f00bde2b6aa1f985e306aebeea77ad0c220d6221508195f7ba3a448a404c9a3b

General

Target

05685be3d8b3edab832f4c2c08633d79_JaffaCakes118.html
Size

159KB
MD5

05685be3d8b3edab832f4c2c08633d79
SHA1

310cb2390e7c5968a89e2879a9427b2bbd3be118
SHA256

f00bde2b6aa1f985e306aebeea77ad0c220d6221508195f7ba3a448a404c9a3b
SHA512

85b3c5e0325ca55033ef4afab0092366c974d38d6408db24674768c323110e62cf5f59ce23d277c3c302c581cb44db76c4bd325d2aec99ad6d0ff65496be66eb
SSDEEP

1536:iQRT6rcF61Z9XbyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:i6/i9XbyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4796	msedge.exe
4796	msedge.exe
3548	msedge.exe
3548	msedge.exe
1900	identity_helper.exe
1900	identity_helper.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3548 msedge.exe
3548 msedge.exe
3548 msedge.exe
3548 msedge.exe
3548 msedge.exe
3548 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe
3548	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3548 wrote to memory of 4780	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 4780	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 1148	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 4796	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 4796	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 4848	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 4848	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 4848	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 4848	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 4848	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 4848	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 4848	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 4848	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 4848	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 4848	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 4848	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 4848	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 4848	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 4848	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 4848	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 4848	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 4848	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 4848	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 4848	3548	msedge.exe	msedge.exe
PID 3548 wrote to memory of 4848	3548	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\05685be3d8b3edab832f4c2c08633d79_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb784b46f8,0x7ffb784b4708,0x7ffb784b4718
2⤵
PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16941815102469212783,18276894153258999039,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
2⤵
PID:1148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,16941815102469212783,18276894153258999039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,16941815102469212783,18276894153258999039,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
2⤵
PID:4848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16941815102469212783,18276894153258999039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
2⤵
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16941815102469212783,18276894153258999039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16941815102469212783,18276894153258999039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
2⤵
PID:1160

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16941815102469212783,18276894153258999039,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16941815102469212783,18276894153258999039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
2⤵
PID:3820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16941815102469212783,18276894153258999039,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
2⤵
PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16941815102469212783,18276894153258999039,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
2⤵
PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16941815102469212783,18276894153258999039,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
2⤵
PID:3448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16941815102469212783,18276894153258999039,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3404 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\91782163-2ad2-42c7-98f4-9131842eaebf.tmp
Filesize
6KB

MD5
5c5e654a89a827da2aeef75db30dba91

SHA1
e4b1556c168c7c334b48e50f8f0666c722872085

SHA256
c9b678c99d4bfed3382f7f50454821783e8b38299968091f8d84c8c708b54111

SHA512
a92ffafba7f59fe8770251183dd60c3b32b2e333296dfbbc45efdc33f5048a1cb17b380593bc80b9093d32d606bb53b8e2b0131ece5e0f896a2429d003f32964

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
bf6d3cdc5f11106081e20e5f4aef0321

SHA1
330e04465b3d04b76d2a0556520ca07958dbaeb7

SHA256
f1d1b44ffb4b21e595f83ea8d808fab40c7190e2821f12fde279c56d8d6cb57e

SHA512
9be5a9595b3a9fbe3b2e34cb856ea7f05282dde59deb2db477aa65dc124c25cbf94230c889cb5453c16c286de3efbb7f697917d49833163dca6348ba986770cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
b77e33aca1dd843ceaa47247cbef4fc2

SHA1
5ac2181e4b4038b04d25927557647cda030e6906

SHA256
bee8d83b3082de0301d4611d807dc33edab58eb71e1731de1c053c6b5ff2eb62

SHA512
4fd06916efa8845e12775c93c67896c3cfd01f6c4712318caf49541292de0d735d7b15bd81c0e17baef9296cc310d0e232e39b89057393c10bc2475edd63ddb5

Download Submit
\??\pipe\LOCAL\crashpad_3548_IKDDOTGHRBBFFQWK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads