0125463e9339a3b8156120ac8d37828f7e4309c5a976f3814b29b5bb83725b3d

General

Target

6902b0c37f871519a16cad9130099a97_JaffaCakes118.html
Size

100KB
MD5

6902b0c37f871519a16cad9130099a97
SHA1

1e7ebb926e28f0a0bd9a546ecd589a9dcdf9bd7f
SHA256

0125463e9339a3b8156120ac8d37828f7e4309c5a976f3814b29b5bb83725b3d
SHA512

586b6977ebe9595e561babe753dec43aefae4c0be5b39b08d1900e045bb9c121b094fed79c4792ce0fa44cb97826169dc3978c52972b5f7a945a3c7d441a471d
SSDEEP

3072:46phiNZ75Vst3Srfu3Ct1bN7u7oSDHZmu1SeVFquD6I1r+UJ5lNr7hP:4D35VC3Srfu3Swp1SeVF3D6I19

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1956	msedge.exe
1956	msedge.exe
64	msedge.exe
64	msedge.exe
4744	identity_helper.exe
4744	identity_helper.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe
3396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

64 msedge.exe
64 msedge.exe
64 msedge.exe
64 msedge.exe
64 msedge.exe
64 msedge.exe
64 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe
64	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 64 wrote to memory of 2392	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 2392	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 3648	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 1956	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 1956	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 4608	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 4608	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 4608	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 4608	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 4608	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 4608	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 4608	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 4608	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 4608	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 4608	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 4608	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 4608	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 4608	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 4608	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 4608	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 4608	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 4608	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 4608	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 4608	64	msedge.exe	msedge.exe
PID 64 wrote to memory of 4608	64	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6902b0c37f871519a16cad9130099a97_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:64

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd521f46f8,0x7ffd521f4708,0x7ffd521f4718
2⤵
PID:2392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,14121157484597878706,3416407864829334430,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
2⤵
PID:3648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,14121157484597878706,3416407864829334430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,14121157484597878706,3416407864829334430,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
2⤵
PID:4608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14121157484597878706,3416407864829334430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
2⤵
PID:1864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14121157484597878706,3416407864829334430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
2⤵
PID:2764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14121157484597878706,3416407864829334430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
2⤵
PID:2104

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,14121157484597878706,3416407864829334430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
2⤵
PID:3156

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,14121157484597878706,3416407864829334430,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14121157484597878706,3416407864829334430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
2⤵
PID:3012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14121157484597878706,3416407864829334430,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
2⤵
PID:2932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14121157484597878706,3416407864829334430,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
2⤵
PID:4284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,14121157484597878706,3416407864829334430,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
2⤵
PID:3500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,14121157484597878706,3416407864829334430,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3120 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
187B

MD5
6da873990ffcfdd386159429fadd1197

SHA1
f74fca9b34a4f56fad379beca6e673802698ad3d

SHA256
934348d11e58bdf2991f8c429fc4c2b7df9ad51545c9cf36954959f39c8c619d

SHA512
d8def6af2552e6f2f67e1fa79fe2ba81edb68dbbdbf4ed794e0b2deb686b47d678a5dfe1ecf09d9c086a644c9b8ada95fd1a2f6783e6e3de6def63ceab5438b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b76bbdeb217c4409cceb0cdd409636ea

SHA1
3af6482bacf4e2e8ebd4a0739eb6fab79d34190e

SHA256
049e90b1e4cade22a3ab3bb0b788944e7b6dd0a855017698e81ee9eb720d3f5e

SHA512
76f4b979b60641b18e42656716dcc7a6402f5a47217d0b6bad410681092c480122104c22520d8bbb5d1e7294f962e5097b5529026eb345acadc1e0f9b7902a08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
127feead41bb2f6ba51df245e8e7c7f5

SHA1
4b028d35d106d43e2fad36f2dfb7698a06cc1a2a

SHA256
dd38901f231df004025c91e28eecfed81bd1f8c15a3edd47178c6ba7aa569380

SHA512
81e42956e0d7c8732c57785d1e0af0609f0492b094f15ec7688431f783dca05cadb12bbd561d9976e6c5dfdcabd20bee71bbf0e3affb0b1d36858855a89ab7ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7cc3bb344bd87bfa3212fd42b53c5d46

SHA1
ef07b8dff113e6e4ccb701330cb6bb7a15cdf5f3

SHA256
769f098482212d57639636676dbab55f4f7101194ae312551fd641810dc1bf5e

SHA512
54c9e36c7fb85caaa5ec76ec8653e8ff36ba473f89ddec6e8c812c3277ab9701e400929543f163e3f9b09ae3d8d27c6f582710d34ee2c427fecb343b3121130e

Download Submit
\??\pipe\LOCAL\crashpad_64_FUNRKVPSCPMJSIAV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads