da219eeb3773fa333a4fc902459a775d73111672730d5f72873fe57e1431d2f7

General

Target

68e90b9ae1b98982fb01a7b3661a84e8_JaffaCakes118.html
Size

55KB
MD5

68e90b9ae1b98982fb01a7b3661a84e8
SHA1

f35c4b2ef30caa4b3b16abc1a452a3584faa24d1
SHA256

da219eeb3773fa333a4fc902459a775d73111672730d5f72873fe57e1431d2f7
SHA512

6dd17947e1ef5d2fd93333009aedab00f473b5f41b33f793353d91c444355ec4a9c55d35925d84976fcfe7417b3385ce18b20defe67a0782b49c742dedeb71b1
SSDEEP

1536:nmsIgSAEZd0H7reguFu8Th9EKwFrQ7XgaHNk7RP:nwgSAe6RP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
440	msedge.exe
440	msedge.exe
2792	msedge.exe
2792	msedge.exe
4836	identity_helper.exe
4836	identity_helper.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe
1380	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

2792 msedge.exe
2792 msedge.exe
2792 msedge.exe
2792 msedge.exe
2792 msedge.exe
2792 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2792 wrote to memory of 4260	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4260	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4940	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 440	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 440	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4868	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4868	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4868	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4868	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4868	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4868	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4868	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4868	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4868	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4868	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4868	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4868	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4868	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4868	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4868	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4868	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4868	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4868	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4868	2792	msedge.exe	msedge.exe
PID 2792 wrote to memory of 4868	2792	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68e90b9ae1b98982fb01a7b3661a84e8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80f8046f8,0x7ff80f804708,0x7ff80f804718
2⤵
PID:4260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8337728051502811037,6312271268771712769,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
2⤵
PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,8337728051502811037,6312271268771712769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,8337728051502811037,6312271268771712769,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
2⤵
PID:4868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8337728051502811037,6312271268771712769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
2⤵
PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8337728051502811037,6312271268771712769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
2⤵
PID:832

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8337728051502811037,6312271268771712769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 /prefetch:8
2⤵
PID:4956

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8337728051502811037,6312271268771712769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8337728051502811037,6312271268771712769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
2⤵
PID:4840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8337728051502811037,6312271268771712769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
2⤵
PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8337728051502811037,6312271268771712769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
2⤵
PID:60

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8337728051502811037,6312271268771712769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
2⤵
PID:4668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8337728051502811037,6312271268771712769,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3100 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
50c5d5dd9081234069c46c907add081a

SHA1
87e8ffd5a76c85e563838a33e09ba79564ea40bb

SHA256
734a5ddc09b3c67fe4572aed2b65beb88426367ef7f28bba76de044163413d1d

SHA512
fc0f3c216ea9cc0e59d6ec6f00857e19309b3d9656449f698be6532408915293d6c2e94ec13ec502edefe5892bc1a51742ae3ff685836e2ec8a94a8b83b5e2f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
efe0bf530f7801bf8f3cd6a84e4a94db

SHA1
b55f37c7406a1af9d3a05bcc3b1ed05f666ba916

SHA256
50c516b34fbf43115b6c7c3d6d1dea64c9a2f8c65d1c18af9a8bb938d11f37c1

SHA512
e8b4be4e39eb34071af233e95466eee2ed33630725402a6870e92a8d176dddf6431931435e103fec3eb94adc338c4c1b3f1e7c406e8533756281ff88d0e3ace8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b75c2ac7674a895c1e569014e51e88d6

SHA1
b1274a864218a548d315b7254023270232e871b5

SHA256
1f2dfea9b14fdbb9935bfc606107341774eb6087b9651eb60392b5c2072718b2

SHA512
010b5ae3b737742fc0c5da8e768730c3aeff22277657f23f8b4c623da1748d0170d48f55047d26ff6e84b0e6b0f802c7b97f5ea4168ab3b89ecb4cc316266217

Download Submit
\??\pipe\LOCAL\crashpad_2792_ZPTVYMUGUIKCZAGP

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads