98f1086120c564b1e5c8db75a344a742b56b444e7da1c212f82d57a2f09cb84e

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
31/01/2025, 00:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_67c06353effb2dea7a894f2ea90a7bf5.html
Size

369KB
MD5

67c06353effb2dea7a894f2ea90a7bf5
SHA1

9978f643b17ae9caac7d4d958a255cacc9fd7591
SHA256

98f1086120c564b1e5c8db75a344a742b56b444e7da1c212f82d57a2f09cb84e
SHA512

76c53b1d0c35d8df4d9ef12d1a18ca0c92e5511f397eac16ff0a6eaa52e51a22fa7a994217b4aa6fc653f1392580cec8c04d527bdfdfac1f0e08b969afb09667
SSDEEP

3072:kE9zUTvuH8ophMbyRZp2vERII9Bz6QLepldI4dQNuK/AmvRW:saH8oeyBs6I8Bz76p3dQNvRZW

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
3288	msedge.exe
3288	msedge.exe
3780	identity_helper.exe
3780	identity_helper.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 2588	3288	msedge.exe	83
PID 3288 wrote to memory of 2588	3288	msedge.exe	83
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 1596	3288	msedge.exe	85
PID 3288 wrote to memory of 4704	3288	msedge.exe	86
PID 3288 wrote to memory of 4704	3288	msedge.exe	86
PID 3288 wrote to memory of 4816	3288	msedge.exe	87
PID 3288 wrote to memory of 4816	3288	msedge.exe	87
PID 3288 wrote to memory of 4816	3288	msedge.exe	87
PID 3288 wrote to memory of 4816	3288	msedge.exe	87
PID 3288 wrote to memory of 4816	3288	msedge.exe	87
PID 3288 wrote to memory of 4816	3288	msedge.exe	87
PID 3288 wrote to memory of 4816	3288	msedge.exe	87
PID 3288 wrote to memory of 4816	3288	msedge.exe	87
PID 3288 wrote to memory of 4816	3288	msedge.exe	87
PID 3288 wrote to memory of 4816	3288	msedge.exe	87
PID 3288 wrote to memory of 4816	3288	msedge.exe	87
PID 3288 wrote to memory of 4816	3288	msedge.exe	87
PID 3288 wrote to memory of 4816	3288	msedge.exe	87
PID 3288 wrote to memory of 4816	3288	msedge.exe	87
PID 3288 wrote to memory of 4816	3288	msedge.exe	87
PID 3288 wrote to memory of 4816	3288	msedge.exe	87
PID 3288 wrote to memory of 4816	3288	msedge.exe	87
PID 3288 wrote to memory of 4816	3288	msedge.exe	87
PID 3288 wrote to memory of 4816	3288	msedge.exe	87
PID 3288 wrote to memory of 4816	3288	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_67c06353effb2dea7a894f2ea90a7bf5.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3ccb46f8,0x7ffa3ccb4708,0x7ffa3ccb4718
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,5892774491304508751,4080900330657168977,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,5892774491304508751,4080900330657168977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,5892774491304508751,4080900330657168977,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5892774491304508751,4080900330657168977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5892774491304508751,4080900330657168977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,5892774491304508751,4080900330657168977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,5892774491304508751,4080900330657168977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5892774491304508751,4080900330657168977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5892774491304508751,4080900330657168977,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5892774491304508751,4080900330657168977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,5892774491304508751,4080900330657168977,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,5892774491304508751,4080900330657168977,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62e6ffe7501e581c80b178323e921b81

SHA1
d0881a3d0aee1c256291d34a90e3092fffa60ce2

SHA256
a4f50a6b36e27013a694382c996a1d3059d38310a138f21aa25cc682be5cb0e5

SHA512
0c4e34fc9a7c5308b1cd05ea71d78c75a9fb85267d7f3e5616dbc1390794941eb549bcc70f7430046ca79cc0055edf0bd51b8eb43f84ee42163dd34d612ba137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
65a84cd7925378cc74972cc4e677ecef

SHA1
30b4da4c5dbd0cc77d756d270ad260ef74987ccf

SHA256
7be0a4cebd74cb4d879e3f9950f5ac5a05acc3bdc415bbf9d3dd691cccee2cb5

SHA512
ef142224cc0b94a1c5585836988a0d544e7e8b5e8573a1893c9fac528a1ccbbab6c9c7acaad7cfec1a415544bbdcdfd1d0c5e0a0819cb94107fd81989df18704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3a1d247b389a0e989997be9b696fb3b2

SHA1
d4bfd20bc854f665a80e843e783af5f293c14a4d

SHA256
b6fcf464010028399485191a6487318f224a83073bcf3e6aa7efba7923f82751

SHA512
3867528f399cd5968ac3c6ba638ab9afcb3c19dc3d26c8dcfe641ee5a352b2703d398fe2803e9f0d4b2c44f933ad1f36daa7b4e0964a8f5249a2d98920958241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c54427431f3739ec9fffca30b3097b24

SHA1
cc7c5f7bca04da042402579dee647f31ea2ca369

SHA256
dcb8ecb46371a08ae70d9d593b181275036c0d69b7e49d955782764d4e06138a

SHA512
8cef832bcacb8eaef0ea87aa80df4ab7b39ca2292dd00a379b7316c65afed998ce0519b98b84bcde3e60c4d9f7c3100384f8c9d79d5ee8c1606dfd9239d25ee2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a8b51b7efa5ce630bb076b7fdeca5de5

SHA1
8a6293ab014feed3fd28f8b400e5f902f5a11c93

SHA256
2c0b2601a57355c0e53eff1324d4b7510be5ac69770731eeed96b15c356580a8

SHA512
d36b453ceca661814d740901cdd91a3bcf7b6c124a12d0914cd1e6a03c09876e6d680e182606bd8cd0001b0f5d0587329ec35df3540f5ab58df514539ba4c45d

Download Submit