cd27f8f44a61643759729c17f8fdd4b5674935d3fd94d5e8d37c2d646fa8d1dc

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2025 11:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_0423be5dedc5c7e0ab4f893378b38a89.html
Size

114KB
MD5

0423be5dedc5c7e0ab4f893378b38a89
SHA1

3efabdd555d86a204eddafc083ad435f4e09f2bf
SHA256

cd27f8f44a61643759729c17f8fdd4b5674935d3fd94d5e8d37c2d646fa8d1dc
SHA512

30d1ade393f0f2bdb9120a69e6023fb8ee163a8da93f848c4a4a4bdadb49f576adb91fe9f68e626ab8c1cd9aa19928d8442e8e11cb9fad72dcf51362a47b1d81
SSDEEP

3072:CoV1odnh8XvCodnh1SxY0tcZBE9Fbbo9YsgZy473tCBtM7Ierd:CGGY0tcZBE9Fbbo9YsgZy473yU

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1484	msedge.exe
1484	msedge.exe
4048	msedge.exe
4048	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 1472	4048	msedge.exe	83
PID 4048 wrote to memory of 1472	4048	msedge.exe	83
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 2804	4048	msedge.exe	84
PID 4048 wrote to memory of 1484	4048	msedge.exe	85
PID 4048 wrote to memory of 1484	4048	msedge.exe	85
PID 4048 wrote to memory of 448	4048	msedge.exe	86
PID 4048 wrote to memory of 448	4048	msedge.exe	86
PID 4048 wrote to memory of 448	4048	msedge.exe	86
PID 4048 wrote to memory of 448	4048	msedge.exe	86
PID 4048 wrote to memory of 448	4048	msedge.exe	86
PID 4048 wrote to memory of 448	4048	msedge.exe	86
PID 4048 wrote to memory of 448	4048	msedge.exe	86
PID 4048 wrote to memory of 448	4048	msedge.exe	86
PID 4048 wrote to memory of 448	4048	msedge.exe	86
PID 4048 wrote to memory of 448	4048	msedge.exe	86
PID 4048 wrote to memory of 448	4048	msedge.exe	86
PID 4048 wrote to memory of 448	4048	msedge.exe	86
PID 4048 wrote to memory of 448	4048	msedge.exe	86
PID 4048 wrote to memory of 448	4048	msedge.exe	86
PID 4048 wrote to memory of 448	4048	msedge.exe	86
PID 4048 wrote to memory of 448	4048	msedge.exe	86
PID 4048 wrote to memory of 448	4048	msedge.exe	86
PID 4048 wrote to memory of 448	4048	msedge.exe	86
PID 4048 wrote to memory of 448	4048	msedge.exe	86
PID 4048 wrote to memory of 448	4048	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0423be5dedc5c7e0ab4f893378b38a89.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3fda46f8,0x7ffe3fda4708,0x7ffe3fda4718
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,6254772001138810946,787328284584582484,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,6254772001138810946,787328284584582484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,6254772001138810946,787328284584582484,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6254772001138810946,787328284584582484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6254772001138810946,787328284584582484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6254772001138810946,787328284584582484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1152 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,6254772001138810946,787328284584582484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,6254772001138810946,787328284584582484,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4be034b634360849809a2f6a2aad11b1

SHA1
ce32b9d6bdd99a9fcd67c7f22068eff2e78a4c12

SHA256
c19a15150f6160fa76606b20d66b4e66bbbe7e8be470d3f29bd5d7db957c5c3f

SHA512
23c90482809f60110084b86da316128923ea60acb3afbb858b2d20af1baa6e57d2c172f5eccc55d79689317ff548f1b96551f0aaf3c84394403a937375947d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1016B

MD5
90e857d8e464fb7e5eec89890727672c

SHA1
e0ca561e04d850ea2d5eed5f929156a1e0b95236

SHA256
02720555a89fb7c40fd4876348e7eb5d59236654f0b202a3f1a121e550bdaea1

SHA512
4fdbd2b8310b603efd30aaf4dfb90fee7c40e10b6be8e695f6766d8f6a0d733f2f55fe9090cbb32e2039dca47d2198e85b9e459aaea8c500241ca16880e80236

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bf0c973af5d633387a6af0cdd72ee108

SHA1
dc90c2f3f1b8ec44cfd0bce5b44c586b1735d08f

SHA256
2468b62e0a537df1cdd6bddef9e99115d4c4959f7902eeb47d10e62a3f1f4805

SHA512
c9a03840b3a8a2943d559dff190ea1f08d988702f23646a13f07415cd3dcc840b429592d0c9b8948fc748a61736c9ed9a29012b2ab73a7ac52a115f7a843ece8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a495166a23aba7c961807675e12ddc3a

SHA1
a173cb7e37ffe379a0df8fea428d9c262fd02290

SHA256
6a4eb5dbd496f2ac50813b125c57a560dc32e648acec446442059836483a8788

SHA512
4fa9ebe0c130a840476e0db6e16396f9851e0b5d229a3a2f40863a2a6fb124661c1c2882ec6b87b79d08ca0ae8eaeb855b6faa5f8a45c3994fbf00c8c5375884

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8f5a0ff9b6a3299b80790afa02525502

SHA1
2a7d9b040e037ce229d35402d08a088b96d36174

SHA256
249a275f4404768fd754185751999231862052ee53181c003fdc8b18fca992a5

SHA512
70bdbc69453f7af49e731b55eae0c8e8495a5495250a5ac57b5ac1fa821b60505c848f1d233150e53d2d60278b9880aaff899ca86e6c58c747a8bb7a8eebeb53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6a129008d53694a2efbd3829cc5d1434

SHA1
4adebdfeba30c8521fcfcea97092453bb22b6f03

SHA256
190e0e5ce08ff47f329467625377fae9306815cb7bf8575e002b6763f4d89983

SHA512
d45dca876559e55cd6c3d67085e03b8ea757424fa1d9be735ba87ec82132b2914601eec779f231a3cbda19b24eae4b80fba0806f091718c4018cdbcb96798ff1

Download Submit