4a33503158395b90a8321f491d877c437f2709b8b210fedf4436848fa019ed42

General

Target

04899cbbd30f5ef5f3a5aa75d60f88d4_JaffaCakes118.html
Size

182KB
MD5

04899cbbd30f5ef5f3a5aa75d60f88d4
SHA1

3a2b622a2507917b19e274dc659f025936e12f68
SHA256

4a33503158395b90a8321f491d877c437f2709b8b210fedf4436848fa019ed42
SHA512

f39ca425c7590ff720b432f852a4cbd1bcd96c0e9633e2d5a233cde2770c2905e3d0dae650842f2f82ac44d6c599a0e31262348a70ed49981ba458bce4d96636
SSDEEP

3072:x/ihSyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFiM:x0XsMYod+X3oI+Yn86/U9jFiM

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
760	msedge.exe
760	msedge.exe
3916	msedge.exe
3916	msedge.exe
4140	identity_helper.exe
4140	identity_helper.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3916 msedge.exe
3916 msedge.exe
3916 msedge.exe
3916 msedge.exe
3916 msedge.exe
3916 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3916 wrote to memory of 4744	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4744	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4492	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 760	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 760	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4960	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4960	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4960	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4960	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4960	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4960	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4960	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4960	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4960	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4960	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4960	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4960	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4960	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4960	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4960	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4960	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4960	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4960	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4960	3916	msedge.exe	msedge.exe
PID 3916 wrote to memory of 4960	3916	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\04899cbbd30f5ef5f3a5aa75d60f88d4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff287346f8,0x7fff28734708,0x7fff28734718
2⤵
PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7433571122919690519,1874253245532895363,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
2⤵
PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,7433571122919690519,1874253245532895363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,7433571122919690519,1874253245532895363,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
2⤵
PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7433571122919690519,1874253245532895363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
2⤵
PID:3076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7433571122919690519,1874253245532895363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
2⤵
PID:4668

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7433571122919690519,1874253245532895363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4604 /prefetch:8
2⤵
PID:2008

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7433571122919690519,1874253245532895363,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4604 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7433571122919690519,1874253245532895363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
2⤵
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7433571122919690519,1874253245532895363,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
2⤵
PID:2012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7433571122919690519,1874253245532895363,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
2⤵
PID:1976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7433571122919690519,1874253245532895363,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
2⤵
PID:2700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7433571122919690519,1874253245532895363,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4684 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2028

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
22e3a1679f39dae8d7087758d35d87dd

SHA1
76ad8f510f58c9fca82e1f1efb08a7e4b9a971d3

SHA256
67ff84e89489c09c9c5af0058a110e9698d3d1210c6ec94927f79699f94082bc

SHA512
22d449983f356f6b20e7e15c7c7b0398c249a0484779be1726b72482b56b4ddb4aac5fd964ea110c0152ed63bad651ea0499d1482cedc0740d4a00046669fabd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
fb5e7bac742b6e2cd7740d6e3ef2cec3

SHA1
7e3d503b5479a552f2d70843f6a50f3b171874fa

SHA256
0943ac54b0ca70e0886a2f2f3860029e60ed380cddc0791ed8b6f6c4119e1b14

SHA512
4dbd9c995d42740ce434ab39c2d57ec6cdcbc408345a18289f94be766daff6bff86e6394708b56a05a5bd482b12e003f97143672230bbf7541f3052c216bd160

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
c124f97b14cab618abe0c3cd2b09fa29

SHA1
9e42f7e4bb8cbd517a8e081164b046e45411054a

SHA256
c315348feacfad273533de1321d0bdcdfd52941cca016f988df3d52d3342d202

SHA512
afb9dfd943dc786fa893a12c82b4e4c15402e664dd8dbb4f52e383b9f2a548efa174ce5c99ff1c73363cc0090a0456dd2c8c7fd7fac16f63c48c42267699b22d

Download Submit
\??\pipe\LOCAL\crashpad_3916_VKHDYPLYIVIIIXJT
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads