9479eb4b3036c129b8043dc8d613b2704ad26d118df9b956c17c35a88f04a31c

General

Target

6912deba0f1d1d475f3f50b06052dacb_JaffaCakes118.html
Size

4KB
MD5

6912deba0f1d1d475f3f50b06052dacb
SHA1

da6cea09d971ee20a96ea5ab13e8b60b849f3e3a
SHA256

9479eb4b3036c129b8043dc8d613b2704ad26d118df9b956c17c35a88f04a31c
SHA512

de3a08759307d7f2edec49ec9aa03a678e1ed524abeb88aa7b5d4d0fc260d7f062ff69392e3ddd13842bc28f1c27cd7c0e1eabf7a31166fb2ebd6c4ab2219b5e
SSDEEP

96:Pk7hJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oSpd:Pk7hY1aEFHVKtF37sNjtXATIQFM93pDR

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2396	msedge.exe
2396	msedge.exe
1720	msedge.exe
1720	msedge.exe
4848	identity_helper.exe
4848	identity_helper.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe
1992	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1720 msedge.exe
1720 msedge.exe
1720 msedge.exe
1720 msedge.exe
1720 msedge.exe
1720 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe
1720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1720 wrote to memory of 1020	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 1020	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2384	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2396	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 2396	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 4456	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 4456	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 4456	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 4456	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 4456	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 4456	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 4456	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 4456	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 4456	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 4456	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 4456	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 4456	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 4456	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 4456	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 4456	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 4456	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 4456	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 4456	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 4456	1720	msedge.exe	msedge.exe
PID 1720 wrote to memory of 4456	1720	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6912deba0f1d1d475f3f50b06052dacb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6d1046f8,0x7ffd6d104708,0x7ffd6d104718
2⤵
PID:1020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,3777729678948499466,1435876068202039588,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
2⤵
PID:2384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,3777729678948499466,1435876068202039588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,3777729678948499466,1435876068202039588,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
2⤵
PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3777729678948499466,1435876068202039588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
2⤵
PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3777729678948499466,1435876068202039588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
2⤵
PID:4632

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,3777729678948499466,1435876068202039588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
2⤵
PID:2352

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,3777729678948499466,1435876068202039588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3777729678948499466,1435876068202039588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
2⤵
PID:4248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3777729678948499466,1435876068202039588,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
2⤵
PID:732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3777729678948499466,1435876068202039588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
2⤵
PID:2208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3777729678948499466,1435876068202039588,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
2⤵
PID:4164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,3777729678948499466,1435876068202039588,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1284 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
291B

MD5
1bfbbd5c8f5a35630fb5625cba3dc728

SHA1
5a8360621eccaeb89cb0f9961ec6efd2dba4d9a0

SHA256
4375c3c98d222b1f3dd5df8cce5691801d294c4566f6bd2ece52d8ca6efbbd97

SHA512
696168c5cabe234b107e4f4c258e30553caf3ba842283ac8bcd7bb5fbebd1a96a5fbd59e71f7e4d6881716481df48d76809faa08bf9a9cbb8eee779293555292

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e6bd7d7fa04091d9a08acde43f801665

SHA1
3a28a89c9ad1b524cb774ccc478292530ca577d2

SHA256
d78d9af34bf47050d381e12f623a543af8de4ff22d0fb63d6701a54070590b0d

SHA512
1bb96b086a27f099ea5a1e6fbac2f064671df5809729315aff1699e54ec402a94e5fb89978450878f95e6492f88775c63d4a2f40ce9ec5d30cba18bfbf22b92e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
da4987027a8bb62f87da20a2d2dbc2d1

SHA1
e1d3f7cb7edc9eb0f83b2237af32e8cf9ca017b7

SHA256
bc480059122ce701ca8deeb620a76c17b7514686b283df495459afde96ce4ce9

SHA512
e702d4c458e0f4cd5783bda86f421c2bca41d26c94f0bdc84cc5d02e6513e26d9b9e17934acb543e62733d2055272f1a0db89f0d03b63583a3cb6b9aa20fb4c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
986e7194e4132d1b8cf674a83468441c

SHA1
15a54c9121b359aec775b3471a98d78e3d17235e

SHA256
2023318357aedabd9039c6bcaf7b72bb5a48582140f3dafcc6c12da946761723

SHA512
17c1067df9c0bf662d05aa291c3cd07c40d383e944c4537508da115e2b6730f8f809988528c44907fcbc182b0bd0961beb580125aad238d721f6cf73708ba13f

Download Submit
\??\pipe\LOCAL\crashpad_1720_RVPURZDXBPCCHMRX

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads