0b87554e79b70dd0af43288d2685dcc7c9bff5988e668ff2043ed3e9612f1c38

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2025 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_42611258b894866b240fabf268e6d5d0.html
Size

80KB
MD5

42611258b894866b240fabf268e6d5d0
SHA1

117e717bc4017091e247883e6b976c9f0bf1ddae
SHA256

0b87554e79b70dd0af43288d2685dcc7c9bff5988e668ff2043ed3e9612f1c38
SHA512

e04c052644f33bfc875345df827108cae13b9ad01acfed3b498c1b00be5e5986faea03cd77cd2cb0c968b4296e733205571b33a19cab1cd473de5fa5e30d5a8e
SSDEEP

768:lwP3Pkpo6xh3t/OyC0f13bI0Id8wvXBvB+1rp/j4IUm0/Mq8xLIE2ItDcoF:S3Pkpo8tRBJwZsF/j4cLIE2IyoF

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3652	msedge.exe
3652	msedge.exe
4500	msedge.exe
4500	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe
4500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4500 wrote to memory of 4632	4500	msedge.exe	82
PID 4500 wrote to memory of 4632	4500	msedge.exe	82
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 1208	4500	msedge.exe	83
PID 4500 wrote to memory of 3652	4500	msedge.exe	84
PID 4500 wrote to memory of 3652	4500	msedge.exe	84
PID 4500 wrote to memory of 3156	4500	msedge.exe	85
PID 4500 wrote to memory of 3156	4500	msedge.exe	85
PID 4500 wrote to memory of 3156	4500	msedge.exe	85
PID 4500 wrote to memory of 3156	4500	msedge.exe	85
PID 4500 wrote to memory of 3156	4500	msedge.exe	85
PID 4500 wrote to memory of 3156	4500	msedge.exe	85
PID 4500 wrote to memory of 3156	4500	msedge.exe	85
PID 4500 wrote to memory of 3156	4500	msedge.exe	85
PID 4500 wrote to memory of 3156	4500	msedge.exe	85
PID 4500 wrote to memory of 3156	4500	msedge.exe	85
PID 4500 wrote to memory of 3156	4500	msedge.exe	85
PID 4500 wrote to memory of 3156	4500	msedge.exe	85
PID 4500 wrote to memory of 3156	4500	msedge.exe	85
PID 4500 wrote to memory of 3156	4500	msedge.exe	85
PID 4500 wrote to memory of 3156	4500	msedge.exe	85
PID 4500 wrote to memory of 3156	4500	msedge.exe	85
PID 4500 wrote to memory of 3156	4500	msedge.exe	85
PID 4500 wrote to memory of 3156	4500	msedge.exe	85
PID 4500 wrote to memory of 3156	4500	msedge.exe	85
PID 4500 wrote to memory of 3156	4500	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_42611258b894866b240fabf268e6d5d0.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff764a46f8,0x7fff764a4708,0x7fff764a4718
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8747219373369573641,4337970235763433842,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,8747219373369573641,4337970235763433842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,8747219373369573641,4337970235763433842,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8747219373369573641,4337970235763433842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3032 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8747219373369573641,4337970235763433842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3044 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8747219373369573641,4337970235763433842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8747219373369573641,4337970235763433842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8747219373369573641,4337970235763433842,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3012 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
524B

MD5
a42313524a5c851d697f2ca794d4e954

SHA1
26b8f116de81cd58b89b4e763ee0b9c332acbe8a

SHA256
080a3cbf4239df85ef0b8f48b97ac45418be56e967f1fc963a3e061de45cef35

SHA512
d1007ec819c1942a1b5fb02fd4d3956c2601aceb7f7acbcd107de09443cc0efc9b9324b5f4176e961c020d2d229928ea301409aa7bcbf6d458c5f9c2c6c3bcfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b71819b4a71dd194a9af819be96d4158

SHA1
a9013e5e42ad8ba658f551c14a6019e3dd4d045c

SHA256
b31df7b7e7920e7547f05be70a1c88a80209bb014c33343e9827d3679ff9505d

SHA512
78dabeb48f41ed744defbcc4228dc869d349765241c69395d2008aff4a33c936f5f6fdd3f4afcf5bc591457752f07a9c14ee4251cff4d4c7d9d2ea1d8c7b9011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
33988e01763c831fc355ad4880930e31

SHA1
b210d55581a02b571d3c7e04053d97e6c2dd13ee

SHA256
9eee957b7075d6cc72dc71331929774957c9e3a94149fd2161a6f4b253fc13c0

SHA512
d9780b00efacbb2fb709777298ed4962a786cdc7fa31c482eba31cc7d40c2c925c564db6134b530a929db55b68c42869ebaed9919e116d7b8d513c5c0fd92d3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
17d6a8f1f2a5074cca4f59cea9eec539

SHA1
efc8c9b913a6575c4c4966745df2d7c6ed42b042

SHA256
fac1e4100a92edf2dd831b4e965e09fc067a1dadcf6c58f51fc3f89156278478

SHA512
563af977a178d1718da49a436f5bf47d5cc5deea721c7a46800ba187dc015d9e0e18285fd3bb1663a7dc48551c7e4a6ed1d44b6bebe6a924e212f7c172d5c60a

Download Submit