+hnCV2fQLkFO8N:1lehzvEnkkzr/XB9wfl9Ck4t8N

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4308	msedge.exe
4308	msedge.exe
552	msedge.exe
552	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
552	msedge.exe
552	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe
552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 1516	552	msedge.exe	82
PID 552 wrote to memory of 1516	552	msedge.exe	82
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 3480	552	msedge.exe	83
PID 552 wrote to memory of 4308	552	msedge.exe	84
PID 552 wrote to memory of 4308	552	msedge.exe	84
PID 552 wrote to memory of 3440	552	msedge.exe	85
PID 552 wrote to memory of 3440	552	msedge.exe	85
PID 552 wrote to memory of 3440	552	msedge.exe	85
PID 552 wrote to memory of 3440	552	msedge.exe	85
PID 552 wrote to memory of 3440	552	msedge.exe	85
PID 552 wrote to memory of 3440	552	msedge.exe	85
PID 552 wrote to memory of 3440	552	msedge.exe	85
PID 552 wrote to memory of 3440	552	msedge.exe	85
PID 552 wrote to memory of 3440	552	msedge.exe	85
PID 552 wrote to memory of 3440	552	msedge.exe	85
PID 552 wrote to memory of 3440	552	msedge.exe	85
PID 552 wrote to memory of 3440	552	msedge.exe	85
PID 552 wrote to memory of 3440	552	msedge.exe	85
PID 552 wrote to memory of 3440	552	msedge.exe	85
PID 552 wrote to memory of 3440	552	msedge.exe	85
PID 552 wrote to memory of 3440	552	msedge.exe	85
PID 552 wrote to memory of 3440	552	msedge.exe	85
PID 552 wrote to memory of 3440	552	msedge.exe	85
PID 552 wrote to memory of 3440	552	msedge.exe	85
PID 552 wrote to memory of 3440	552	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e2bb4f1580dbeca4a350924e2c956777.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff927b146f8,0x7ff927b14708,0x7ff927b14718
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,9597705240810790846,17137534512477849840,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,9597705240810790846,17137534512477849840,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,9597705240810790846,17137534512477849840,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9597705240810790846,17137534512477849840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,9597705240810790846,17137534512477849840,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,9597705240810790846,17137534512477849840,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4884 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b9a40139a54b25086b7144ef134420d3

SHA1
ca146027dc65637dce6377c65e480eacd67e02a4

SHA256
46d85b3188806737e76a49870a66a5c5868238ced6f9b21fde0df8d3da822f64

SHA512
5945aa099f1df41cbf762c4ea1f420921640a938abcfdbdd471fcf99aea0bbb333ac8fca55036f543e26174ada72c5954f8547a629945bc7e5442714b4929264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
164e4f42f2e82c89368dc85092c692c5

SHA1
9e0e1d5a2a24c1c94f70d929927a5027373e8040

SHA256
c5747b5b760d8f1bc3f58721c00dcf57d9e84ba05cd38da3f18b910523a51327

SHA512
ff302749f0d33e6bfafc4409e76c46e19b825001c79a9e73309ad6597ee791dc8532fa6e5b7bd0838c1eaf08451a4ff30abf25529dbd3a318bdb791e54a2a5f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
48d3e81a7559d5932db63c5f7b11a501

SHA1
2920376e194f01ab37ec5044caaccc578bf89639

SHA256
65200e9d193b023852a2512cc136cfaaaafed34c78cd8150544f23212f2f9a89

SHA512
8020772be0f128e9241270a4f084b6f7e5aea280bae2973e9fcd60dd9f2e82b1b7e94142faa679236f223fb59acdcde85688c5e67c86c8c4a8a07fd7952c46cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
004acca14198e036f430cce750d7ac73

SHA1
0a78926fefe68c725ddb484608fabdb71fa8191d

SHA256
717fc59b7cf6d630bb861316b07bfacd3cd6c93ede2bdc27f4610a0bfb897409

SHA512
b0637d577dea78fa344a927a18136ee4783a697749b0a556fc32929961e3cda8592e126b548c28f8c0b4acd06c7b5db6b5c30381d165fd0d34322975746cfaf5

Download Submit