d8fd8ce17a336fcebd02d2317ea296ddf77f7668746c0c2b3d9fcb24dea5c86b

General

Target

03c4807038ef4302963ca1816e515162_JaffaCakes118.html
Size

256KB
MD5

03c4807038ef4302963ca1816e515162
SHA1

9cd83e8463d83f8a8d2d8a91a84e5f899bea4ca5
SHA256

d8fd8ce17a336fcebd02d2317ea296ddf77f7668746c0c2b3d9fcb24dea5c86b
SHA512

4fa8697da459f6ef5bb9241bcf360a45743e50970a5d6afe001fa48894e3d6c15f8cd54d0f7a188ae485638dd490876dda5a6e98c136de90af3fdb174a458f06
SSDEEP

6144:/IKbYeE+y630styzBzSzmPtocC20IusntfO8/3KHjtck:gKE3630st4Pt9C20Iusntm8/3KHjtZ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4480	msedge.exe
4480	msedge.exe
4888	msedge.exe
4888	msedge.exe
3616	identity_helper.exe
3616	identity_helper.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe
4904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4888 msedge.exe
4888 msedge.exe
4888 msedge.exe
4888 msedge.exe
4888 msedge.exe
4888 msedge.exe
4888 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4888 wrote to memory of 1176	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 1176	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 2016	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 4480	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 4480	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 752	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 752	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 752	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 752	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 752	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 752	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 752	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 752	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 752	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 752	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 752	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 752	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 752	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 752	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 752	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 752	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 752	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 752	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 752	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 752	4888	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\03c4807038ef4302963ca1816e515162_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffda12646f8,0x7ffda1264708,0x7ffda1264718
2⤵
PID:1176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,4241733536182065661,7360195720075338205,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
2⤵
PID:2016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,4241733536182065661,7360195720075338205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,4241733536182065661,7360195720075338205,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
2⤵
PID:752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4241733536182065661,7360195720075338205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
2⤵
PID:3736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4241733536182065661,7360195720075338205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
2⤵
PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4241733536182065661,7360195720075338205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
2⤵
PID:1892

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,4241733536182065661,7360195720075338205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
2⤵
PID:4288

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,4241733536182065661,7360195720075338205,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4241733536182065661,7360195720075338205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
2⤵
PID:3052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4241733536182065661,7360195720075338205,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
2⤵
PID:636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4241733536182065661,7360195720075338205,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
2⤵
PID:2712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,4241733536182065661,7360195720075338205,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
2⤵
PID:1472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,4241733536182065661,7360195720075338205,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4800 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4808

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
850f27f857369bf7fe83c613d2ec35cb

SHA1
7677a061c6fd2a030b44841bfb32da0abc1dbefb

SHA256
a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a

SHA512
7b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
dc1c715246ff84ac3c3d472b473eedf5

SHA1
c0a34ba7dc750f4c747e5b6f2774b63f81d1a092

SHA256
ed7a77d836b79254c8e85d808c0de063d64157e38449a65d417b9ba800e51135

SHA512
a3f923819b4316d5890d8e70b8b0e75034e5a42baf098bda3cd7adc49987d5ab607d0be87a7227891f72f931269898728c1b626566cdf94c0fd21ba183058ac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
1d563c06f84a6b70799e7389511e3307

SHA1
3514aa2d4ff34cee687d4eeb3b3bfa20e9a41e05

SHA256
01d12fe01709bf6b0bc2c692ab9c6badbadefebb1237b5683d0ede6eaab3b23c

SHA512
184fa159c3801f22b790afb3b722f3f01f1a947d47d6ce2f9c2c418dd3ca41aa63369a0c5c121a60b6c7d3ed01cde979b417394cbfb06afe2a9f7cb33914e51c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
7dbd55cbc24374dda2f7a4e3bdb0bdf4

SHA1
ead1e213ef0645256570d7b2ae9154b2231aee8f

SHA256
b067fbe3c61e5cb280a30de79390f5dd7cf67e0c1d1fbfba5f8b9545c8193715

SHA512
208ad01f55d4fe158384a561baa0bd7e7d2ad1788e3e74f8f8d647c79cc7b407c056eb6d651eb58e8de558ba939290c76ea1c79d8ae0cedf501623461455e9e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
dc5126fd64fc17a721089728d0030266

SHA1
bd7575dddaea0b99c33777716949716d70096549

SHA256
8e095584bb3993a11bfcc4477cb3d78896aba0fac7bef2caebbb4f9f5fedd5d2

SHA512
1757e0c3e65c9c6588001921965bcd531c39e125e7d76e1095308d4bfeb77f3be12478f72ae9e268b4a03a8bb9bb82071533a20192d737a3083d3052d1e0cc50

Download Submit
\??\pipe\LOCAL\crashpad_4888_OMWDWVGLRPJXIEZV
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads