b735fe6faa6f9e923f28908b53068eddade26effb728125cb4e57ba92dbb99e0

General

Target

647be580831afd0fb21f6b2ba9dd5da1_JaffaCakes118.html
Size

36KB
MD5

647be580831afd0fb21f6b2ba9dd5da1
SHA1

c59184901722247f4b0423decc82febbbe873886
SHA256

b735fe6faa6f9e923f28908b53068eddade26effb728125cb4e57ba92dbb99e0
SHA512

048d6aae9f9c8b8123ab4cfa18ea819cc209a3b83b04c582584cadea73c3e96d37e133f70a59ed4515b0d1d4de57cb2a97bd438184f1dc21f4441d287f110787
SSDEEP

768:zwx/MDTHUO88hAR2ZPXBE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TUZOD6lrw6lLRcI:Q/nbJxNVru0S9/S81K

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4444	msedge.exe
4444	msedge.exe
1228	msedge.exe
1228	msedge.exe
2300	identity_helper.exe
2300	identity_helper.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1228 msedge.exe
1228 msedge.exe
1228 msedge.exe
1228 msedge.exe
1228 msedge.exe
1228 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe
1228	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1228 wrote to memory of 1564	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 1564	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4260	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4444	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 4444	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 1144	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 1144	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 1144	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 1144	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 1144	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 1144	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 1144	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 1144	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 1144	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 1144	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 1144	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 1144	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 1144	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 1144	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 1144	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 1144	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 1144	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 1144	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 1144	1228	msedge.exe	msedge.exe
PID 1228 wrote to memory of 1144	1228	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\647be580831afd0fb21f6b2ba9dd5da1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0x100,0x104,0xe4,0x108,0x7ffcb7ba46f8,0x7ffcb7ba4708,0x7ffcb7ba4718
2⤵
PID:1564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,10209687195036731567,11658862087494634533,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:2
2⤵
PID:4260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,10209687195036731567,11658862087494634533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2536 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,10209687195036731567,11658862087494634533,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
2⤵
PID:1144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10209687195036731567,11658862087494634533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
2⤵
PID:4756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10209687195036731567,11658862087494634533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
2⤵
PID:1940

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,10209687195036731567,11658862087494634533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
2⤵
PID:3032

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,10209687195036731567,11658862087494634533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10209687195036731567,11658862087494634533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
2⤵
PID:2876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10209687195036731567,11658862087494634533,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
2⤵
PID:2272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10209687195036731567,11658862087494634533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
2⤵
PID:832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,10209687195036731567,11658862087494634533,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
2⤵
PID:2072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,10209687195036731567,11658862087494634533,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
613B

MD5
eb2ddf2c2c1b99688bf6121cfcf073d4

SHA1
894910408680cd200967811d09986656b6512f3e

SHA256
fe3650fba688f8815aaaa3190ffc0b0c819c5f1eea204ade77f8dc739ab25d5e

SHA512
cf8befe4c103f916256ac4c7400831b146bdc71601f8639304cf1a5221a3de338c0932ccf554d4bb4c7130418853879b9ffa87887211eaf0e6b820a490b3f858

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5ec2ab01e6bb9e888f9090498a9d6d70

SHA1
b6eb6bcbd96cc60772e746a44f1ced1403f4ed5d

SHA256
acaadf3c058fe25617aa8baa094d731afb09e6e71f49a43c2eeed8c475fde5ca

SHA512
69931472b3f7f0b6041cb63be972ec0da0f0de9ddfc062d1a6a8867b5adc3c8d0c3b51ef17a2881eb6d809018c8668cde0b2ee194f2469d1927b8e8603da0f4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
da3f00c4ee26df00e0c64dcd837c0442

SHA1
7116f663f1c80d0e9ff8c487c64e5308da6baa70

SHA256
46e8366e618c485299462990f69ba4ef3a8d7a5c4df004bd13253f10a14eaa1b

SHA512
6a44f0e3d8d47ae87b7cfe825b8119564a66355deec26cb7813604eb2c7ff38b3bcf5133bdacf0bdbdee375d0cb105fecb073d13a338ece107b378c73ce7710d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1edb619245d7c536914ab8891d8761d6

SHA1
5835e9ae6357dc84b27c5da6104670701b06360c

SHA256
4dfd3bf154f157228a1153e2b8e71a5976b2f91595a70573f13a5edceac96461

SHA512
522fcabb95693e5545bd9cadef875ab3133272cf540c723955b080eaed4a12af376bb00e010305b4fe477f1e1ade05552a2ac6f9622d54c371c2f7af1dfcd689

Download Submit
\??\pipe\LOCAL\crashpad_1228_DRUEMORFGHKGOFAT

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads