1b07a1b23dcf7580054790f7f4943f49c3e80b291b8ff4060d85465799a134b1

General

Target

04cd8dfbe08f3497e0e37848abf8be91_JaffaCakes118.html
Size

348KB
MD5

04cd8dfbe08f3497e0e37848abf8be91
SHA1

860aad71adc66a3fe512c0dc84a8a3c4734d48fe
SHA256

1b07a1b23dcf7580054790f7f4943f49c3e80b291b8ff4060d85465799a134b1
SHA512

98d507acf25a6f6eff050ea4f3f973d819c37a46686891f0d80a1828be4e147c41c78d936975aa3dbf048848311f4d073fb3a2a1aaf39ca1676c2be62e9f680b
SSDEEP

6144:SAisMYod+X3oI+YGQsMYod+X3oI+YZsMYod+X3oI+YQ:3g5d+X355d+X3L5d+X3+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1248	msedge.exe
1248	msedge.exe
3180	msedge.exe
3180	msedge.exe
1880	identity_helper.exe
1880	identity_helper.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3180 msedge.exe
3180 msedge.exe
3180 msedge.exe
3180 msedge.exe
3180 msedge.exe
3180 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe
3180	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3180 wrote to memory of 316	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 316	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 4720	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 1248	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 1248	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 1324	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 1324	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 1324	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 1324	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 1324	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 1324	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 1324	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 1324	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 1324	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 1324	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 1324	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 1324	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 1324	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 1324	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 1324	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 1324	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 1324	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 1324	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 1324	3180	msedge.exe	msedge.exe
PID 3180 wrote to memory of 1324	3180	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\04cd8dfbe08f3497e0e37848abf8be91_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f8ab46f8,0x7ff8f8ab4708,0x7ff8f8ab4718
2⤵
PID:316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,12464016478938883989,13618978664754403299,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
2⤵
PID:4720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,12464016478938883989,13618978664754403299,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,12464016478938883989,13618978664754403299,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
2⤵
PID:1324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12464016478938883989,13618978664754403299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
2⤵
PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12464016478938883989,13618978664754403299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
2⤵
PID:3844

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,12464016478938883989,13618978664754403299,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4460 /prefetch:8
2⤵
PID:1732

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,12464016478938883989,13618978664754403299,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4460 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12464016478938883989,13618978664754403299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4368 /prefetch:1
2⤵
PID:4404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12464016478938883989,13618978664754403299,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
2⤵
PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12464016478938883989,13618978664754403299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:1
2⤵
PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12464016478938883989,13618978664754403299,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4468 /prefetch:1
2⤵
PID:1344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,12464016478938883989,13618978664754403299,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4620

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
d6606658bb4940deb8604c9c08499d1b

SHA1
f774f853f885e76dbc3923b4334765599670f15b

SHA256
06cb13f4d03693e318f3a72c8a597c9caa7801063809a2d53d4d25c466d9f0ca

SHA512
1fecbedc119b751c7bad5043fde75528003400a3e23236d8078e58c9c7ffe2b700afde330305b8036417e201f57fa18fa087f0ce8f7ccdb1c509558d85d48d6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
92271973d4404f94e05c3b9f125dd221

SHA1
ca0d5b307f45b46343f9e77cc007c75b090ebcb6

SHA256
dc099caea4f1e4af50b22d1c9cc03a6d7e201188f3bc81286eb5741ee3107572

SHA512
6814b8672be2484f0a7027eea52df9ce3506045cdd5cfd424475d4d3d4d0cf949413486976b79fabb7e4a75e5b429aa41fa8c44fcd98c620886ead8ea7aec619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
13f2599fcff553125008dbb1cf493e2b

SHA1
788164e7f58fcdd8e32c8779350285115348d336

SHA256
b59534d10320ad072d478a5939e00efa953112dffebe7feec6729eba3f82c115

SHA512
41638419fd43d5fdef112e8f31abf926435cb9e33271524cbfdeabab6035a8ef5e665a3f247f86564dd2d5e0ae7bad60f41fc2f043b83d4a6ec4b6072aed9bf2

Download Submit
\??\pipe\LOCAL\crashpad_3180_DRLBQBWXXSYSHIVL
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads