f4bbd91d1f48d4d286335677973bee1605c40023244acab79230cd45d14e9e5d

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2025 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_7b7c728f0c2c903d0e15936453671504.html
Size

160KB
MD5

7b7c728f0c2c903d0e15936453671504
SHA1

6e0b719a7653abe0f9543268df0b04c99cc82195
SHA256

f4bbd91d1f48d4d286335677973bee1605c40023244acab79230cd45d14e9e5d
SHA512

880fad7e9a70ae552957df7b91b94fd9637600e1362421130a7b2ab4ffd13a4e22e26df8da64d0b434866db4ffea246016ba97e34d7c6c763fd66165d3245446
SSDEEP

768:20k1ATx+Bw24Tp7VD6z2/uI8I6uiWhWcVI0Hoy57EUJ3uCmWDrODQPydd7rxq0p3:2AHD6cARcVvo1UJdcFpa7XHcDO0tpvH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2032	msedge.exe
2032	msedge.exe
3812	msedge.exe
3812	msedge.exe
1912	identity_helper.exe
1912	identity_helper.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe
3812	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 3128	3812	msedge.exe	83
PID 3812 wrote to memory of 3128	3812	msedge.exe	83
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 4916	3812	msedge.exe	84
PID 3812 wrote to memory of 2032	3812	msedge.exe	85
PID 3812 wrote to memory of 2032	3812	msedge.exe	85
PID 3812 wrote to memory of 2996	3812	msedge.exe	86
PID 3812 wrote to memory of 2996	3812	msedge.exe	86
PID 3812 wrote to memory of 2996	3812	msedge.exe	86
PID 3812 wrote to memory of 2996	3812	msedge.exe	86
PID 3812 wrote to memory of 2996	3812	msedge.exe	86
PID 3812 wrote to memory of 2996	3812	msedge.exe	86
PID 3812 wrote to memory of 2996	3812	msedge.exe	86
PID 3812 wrote to memory of 2996	3812	msedge.exe	86
PID 3812 wrote to memory of 2996	3812	msedge.exe	86
PID 3812 wrote to memory of 2996	3812	msedge.exe	86
PID 3812 wrote to memory of 2996	3812	msedge.exe	86
PID 3812 wrote to memory of 2996	3812	msedge.exe	86
PID 3812 wrote to memory of 2996	3812	msedge.exe	86
PID 3812 wrote to memory of 2996	3812	msedge.exe	86
PID 3812 wrote to memory of 2996	3812	msedge.exe	86
PID 3812 wrote to memory of 2996	3812	msedge.exe	86
PID 3812 wrote to memory of 2996	3812	msedge.exe	86
PID 3812 wrote to memory of 2996	3812	msedge.exe	86
PID 3812 wrote to memory of 2996	3812	msedge.exe	86
PID 3812 wrote to memory of 2996	3812	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b7c728f0c2c903d0e15936453671504.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbcd7746f8,0x7ffbcd774708,0x7ffbcd774718
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,17359990272422155302,8383011477649955977,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,17359990272422155302,8383011477649955977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,17359990272422155302,8383011477649955977,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17359990272422155302,8383011477649955977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17359990272422155302,8383011477649955977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17359990272422155302,8383011477649955977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,17359990272422155302,8383011477649955977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,17359990272422155302,8383011477649955977,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17359990272422155302,8383011477649955977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17359990272422155302,8383011477649955977,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17359990272422155302,8383011477649955977,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,17359990272422155302,8383011477649955977,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,17359990272422155302,8383011477649955977,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62e6ffe7501e581c80b178323e921b81

SHA1
d0881a3d0aee1c256291d34a90e3092fffa60ce2

SHA256
a4f50a6b36e27013a694382c996a1d3059d38310a138f21aa25cc682be5cb0e5

SHA512
0c4e34fc9a7c5308b1cd05ea71d78c75a9fb85267d7f3e5616dbc1390794941eb549bcc70f7430046ca79cc0055edf0bd51b8eb43f84ee42163dd34d612ba137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
65a84cd7925378cc74972cc4e677ecef

SHA1
30b4da4c5dbd0cc77d756d270ad260ef74987ccf

SHA256
7be0a4cebd74cb4d879e3f9950f5ac5a05acc3bdc415bbf9d3dd691cccee2cb5

SHA512
ef142224cc0b94a1c5585836988a0d544e7e8b5e8573a1893c9fac528a1ccbbab6c9c7acaad7cfec1a415544bbdcdfd1d0c5e0a0819cb94107fd81989df18704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
394B

MD5
cb266e2d035f56e39f725ff2c979b432

SHA1
2f56062561fc18062d3f913e08132baf68bac50b

SHA256
e45ac475b052edf1c6fa3f27fdf07f724b06f797e44c8ffb5deca0cb112bfb6a

SHA512
47c43f6ab09be416159bddeb2c1ff44aa2a201168718e0b59a48f163a28664fbd28f4d12f0abdc9fcf3ae541b5b2e2ed9cf71b6ed1dc1edca866644012f7a7f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
20c1feb2a2a948d2c5efa0421bfecb50

SHA1
e93d15b9e0cbd0374d143367f18f065a503dfccd

SHA256
81e521c3c2a49b307fddc9f9de368d95e53b99ba84e5af198359c95e1c63e0a6

SHA512
eba0f51377166eab6d68e601579ce1a42b45b520092482fd90addb51a5504444d225f8031d0f64a50a0d09be06d976e818f9d068b9448359dec80143e475883b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
94ab9cdded486b4e597efbf74eea44f7

SHA1
86f45890068cee6761edf4ee3cecc904d3e80d8d

SHA256
20622831904e9a5fe946686e314a701855dd5a708d2c80cc4d3a4c8776dd717f

SHA512
f96bb54fd6d6f4f526a771755ee5bb83f6881ea43b253e9e0592ec50b7e77e0df1af5c13c20e3f1d2907b02e4a5c5e2efc5d85f611316a7262586536430f2246

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7ce938cdf5b8715527cb7c88498a5673

SHA1
9874f9c746cf7342b6208805129ccd8400f93e48

SHA256
c84b50ba8571b256ca973e5ee1929ef6d7713d6589d1e429f5223a485fbe085c

SHA512
fd77b0be522e3af9b0ff45bef1d522dde5fe2cb1e2c745654569ebdcdc711b667282a060335c295f57a71bdca306cc97e149d92c8a8c7a0a00e3f1450f0a2b99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6c47e28aceb58937e2459c151e517429

SHA1
dc0f0919f7e9ef7e737c640fd6acbc05cac52407

SHA256
b968f98b1a9be356f5000ea91f8922f5fa758fd6b8ee86ffd4e78a9482e3fc9a

SHA512
63967073f0bc3ef2903d9f6d86c269d4c77c6a4d09fa425841bf311ad73e8896076d07869c3f28d84e1cb7451f4d72fa555e60f8bc9519c2375b3a6e78cc299a

Download Submit