1b77834820be102b8f72d60f667ef7c86b64aef5697fec4653190a938dc8dfff

General

Target

6489494db1f33d08a0ede05f1386e741_JaffaCakes118.html
Size

43KB
MD5

6489494db1f33d08a0ede05f1386e741
SHA1

f6f11450959a27ed572363e40d734a7176f9e7d6
SHA256

1b77834820be102b8f72d60f667ef7c86b64aef5697fec4653190a938dc8dfff
SHA512

a0bf1f3862eda36145a935e3004fea11516980e7313b938e8a30b358a85b1a3962a7a98a3bb6bcc89ecaa4c02b6c516c00539529d96a866f70dd755d60342ccc
SSDEEP

384:afOKIh0chGvuaqocoGYaq2cKGznaqK8Imx8Q3yx6ZWSwhxYEptR6cuxrpeus/xuD:afOK7kct0SwhxYEp6cudpexV309

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1928	msedge.exe
1928	msedge.exe
4012	msedge.exe
4012	msedge.exe
3444	identity_helper.exe
3444	identity_helper.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4012 msedge.exe
4012 msedge.exe
4012 msedge.exe
4012 msedge.exe
4012 msedge.exe
4012 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4012 wrote to memory of 2628	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 2628	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 4808	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1928	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 1928	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 3640	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 3640	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 3640	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 3640	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 3640	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 3640	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 3640	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 3640	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 3640	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 3640	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 3640	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 3640	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 3640	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 3640	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 3640	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 3640	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 3640	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 3640	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 3640	4012	msedge.exe	msedge.exe
PID 4012 wrote to memory of 3640	4012	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6489494db1f33d08a0ede05f1386e741_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1b9846f8,0x7fff1b984708,0x7fff1b984718
2⤵
PID:2628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,11997401199462752717,17628959661785167759,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
2⤵
PID:4808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,11997401199462752717,17628959661785167759,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,11997401199462752717,17628959661785167759,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
2⤵
PID:3640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11997401199462752717,17628959661785167759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
2⤵
PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11997401199462752717,17628959661785167759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
2⤵
PID:1232

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,11997401199462752717,17628959661785167759,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
2⤵
PID:1184

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,11997401199462752717,17628959661785167759,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11997401199462752717,17628959661785167759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:1
2⤵
PID:3588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11997401199462752717,17628959661785167759,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
2⤵
PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11997401199462752717,17628959661785167759,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
2⤵
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11997401199462752717,17628959661785167759,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
2⤵
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,11997401199462752717,17628959661785167759,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5028 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7cc19723e47e33505f506000946a8f59

SHA1
21b49d0e44615160e0480a8b3c8cb92bd078e83b

SHA256
9f60adb47e8a8953c7b2997f5ec7d4f8d3cc74b56e6cb42356a84919e2d9fdd1

SHA512
2ecb9d13502bb860ee658a2a5be69ff04cc5627fa995ccd8568c94f1ebf5476ebf4f0b6d0c72827d3b979f46706f2ca0b79d5be7ee9d792d2a91a9d839038f1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9a9515c3f082194da20eda48d82dad6b

SHA1
fa0e70919291395ca37077415d7200a6b75a321e

SHA256
cb0e6b0e776b4287faf1d896d39b95878247388ef8b55ba9b7066396f35da015

SHA512
4015e199c543560b5619ee96de0ec2fc7b36bdc3fd2768cab7a634389ddf9aab95a3e7058e7d4be369af13e5a0554580c9b21016457fe560ac06d63146c98e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c33d2c0c126595d1f2938f583fccb398

SHA1
866cf3390228421c2f13609096574fd8f2986ed3

SHA256
dcde31ede2ab17872f160cdd2a5d8482666b38f01f4f0112c5ba0c58a6d74b5b

SHA512
6b3d0afd98b70dc5d5698f628a3abe228857fafc33d3588ccd4ae0b73e534e9d49c1210b213126a64ffe94802a52d96b822128596fcff3fc04f9d771825ad8fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7b62646b9bf7a0ab9683cef52fa45644

SHA1
45946ff94b33a5f084b6342a79d9393a264654e2

SHA256
216201961d6a40dd48cb0884017c32ae588badc4a7e36f2f29eb2e95c4c2ef0a

SHA512
1fe93749cc18ed2276c309627753e2f4120bd8de55b560be6dc2d4337ffe878c43325d0e77918be37ebc2224d4ccb925be22ce5f0a738e0799207a1bb6c9f635

Download Submit
\??\pipe\LOCAL\crashpad_4012_KXAWOBJVTENNPJKG

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads