a1b24384bca4a70fc509194dbe1a97bddd67ca64b999e215b3aee4c1e6e81418

General

Target

639bd13787dfab2ec28bba43356e6e85_JaffaCakes118.html
Size

18KB
MD5

639bd13787dfab2ec28bba43356e6e85
SHA1

e1a9d27b8727182d37a2b7d0df3cde0a4ab19323
SHA256

a1b24384bca4a70fc509194dbe1a97bddd67ca64b999e215b3aee4c1e6e81418
SHA512

47b40b270d3113c76e35ba9156bcc5819580ef5243ac0f7a40a4b6aab20b534a1a698cb1741fc25bddcb48d9e7da2ee4f77a37cd5f83cf2064c739ffe2375d48
SSDEEP

384:hnWXC13xsawG/MUmyoUey19nyiea8Py9D+Sdll57d:913xscGY9D9D+Sp

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3648	msedge.exe
3648	msedge.exe
3780	msedge.exe
3780	msedge.exe
1484	identity_helper.exe
1484	identity_helper.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3780 msedge.exe
3780 msedge.exe
3780 msedge.exe
3780 msedge.exe
3780 msedge.exe
3780 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3780 wrote to memory of 212	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 212	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3480	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3648	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 3648	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 4860	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 4860	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 4860	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 4860	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 4860	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 4860	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 4860	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 4860	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 4860	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 4860	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 4860	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 4860	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 4860	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 4860	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 4860	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 4860	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 4860	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 4860	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 4860	3780	msedge.exe	msedge.exe
PID 3780 wrote to memory of 4860	3780	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\639bd13787dfab2ec28bba43356e6e85_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed41746f8,0x7ffed4174708,0x7ffed4174718
2⤵
PID:212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,326956384937599127,8330811056082256452,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
2⤵
PID:3480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,326956384937599127,8330811056082256452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,326956384937599127,8330811056082256452,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2388 /prefetch:8
2⤵
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,326956384937599127,8330811056082256452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
2⤵
PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,326956384937599127,8330811056082256452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
2⤵
PID:1076

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,326956384937599127,8330811056082256452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3036 /prefetch:8
2⤵
PID:1244

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,326956384937599127,8330811056082256452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3036 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,326956384937599127,8330811056082256452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
2⤵
PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,326956384937599127,8330811056082256452,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
2⤵
PID:1976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,326956384937599127,8330811056082256452,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
2⤵
PID:3112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,326956384937599127,8330811056082256452,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
2⤵
PID:1072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,326956384937599127,8330811056082256452,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
585B

MD5
27338c75d0524ec177992d05130ee922

SHA1
1c1ced50dba0f278b77daa94c8a735680dce1b53

SHA256
2b110031cd95d7604eda4867ef8cca0a8f6b0073da3d0929b76eeaffc276862f

SHA512
6bbfbef4e267b0a7d29556fc0595aea1f0b903cc797643df68ce6040486a36b635b8283396b8f1c8417704a69a7d04f1313974e3cbacb0369ba9296a8acf7480

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d47c42e9d896043a35ad98651ce45cba

SHA1
d26695f6365828cb30104279c688410f8e6c1769

SHA256
b787ad35db8c238208cadaba565ca91021ddc3b736b0e9adcb390090c6e5bf2a

SHA512
bf596ee096c9548c6f0673a99193bbf2ec1b489e60fd3ba243ebfef70b7cdf213d75db05f44a8ce8b8d78e5b1386f466b7c2e1b2258c0d7d1e998c3e22dcb7a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f5b5cf51f493c267760500e451dc177b

SHA1
45b4e33f76bf47c2b6ed19e297c63fa8e977c140

SHA256
a0776f243a925a5949be165aceb1d66cc0f394a8fced5b23bf6b53fa2ffb2b4f

SHA512
58ba0f64b2291abae1acf4d9262bef0ee9d895a104c22ec1f93b142943b61e25b9bdc9107d02ed498cb5d36b21fd64580bf9072291cefa3f76ca09e457875b9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ecec3909ef26edc4d252f5e139d947dc

SHA1
9f640a6272bbf7d58976f6a0e7754e65d8f6cd00

SHA256
fc6034fdc4cfd575fc896ccf443e633887dcc2089d2968a1147d3d6719898741

SHA512
89cec8886b51195a2ccc0b1c12c19b8095d32712214f3fd2718e30bf6a90a4bc934df452df1f59fe557c15c13b32ff6e5385a50819acd619f05af77bf257e210

Download Submit
\??\pipe\LOCAL\crashpad_3780_CQSBGNMTMMBXXDNS

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads