9494b9ccb055f5f9ac4d69b043b0954ea6dd7771927670e7680be3ca547dd907

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2025, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_40be31f9acd0bffe829ca9193867ea6f.html
Size 20KB
Sample250127-sbtdnatncv
SHA256 9494b9ccb055f5f9ac4d69b043b0954ea6dd7771927670e7680be3ca547dd907
MD5 40be31f9acd0bffe829ca9193867ea6f
SHA1 f1d3ea2b812d24cbf486f9e69686785240034aa4
SHA512 77bb69dadddc6ff8010e150b1c18b9167dff45b681e50e20809651cb12f8bfabbef5a1a662c2857c698eb3c68a97699f99dc1b47d76b6961700b8e37ab43b3d0
SSDEEP 192:qYSPRgJSSFnJzOF9A+3gA/ee94dbLq4ZLvydFOov88uigLA/0HPXxcJTtlaR2uA8:qYSPcAFG+bhy1Y8sVlvb19W
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2876	msedge.exe
2876	msedge.exe
1008	msedge.exe
1008	msedge.exe
3452	identity_helper.exe
3452	identity_helper.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe
4616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 3832	1008	msedge.exe	82
PID 1008 wrote to memory of 3832	1008	msedge.exe	82
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 4808	1008	msedge.exe	83
PID 1008 wrote to memory of 2876	1008	msedge.exe	84
PID 1008 wrote to memory of 2876	1008	msedge.exe	84
PID 1008 wrote to memory of 2740	1008	msedge.exe	85
PID 1008 wrote to memory of 2740	1008	msedge.exe	85
PID 1008 wrote to memory of 2740	1008	msedge.exe	85
PID 1008 wrote to memory of 2740	1008	msedge.exe	85
PID 1008 wrote to memory of 2740	1008	msedge.exe	85
PID 1008 wrote to memory of 2740	1008	msedge.exe	85
PID 1008 wrote to memory of 2740	1008	msedge.exe	85
PID 1008 wrote to memory of 2740	1008	msedge.exe	85
PID 1008 wrote to memory of 2740	1008	msedge.exe	85
PID 1008 wrote to memory of 2740	1008	msedge.exe	85
PID 1008 wrote to memory of 2740	1008	msedge.exe	85
PID 1008 wrote to memory of 2740	1008	msedge.exe	85
PID 1008 wrote to memory of 2740	1008	msedge.exe	85
PID 1008 wrote to memory of 2740	1008	msedge.exe	85
PID 1008 wrote to memory of 2740	1008	msedge.exe	85
PID 1008 wrote to memory of 2740	1008	msedge.exe	85
PID 1008 wrote to memory of 2740	1008	msedge.exe	85
PID 1008 wrote to memory of 2740	1008	msedge.exe	85
PID 1008 wrote to memory of 2740	1008	msedge.exe	85
PID 1008 wrote to memory of 2740	1008	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40be31f9acd0bffe829ca9193867ea6f.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9840e46f8,0x7ff9840e4708,0x7ff9840e4718
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:8
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6d94763c-16a8-4220-bba8-89d872a22f12.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6d94763c-16a8-4220-bba8-89d872a22f12.tmp
Size 10KB
SHA256 9c1a0a7b1bdfcb9dd35a4f1bb8928f524314f279d29a2b0257921e307dafe572
MD5 8bce0d45c0d137e967eb083d42b4d8c5
SHA1 8c48e5880547bde1d4f8009335953ce72efbbf8c
SHA512 6857f0ed92b9ad6408815fdc30336211f59b56fd1c6ceee6ac1d69124a8ff629b546a7ad7d4c0e4a9c336cf2d08a24569aedd5a3561fc4163057fc81e879b40c
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupLiCBle2RUN08mS+vYVkh:A9iIxuERzA83h09RZxYLRo+SFe
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a667d0d19885a961de72e4ba4b89957e9904bb9ac99e878e7fc106da0b3091e0
MD5 1b9739f5776a018d1dfea64dee3f4897
SHA1 3dcea83f53d046c24318fb0748f4d0652b213456
SHA512 d22f0a192450d4185fe73674d0bde7f2fa1f68bcc16ade038c372028a891d230391e45d08c02db9d11b8fccc250abbc5a29ca3d7759dbab8cb937cb4066e46e8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9bc3a5bef04210d4751fd4ed395131776e8f7737a5a377be09fcddfb7eb45384
MD5 2c40d5d7c5e0a85321aa5a230e68a231
SHA1 c4ac788ba4da6897adc3c9ef661ca6b469fc547e
SHA512 bb513fae1e4dbaed4ae59181407a24fe987c642451e6546fbcf14555fae575ff2d227fc39dee997fd64407d2927973831bfa14645d675c041b2dfc61ed3d55c0
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 794fefcbf1fbe2bcfce71e8a75a91106d2393997b6ed79af1e44c0bc064a7093
MD5 3532c782d6470e90ecd7ab84e0c1d2ae
SHA1 ae7ba704e13b57d5c0af50788566e29f4e42e6ba
SHA512 f0ee17816a9c2582c223862211e758643f317841ce402f3eb7cc9f247dd7ec11f4ad67147a20fbad4788c3e6efe341a141bb1faea0181842004c9f100ec3f092
SSDEEP 96:nackKqj1MBwpvWMoiVmdeHPApDAPmUWQyV+VDCziEwb:nNkxiBGWMX2ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 a725d9375571fd926dac80ab5e0991682ed6646deb236e2e81082cda1a23397b
MD5 ca385fe232c47d81cf265a0c004a1008
SHA1 ebe9100e0bac74384f7f6034b6282539f469a080
SHA512 7917b991b20c6fb6eef8473eaf7fa063410c6b5cf62c8f1030617e25b8ae39d3df37cb6cf805b990e804a7fe6f94a562486dcc8da4b961bcaedac45c435c5d20
SSDEEP 96:nackhqj1MxwpvWMoiVmdeHPApDAPmUWQyV+VD7AiEwb:nNkgixGWMX2rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 fe3d2e83848ede65097467a54ea813ed25a51119e87121089b3cfc531ebe5798
MD5 62fa438b48fdfb61c360e6d4fd356110
SHA1 6e54e946a5211afa1459715b9f37a18ea92cdd57
SHA512 01ada296a3fefe713f53d80d2c95b6e41231012d0998077b7948a68d961b61292d1e3b1b3457488eaa739fc4ff0974672ee448d29d2fcce2c1bebab49da96624
SSDEEP 768:nvoWvf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpLlKwrU+legxq:nvoWvfu1jaELY+l3g
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download