4c5fcc3c399de5190afd02c317c6ae87ad53bacdb2ead04e54424f2ae91664e9

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2025 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_e8460fe4764a73f1969db241c5729006.html
Size

127KB
MD5

e8460fe4764a73f1969db241c5729006
SHA1

8fc034e4d7de4c4f152704e5b461506b860a1c8d
SHA256

4c5fcc3c399de5190afd02c317c6ae87ad53bacdb2ead04e54424f2ae91664e9
SHA512

2017443ee4cc5fabac5aac39c661eed9bd69ad76514ca465c0d051815d05193be302df94b466fa3fd99dc877e8f60ab0edc0076b7ef7be23c1f1742892ff1070
SSDEEP

1536:CXJEEJXFM4KCjanDD9BVZfkjnJKlf5wrw+it:CbJXq4KCjanfVZfc8

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3204	msedge.exe
3204	msedge.exe
3292	msedge.exe
3292	msedge.exe
3292	msedge.exe
3292	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 4100	3204	msedge.exe	82
PID 3204 wrote to memory of 4100	3204	msedge.exe	82
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 4776	3204	msedge.exe	83
PID 3204 wrote to memory of 3804	3204	msedge.exe	84
PID 3204 wrote to memory of 3804	3204	msedge.exe	84
PID 3204 wrote to memory of 4156	3204	msedge.exe	85
PID 3204 wrote to memory of 4156	3204	msedge.exe	85
PID 3204 wrote to memory of 4156	3204	msedge.exe	85
PID 3204 wrote to memory of 4156	3204	msedge.exe	85
PID 3204 wrote to memory of 4156	3204	msedge.exe	85
PID 3204 wrote to memory of 4156	3204	msedge.exe	85
PID 3204 wrote to memory of 4156	3204	msedge.exe	85
PID 3204 wrote to memory of 4156	3204	msedge.exe	85
PID 3204 wrote to memory of 4156	3204	msedge.exe	85
PID 3204 wrote to memory of 4156	3204	msedge.exe	85
PID 3204 wrote to memory of 4156	3204	msedge.exe	85
PID 3204 wrote to memory of 4156	3204	msedge.exe	85
PID 3204 wrote to memory of 4156	3204	msedge.exe	85
PID 3204 wrote to memory of 4156	3204	msedge.exe	85
PID 3204 wrote to memory of 4156	3204	msedge.exe	85
PID 3204 wrote to memory of 4156	3204	msedge.exe	85
PID 3204 wrote to memory of 4156	3204	msedge.exe	85
PID 3204 wrote to memory of 4156	3204	msedge.exe	85
PID 3204 wrote to memory of 4156	3204	msedge.exe	85
PID 3204 wrote to memory of 4156	3204	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e8460fe4764a73f1969db241c5729006.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab23f46f8,0x7ffab23f4708,0x7ffab23f4718
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,10899317327059032304,8507492697661529221,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,10899317327059032304,8507492697661529221,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,10899317327059032304,8507492697661529221,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3024 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10899317327059032304,8507492697661529221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,10899317327059032304,8507492697661529221,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,10899317327059032304,8507492697661529221,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7cdab24e01c5b50565eb97418b7a114c

SHA1
18516657350ac9c46d6bfb9e2d3175e309a2f8e6

SHA256
46d6295618246deb5a8c1228050ce86ead39b378ce4c29a438781e382c54216c

SHA512
55ab633e098b1465096839b6d9be1bdc837bd1965152a0df02846ff380ac956e1b0a797ab7f08e279aad476756b014dac6020a0b1d4d1303fe2d0ba2cf05d760

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ace8216542b68be1d93210c6d49609f4

SHA1
111cb00a9d32cb8150ddb2dc3db4b624107e1ffa

SHA256
c7797e112e5d39b07e2855173e0ff1cc9f4ee3dbee73631970c9f164f65a7151

SHA512
4a99c0f6476cd25b01766a95ded8d4383403239cd3b8a7995792a283308811ce811c27fb0bc7d7b5319edfcde7ec678b5f635fee5cf42003b2272892a20dd12a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f9fd9a71-b9fb-4079-8136-f67a31450c64.tmp

Filesize
6KB

MD5
50fb075507b0e70931c594af23441b85

SHA1
bedd50b3308b92bd36a1705e95e00c6dcef1b3dd

SHA256
cb2e9e0c3e990451f9bd97a9ab54da01ff41d39fd0e51df5111830199252bc58

SHA512
9f61bf57724445b3086f2ca2295341c39dc2be75e5c02a1bb86530ee1af5cdf8c73cf9191e47fbe46a7cd25fe73e765975e3707367e72dd5d552c1f711e8e81f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4795256d44a2e06b2712299e80865c63

SHA1
f9727cb30ea5683a7ae8f17278862a7a7f42db9a

SHA256
aff40311342ec377b544ef38a703fba6c4e95a6389cd545eae152035d50e8b55

SHA512
3421ef54583f0f494ad6db1b9a03da1628e5d82570ed68b6eee7ea69c48283c061c9d11c1a41465002a802b2460a47296867fb0542507dcb753953abe378c491

Download Submit