a7fe549d4a3729a029aca7dbe773f097851d3e87c9e8d4827c94b7d86ca5b9e7

General

Target

63beefdd8ba45cea879fadb0d39bbd86_JaffaCakes118.html
Size

3KB
MD5

63beefdd8ba45cea879fadb0d39bbd86
SHA1

d6af004248715657c4170bf4a87e17ae3f5dc37c
SHA256

a7fe549d4a3729a029aca7dbe773f097851d3e87c9e8d4827c94b7d86ca5b9e7
SHA512

004c8dff8dab0b966006fbf0db60186e1ebddc7f2e178119588d9f64cf5f21da7aa2071d5c4519301a015dba4761c926f9ae0cd7979136505653303ba1dd8743

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
316	msedge.exe
316	msedge.exe
3376	msedge.exe
3376	msedge.exe
392	identity_helper.exe
392	identity_helper.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3376 msedge.exe
3376 msedge.exe
3376 msedge.exe
3376 msedge.exe
3376 msedge.exe
3376 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3376 wrote to memory of 4336	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 4336	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 3740	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 316	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 316	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 1440	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 1440	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 1440	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 1440	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 1440	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 1440	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 1440	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 1440	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 1440	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 1440	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 1440	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 1440	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 1440	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 1440	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 1440	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 1440	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 1440	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 1440	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 1440	3376	msedge.exe	msedge.exe
PID 3376 wrote to memory of 1440	3376	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63beefdd8ba45cea879fadb0d39bbd86_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdb8546f8,0x7ffcdb854708,0x7ffcdb854718
2⤵
PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17583838644170050802,2694654827500434053,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
2⤵
PID:3740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,17583838644170050802,2694654827500434053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,17583838644170050802,2694654827500434053,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
2⤵
PID:1440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17583838644170050802,2694654827500434053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17583838644170050802,2694654827500434053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
2⤵
PID:2656

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,17583838644170050802,2694654827500434053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
2⤵
PID:2884

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,17583838644170050802,2694654827500434053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17583838644170050802,2694654827500434053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
2⤵
PID:4008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17583838644170050802,2694654827500434053,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
2⤵
PID:3152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17583838644170050802,2694654827500434053,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
2⤵
PID:872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17583838644170050802,2694654827500434053,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
2⤵
PID:3792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17583838644170050802,2694654827500434053,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1372 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2184

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
276B

MD5
63e94862b42530f86676ad4d8dad984d

SHA1
3fd2230f79711e641c7d8bc1fc8f6d671319aec8

SHA256
02bd271fbf1d8f8cfeb229ec24d7bfb1c261116853c2e66a3f5d0b3536f59a25

SHA512
8f57ba1d96f3a97a7867f7eb43efd22baea3a78766fd88e87affcbc1e2e1699de833cbe9d78d22fa784ebf9602bd2006ee315ea13aebbcb79b56ec137c7a5aff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
7ef8ebe1b05e571cd9e50ca8a56b271e

SHA1
c9b168bbcbe8a4f1f57b9d3d4f5687f826e853ec

SHA256
bd2c1ec43023474b610bfe269a1a7a60a9285730bc32d6ab9f8fce4e1f62d4a2

SHA512
af5b69e1f192fe96a2a548b5116ccd1174033fac4cd6b4630cc878808a16584c62854865b473ecc7116ebeb896f4c3444934e4d1ebcc2c4e78e9848e17ec0138

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
8f22138c2a37daa69c7504b86e9da362

SHA1
7d6878ddf3a70bb7ede944a782906366f8884948

SHA256
76ee94c90a57f318185573693db4431aeb129b71ede9f512c6f49fb4d12618d9

SHA512
a0bcbfd3bdf816121fe002a4be98dae806bd4dcc36b3ef2b05362fb3d7596705078c48e6cd5a1a250eec6f873ae37bbdc61e578878d9bd4cf1963e590a1daf7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
9870c0cb5eab37e58717439b351e333f

SHA1
9a993312460b854f458d6f82e445e938a3410af5

SHA256
824001208be465c0d2d6ca291ae267803332f3948e2f4e0f0781ed73aba6aba8

SHA512
5868794d1989d3bfdc6b4f0c44db19ab1a044a67bd171fbbdf6c256e156d7756a6991ef8045076652594dc529144f23dd1322ff85130a1e2fa3af6cd884e3f1d

Download Submit
\??\pipe\LOCAL\crashpad_3376_FLCZWMSOICNSFRBP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads