6d121a996aaabd46e1d472075ac7c7743eacc6eaf6013d6f2ec3983dd715e0d8

General

Target

63f84486676ae1eb419b6af086d8ffd0_JaffaCakes118.html
Size

25KB
MD5

63f84486676ae1eb419b6af086d8ffd0
SHA1

92d93ef5858b254f3b600749a9f7194afac2dca4
SHA256

6d121a996aaabd46e1d472075ac7c7743eacc6eaf6013d6f2ec3983dd715e0d8
SHA512

5ef80cb1f363bd91e89f82ef228151738e83c8248e9f02bad0a2c3e931e7af1369c8761d5d1814b71476d3d6f1c0af7b31d379b55dad0313a582adb7ff9735da
SSDEEP

768:KNi502uBdOvxYPusnzsTWYPusnz5KZYPusnz3UzBYPusnzLJjBVK1ac:KNi50V2xYPusnz+WYPusnzoZYPusnz3k

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
948	msedge.exe
948	msedge.exe
4828	msedge.exe
4828	msedge.exe
3960	identity_helper.exe
3960	identity_helper.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4828 msedge.exe
4828 msedge.exe
4828 msedge.exe
4828 msedge.exe
4828 msedge.exe
4828 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4828 wrote to memory of 1884	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 1884	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3624	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 948	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 948	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3592	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3592	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3592	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3592	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3592	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3592	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3592	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3592	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3592	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3592	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3592	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3592	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3592	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3592	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3592	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3592	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3592	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3592	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3592	4828	msedge.exe	msedge.exe
PID 4828 wrote to memory of 3592	4828	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63f84486676ae1eb419b6af086d8ffd0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff935e46f8,0x7fff935e4708,0x7fff935e4718
2⤵
PID:1884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14822151237649092839,6359912619954878354,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
2⤵
PID:3624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,14822151237649092839,6359912619954878354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,14822151237649092839,6359912619954878354,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
2⤵
PID:3592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14822151237649092839,6359912619954878354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
2⤵
PID:3480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14822151237649092839,6359912619954878354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
2⤵
PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,14822151237649092839,6359912619954878354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
2⤵
PID:2760

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,14822151237649092839,6359912619954878354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14822151237649092839,6359912619954878354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
2⤵
PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14822151237649092839,6359912619954878354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2376 /prefetch:1
2⤵
PID:1548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14822151237649092839,6359912619954878354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
2⤵
PID:4004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,14822151237649092839,6359912619954878354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
2⤵
PID:4160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14822151237649092839,6359912619954878354,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4744 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
558B

MD5
428f44270b2cfeb735a8aa74f12694bf

SHA1
278988fb263d55331657881c3e8d46ec63f58d36

SHA256
25ac27f16d0222369067160d0d386a5f8d25f19ca7ecc6b5a4ad630da35cd030

SHA512
d0b74f28c8cd06f74f9dea4edee46529c703f244d8719948615b93597294596842b56dab3be4cbff63f960e532585030b6af7cf1cba1dd8d66d2e437f5231d79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d2438908f58a3f8089a82e9abfbab48e

SHA1
5ea5f865e8d572da9a9d1d2ddb5fb594006aaa38

SHA256
1745c269142428ee923f32b7f6e54199902311a37d15fddfd8f897e8f20aae43

SHA512
84139a0b6a93b261b60b9f1e4cb486fd3b10086ed80f5007b2d71cb938944d8316b1c52f3b84a072a53b2b6baf11592b6ba97ce8816d865c4042e4b2d1a4a9ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8ecfd6b9dab627ce646df4a20788c0f3

SHA1
d144ca16b968c0722f43709e81b18a112e65ae96

SHA256
eb8d57c7c1ebc65e6c485ffa716ccbf25cbbb13f8a9bb68643e699e4dd772fa3

SHA512
e4ff50a3729fcc35639b2baa6eddc7ec1f5578914e9d3a451268582a44e0c732aff01e6f1c8c6ac36b58c6716e82d1f38c9d442e99a0f828915ddad63a90582e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b4f5952181754d81d8694319ad08c6cb

SHA1
7687577dc79fad17e13fd9afc7738661bcfc7fee

SHA256
a76b21992be26992a712e1ba308c0714549f560a557af794fdeaab7d1f79d64c

SHA512
fbcd211dd73e69cd4bdbf94ec9e0828c36c21e7a0f78c21d8a3312381f15e9a6264157bf2623cba4030b3a3133e3f9de9545ca25be18fe075497a3282a0d5b73

Download Submit
\??\pipe\LOCAL\crashpad_4828_WRWIORXYSTYQFYKF

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads