e654d3e98f9f25b49f5f649a9347aca833f4ae232e0a0617a247c80985086fbf

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
05-02-2025 12:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_9f9272be659d03ab5153e08f552911cf.html
Size

130KB
MD5

9f9272be659d03ab5153e08f552911cf
SHA1

71f1b8173c511d6d72ed77bb4a96de521796d11e
SHA256

e654d3e98f9f25b49f5f649a9347aca833f4ae232e0a0617a247c80985086fbf
SHA512

cd5e6024ee88e07d06c3f418ef5a4b784f88a2a2bfb69b23edda7e6f8841993de84a9a6f495fc2b51ca6b1b5ca7c1660c70a9c768bc2bbdbc03a347a646dff3c
SSDEEP

768:2Hk1ATx+Bw24Tp7VkiLSOidNCiZW0HI8JjoE5Jcsm09XWhCFAfDv1p4ODMtFA6cB:25HkieuiZdIXE5F4ZDMtFbcDO0tgWf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
832	msedge.exe
832	msedge.exe
1540	msedge.exe
1540	msedge.exe
448	identity_helper.exe
448	identity_helper.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 4736	1540	msedge.exe	85
PID 1540 wrote to memory of 4736	1540	msedge.exe	85
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 3508	1540	msedge.exe	86
PID 1540 wrote to memory of 832	1540	msedge.exe	87
PID 1540 wrote to memory of 832	1540	msedge.exe	87
PID 1540 wrote to memory of 3180	1540	msedge.exe	88
PID 1540 wrote to memory of 3180	1540	msedge.exe	88
PID 1540 wrote to memory of 3180	1540	msedge.exe	88
PID 1540 wrote to memory of 3180	1540	msedge.exe	88
PID 1540 wrote to memory of 3180	1540	msedge.exe	88
PID 1540 wrote to memory of 3180	1540	msedge.exe	88
PID 1540 wrote to memory of 3180	1540	msedge.exe	88
PID 1540 wrote to memory of 3180	1540	msedge.exe	88
PID 1540 wrote to memory of 3180	1540	msedge.exe	88
PID 1540 wrote to memory of 3180	1540	msedge.exe	88
PID 1540 wrote to memory of 3180	1540	msedge.exe	88
PID 1540 wrote to memory of 3180	1540	msedge.exe	88
PID 1540 wrote to memory of 3180	1540	msedge.exe	88
PID 1540 wrote to memory of 3180	1540	msedge.exe	88
PID 1540 wrote to memory of 3180	1540	msedge.exe	88
PID 1540 wrote to memory of 3180	1540	msedge.exe	88
PID 1540 wrote to memory of 3180	1540	msedge.exe	88
PID 1540 wrote to memory of 3180	1540	msedge.exe	88
PID 1540 wrote to memory of 3180	1540	msedge.exe	88
PID 1540 wrote to memory of 3180	1540	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9f9272be659d03ab5153e08f552911cf.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb479c46f8,0x7ffb479c4708,0x7ffb479c4718
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,14304968053892907370,18032640882691675681,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,14304968053892907370,18032640882691675681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,14304968053892907370,18032640882691675681,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14304968053892907370,18032640882691675681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14304968053892907370,18032640882691675681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14304968053892907370,18032640882691675681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,14304968053892907370,18032640882691675681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,14304968053892907370,18032640882691675681,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14304968053892907370,18032640882691675681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14304968053892907370,18032640882691675681,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14304968053892907370,18032640882691675681,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14304968053892907370,18032640882691675681,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,14304968053892907370,18032640882691675681,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3592 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
62e6ffe7501e581c80b178323e921b81

SHA1
d0881a3d0aee1c256291d34a90e3092fffa60ce2

SHA256
a4f50a6b36e27013a694382c996a1d3059d38310a138f21aa25cc682be5cb0e5

SHA512
0c4e34fc9a7c5308b1cd05ea71d78c75a9fb85267d7f3e5616dbc1390794941eb549bcc70f7430046ca79cc0055edf0bd51b8eb43f84ee42163dd34d612ba137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
65a84cd7925378cc74972cc4e677ecef

SHA1
30b4da4c5dbd0cc77d756d270ad260ef74987ccf

SHA256
7be0a4cebd74cb4d879e3f9950f5ac5a05acc3bdc415bbf9d3dd691cccee2cb5

SHA512
ef142224cc0b94a1c5585836988a0d544e7e8b5e8573a1893c9fac528a1ccbbab6c9c7acaad7cfec1a415544bbdcdfd1d0c5e0a0819cb94107fd81989df18704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
588B

MD5
6ceed50f5019e3cc3725e6193e510a34

SHA1
892cd723bf112bb7030c632e9706b96aaa91b2a2

SHA256
100f8bab911819fa4d775ba9f2e9056437cc1a5232a558a9fa3efbf8d9b880fb

SHA512
8b066ebdb611c82023b7d8b31b0d9d526bd985d5d1a2c12cdaec05e75dd32a5174c2b9e2b784a83cc534c491c1ae24a5eb237b595ff8025a032c90df98f02984

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
24d1ab0ef88f4fe1031eb94cd01cbdfc

SHA1
6663933cca6d9ef2607e18031ae27c884ed9174d

SHA256
73faa8f1baae841c204941f867212fb797da01d7f37f7eeb7ec27edca44e4725

SHA512
d2ef9c5c79b100025d8dd4a19d16ec486a9c7a6fcaa4fd61c74493432d7aa3da791ad33973c86e01d3f5546b7d0906e9de2141905074e6899130df4ba4952f3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5073198778ec5fffa1aee3fe2d541d52

SHA1
8600c48fcedc9cefa753b353cf8d701863f90635

SHA256
901b871c9110b56c4f6c30d260b4944cbff1d2bf534c64fbc700d0b5aa17a7d9

SHA512
4e88e53da2767390af1dc89fdf66f2d05e970673a61a236a35be7928fad77cc24e7a5b29edcaa8ac298485acb414f1917b0ac68836682556445712f6718811d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e8eef129a34c9996a9e676f96ad017d3

SHA1
8ee836f1787e7a9ed82e44700d3403dee0b6367a

SHA256
b01c5a684bde6ff50826ff291c83d185f5aa78b06a28bc3f87115c92de41bc8e

SHA512
af73e978754820d9a11b7773b64e8bc11f9b57adb9a7019b0614da917af0fb6f061c34dcae3215aa046d01e161c6dcd0811d463ea26732da9ade409483894bc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0b78d0bf44cc64e9b204346e7e50299e

SHA1
10fe6441de5153e1a83b5541a950c3b61506a4fb

SHA256
503e7332b7369f322811583a4da5a04f4d8d39acbcb37e48426141d3e81403a7

SHA512
57c0abe52a2ce1120a52a1003e4eb531a0d5387c3fc3f51050320010c4e44c9ed36b979b9f774c6544205e6efbd4a44d04e927b62e6bcb07ec18e213f4d1fae8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
839a7ae98526d5e640daf3c657bad989

SHA1
90f04c92cbe009cc7e30713d70429f2c9e256d85

SHA256
957025828a69e46730cc56de6088a966269e0d6640b54eef5be896d9c0e50652

SHA512
0904a5f0decf89e65d929b3164f5620952e8367eed0ea547b5c1afbb5432b144108a8dc6dbb63baa96c8df217d28b2bbe385237507fa9fb615cef1c60267da55

Download Submit