657a06ee735cabcacc7d8e1dce9e1357bbe5ab0f5af62f30128bd366da6f6ff3

General

Target

64798b6ebb0d157efd923bb782358c86_JaffaCakes118.html
Size

69KB
MD5

64798b6ebb0d157efd923bb782358c86
SHA1

dbadd1e1770431f3ca8d95c56a45babe955663d7
SHA256

657a06ee735cabcacc7d8e1dce9e1357bbe5ab0f5af62f30128bd366da6f6ff3
SHA512

52ad6dc8b4e2cb82073831d821d575b4868cbb0f92599e5a1e044d00efa9f13be127ecb50159acc3ab31c792e1b73d0092e8dac73e34a9e9e1a9f8042ec584a7
SSDEEP

768:JicgcMWR3sI2PDDnd0g6G0stoT2jwC2oTTMdtbBnfBgN8/lboethcRTQFVG8s//c:J6GT42w0tbrga9nhc1nhVa

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3816	msedge.exe
3816	msedge.exe
4316	msedge.exe
4316	msedge.exe
1684	identity_helper.exe
1684	identity_helper.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe
2556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4316 msedge.exe
4316 msedge.exe
4316 msedge.exe
4316 msedge.exe
4316 msedge.exe
4316 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4316 wrote to memory of 3412	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 3412	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4956	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 3816	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 3816	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 3148	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 3148	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 3148	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 3148	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 3148	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 3148	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 3148	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 3148	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 3148	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 3148	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 3148	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 3148	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 3148	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 3148	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 3148	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 3148	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 3148	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 3148	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 3148	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 3148	4316	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\64798b6ebb0d157efd923bb782358c86_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb014846f8,0x7ffb01484708,0x7ffb01484718
2⤵
PID:3412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,9609775681681976437,1303384011012849486,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
2⤵
PID:4956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,9609775681681976437,1303384011012849486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,9609775681681976437,1303384011012849486,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
2⤵
PID:3148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9609775681681976437,1303384011012849486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
2⤵
PID:2068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9609775681681976437,1303384011012849486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
2⤵
PID:820

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,9609775681681976437,1303384011012849486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
2⤵
PID:4804

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,9609775681681976437,1303384011012849486,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9609775681681976437,1303384011012849486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
2⤵
PID:1248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9609775681681976437,1303384011012849486,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
2⤵
PID:3752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9609775681681976437,1303384011012849486,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
2⤵
PID:4996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9609775681681976437,1303384011012849486,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
2⤵
PID:4312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,9609775681681976437,1303384011012849486,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
03ed432eae5e3b8d8dcbcbcafb73a7a4

SHA1
07be00ece67d2cb00a50ed673cc69e9e46bfb7a7

SHA256
d330ce216b8581cf17831c1f6b540ed68b19f8287389120edf9faedb7518c812

SHA512
f1a04b7dca928f7133f4011bdd64d911e918f4c8dce2f3f68dc7aec5c7b890721e14de756f59803acb5c1242dee7bdc15fd04109ff60e58f0030493288d7aa75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
98e793fdbb947e591d3aad250e214c79

SHA1
66a7b6c5cd16d94a9c4de1120ff91d993d0b1ea8

SHA256
8d73c336f6877538f92c69fe103edfdd6588059c307dace20fd554134f54e586

SHA512
03fd02553dd69a5e8ea023fca9e8a0dfd1d93a199657356acb2039871e07a80c11fda5c153c2f3c07fd8c57d79f3d01f6f03b816f3f2f86a7e7030cc5d754743

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ea14122d870e4b584b445f7196188a40

SHA1
d283f3790e9afa859367a9d17add92fbf53a3873

SHA256
623115d7ae6f6caf4e1f5a47d72cad2dcc79b724e70651a1b33ba55987cdaa7e

SHA512
eb71c323b3fa785abd8e5f9520e420f316809066190d6d8313f5ee393d29f504537b1c9a27c04a99d6cf7aa3617f5c731360128cfa3cff9c13590e044c89a421

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads