dec4b9ef8c90cbb747ecf8e3bd8ae1ac432d581690c9b76a8bdcd0068f34b264

General

Target

68ff7a27b6bb84791d59f59301919cec_JaffaCakes118.html
Size

460KB
MD5

68ff7a27b6bb84791d59f59301919cec
SHA1

2c75b2adeca3c7a209eb823a9495d2c9d59b5654
SHA256

dec4b9ef8c90cbb747ecf8e3bd8ae1ac432d581690c9b76a8bdcd0068f34b264
SHA512

b7f4ea204eff899da9fd91f95b0a06a0f85f2de17eff13366a51cef9bd3be16dc8a5876c73f53dac6d3717d44b55e2f60421066a9158a5c72ac31857ecb096b5
SSDEEP

6144:SSsMYod+X3oI+YksMYod+X3oI+Y3isMYod+X3oI+YLsMYod+X3oI+YQ:t5d+X3M5d+X3+5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

1612 msedge.exe
1612 msedge.exe
816 msedge.exe
816 msedge.exe
4640 msedge.exe
4640 msedge.exe
4640 msedge.exe
4640 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

816 msedge.exe
816 msedge.exe
816 msedge.exe
816 msedge.exe
816 msedge.exe
816 msedge.exe

pid	process
1612	msedge.exe
1612	msedge.exe
816	msedge.exe
816	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe
816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 816 wrote to memory of 1672	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 1672	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3928	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 1612	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 1612	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3304	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3304	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3304	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3304	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3304	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3304	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3304	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3304	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3304	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3304	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3304	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3304	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3304	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3304	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3304	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3304	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3304	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3304	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3304	816	msedge.exe	msedge.exe
PID 816 wrote to memory of 3304	816	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68ff7a27b6bb84791d59f59301919cec_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb685f46f8,0x7ffb685f4708,0x7ffb685f4718
2⤵
PID:1672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,3296893049956740296,12409610383429193835,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
2⤵
PID:3928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,3296893049956740296,12409610383429193835,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,3296893049956740296,12409610383429193835,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
2⤵
PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3296893049956740296,12409610383429193835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
2⤵
PID:2076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3296893049956740296,12409610383429193835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
2⤵
PID:3856

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,3296893049956740296,12409610383429193835,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8
2⤵
PID:2172

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,3296893049956740296,12409610383429193835,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:8
2⤵
PID:1092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3296893049956740296,12409610383429193835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
2⤵
PID:4312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3296893049956740296,12409610383429193835,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
2⤵
PID:4360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3296893049956740296,12409610383429193835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
2⤵
PID:2364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3296893049956740296,12409610383429193835,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
2⤵
PID:1852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,3296893049956740296,12409610383429193835,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a30537dfbdfc189231a49c30306c0704

SHA1
b2fe7cfc24a472567e87ae7ff3c569d2c938ad01

SHA256
91dedf2ad60080b937a767878aa220cb8123abd7872f6c1d5ae70b74a45b8491

SHA512
7ad7f66e824705835730beca7d69c9c3395fbb2d147db4b9c9a8fddd2fe859d1f2f19ae725776a84478829367bb52303e20f4a54381b2ab2cbc66c400c5c8590

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
31b0d1f417d40013611ca5010ead35c2

SHA1
8dbdb5eef85a605a67b730a81870f332e03ddcf3

SHA256
4b84ec516b471409cb22798fbcc6f8d93b93c19f2089d3811a72725eb2d0fc86

SHA512
fe9206395f73539fba60cab0bd915e3372401abbf34d7438a5527e16224616f11ae18b51bbd7f2cb2afd488fee153f746cc89444a22958ab1ab98d7c7911027f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e0ca42aa40e4d82c9c3982aaa6b9bb52

SHA1
158c2aaaeca6f3431853ed95c1d4210d1585439a

SHA256
0006ac8225144a846befa95cf15549ef25f4a38d5e7101a349eca1a6814f2d14

SHA512
f71e99d81f26875049560b52117f8c3eda1b378173cf8d6895fb4dc5607338315d98e880bf76c556f2c4b56dc5d3a85b40b9d1052064d5e16ac4a6baaa31e529

Download Submit
\??\pipe\LOCAL\crashpad_816_JMRWZHTSSVASGHNH

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads