827f3500b12b93ed78a56e565dc75de8f13717155df561c69b901e71a8f0edd7

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2025, 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_626147a8b4d40c89643c5c106178292a.html
Size

67KB
MD5

626147a8b4d40c89643c5c106178292a
SHA1

8eff86b65e16d21e24688d4e3e5accac590560c2
SHA256

827f3500b12b93ed78a56e565dc75de8f13717155df561c69b901e71a8f0edd7
SHA512

476ad24cd7f58a7d07ab7c4253a473b3c6db461991a5ba0f921d8954cac1bac32cbdaa99b06a646a2fe32010e196afe29ad943efb4b5b68e577b41ca4a28c134
SSDEEP

1536:ZdzGwhEGtlNJQL1s2SBKxmEq/4Hsj4sRGQf1detfq6:ZdzGwhEGtlNz2S4xpq/4Hsj4sfdetfq6

Score

6^/10

discovery motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc	pid	Process
100	https://jira.ops.aol.com/secure/attachment/688199/failwhale.html	3016	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3016	msedge.exe
3016	msedge.exe
5012	msedge.exe
5012	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 3332	5012	msedge.exe	85
PID 5012 wrote to memory of 3332	5012	msedge.exe	85
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 2732	5012	msedge.exe	86
PID 5012 wrote to memory of 3016	5012	msedge.exe	87
PID 5012 wrote to memory of 3016	5012	msedge.exe	87
PID 5012 wrote to memory of 2192	5012	msedge.exe	88
PID 5012 wrote to memory of 2192	5012	msedge.exe	88
PID 5012 wrote to memory of 2192	5012	msedge.exe	88
PID 5012 wrote to memory of 2192	5012	msedge.exe	88
PID 5012 wrote to memory of 2192	5012	msedge.exe	88
PID 5012 wrote to memory of 2192	5012	msedge.exe	88
PID 5012 wrote to memory of 2192	5012	msedge.exe	88
PID 5012 wrote to memory of 2192	5012	msedge.exe	88
PID 5012 wrote to memory of 2192	5012	msedge.exe	88
PID 5012 wrote to memory of 2192	5012	msedge.exe	88
PID 5012 wrote to memory of 2192	5012	msedge.exe	88
PID 5012 wrote to memory of 2192	5012	msedge.exe	88
PID 5012 wrote to memory of 2192	5012	msedge.exe	88
PID 5012 wrote to memory of 2192	5012	msedge.exe	88
PID 5012 wrote to memory of 2192	5012	msedge.exe	88
PID 5012 wrote to memory of 2192	5012	msedge.exe	88
PID 5012 wrote to memory of 2192	5012	msedge.exe	88
PID 5012 wrote to memory of 2192	5012	msedge.exe	88
PID 5012 wrote to memory of 2192	5012	msedge.exe	88
PID 5012 wrote to memory of 2192	5012	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_626147a8b4d40c89643c5c106178292a.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdab8346f8,0x7ffdab834708,0x7ffdab834718
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,647119215537637345,18254856288844442445,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,647119215537637345,18254856288844442445,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Mark of the Web detected: This indicates that the page was originally saved or cloned.
  - Suspicious behavior: EnumeratesProcesses
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,647119215537637345,18254856288844442445,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,647119215537637345,18254856288844442445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,647119215537637345,18254856288844442445,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,647119215537637345,18254856288844442445,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fe6fb7ffeb0894d21284b11538e93bb4

SHA1
80c71bf18f3798129931b1781115bbef677f58f0

SHA256
e36c911b7dbea599da8ed437b46e86270ce5e0ac34af28ac343e22ecff991189

SHA512
3a8bd7b31352edd02202a7a8225973c10e3d10f924712bb3fffab3d8eea2d3d132f137518b5b5ad7ea1c03af20a7ab3ff96bd99ec460a16839330a5d2797753b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1bed6483de34dd709e03fd3af839a76b

SHA1
3724a38c9e51fcce7955a59955d16bf68c083b92

SHA256
37a42554c291f46995b2487d08d80d94cefe6c7fb3cb4ae9c7c5e515d6b5e596

SHA512
264f6687ea8a8726b0000de1511b7b764b3d5a6f64946bb83a58effda42839e593de43865dafeeb89f5b78cc00d16f3979b417357fa2799ca0533bdf72f07fda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
cde6099dd522a1a207a5c6ab4a569a68

SHA1
ebb87589bd6585e60148999aa1fade607566eecf

SHA256
1779dba4f26b8ca26f7e4f7c3d47ac833f470c60e61ed75bb68193e4ecfbb147

SHA512
4cfe2ccea2e87dbe59e583801dfccb40350ff75b2c886ab220d9bdceb481ee57b70ef0849417c586dd94a2f2a5d5181517ea537713d79d24709eb174d01395b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
15d64456b00f8cee9ab0f32571c86c9f

SHA1
84076ea8ad47f6f076b95426c2dd75ef340fefd0

SHA256
a1928c0928f67ff8470710b16a75779fefa4c0ceb585af4de87f6c540412ca98

SHA512
c47ec2e7111f6d0721a51ace57abb4734f97b0463c083a2050ec86ebce6c56613f97d9602eade7d94af5fc8ef112d8e5c47850a9fcc7c1cab48b03285a2d08d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9efb1e4a3f34c079213b78e659fcdbed

SHA1
48e58de50ddaace946fda71d1c15fcabcd32e906

SHA256
04d57bdd19ed6d1dc74ac5077ac51431b8f5ed478715c0a3781063d213d0fdad

SHA512
974188be4b861d56ea02757cf3ba86fa415dacc925bf5534e569bf1221adc35d2eecf0af370a3e43af5b67bdfdeccca1d6e060e33211b38b6513c8f8177cb71d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
00276f5bfa8fa8b2270611ab681426ff

SHA1
eb8851bf9c39d6beb11180778fdba4bbbaccc472

SHA256
08f9e147b058c777d705e5454d497dfafcc2ae672c2d3a762719eec65ff93c61

SHA512
308b54b4d4387b4f1303db3f098ea3a7dd9f3c077973a72195de10a75c9859842d9901205d03b7a8d6e2e70cae9a47639cdc59d7a6724d7ce27f1add4ab71ef9

Download Submit