8ecf8bcc44974c8138307348af09829204b916a1ba9d8ea6c486231d00c6bdc3

General

Target

655a1a7d3ddcb11798ceb5b8d36f4144_JaffaCakes118.html
Size

461KB
MD5

655a1a7d3ddcb11798ceb5b8d36f4144
SHA1

6222eacd13bc6b3ae5ebe18c4360ede63a712c5b
SHA256

8ecf8bcc44974c8138307348af09829204b916a1ba9d8ea6c486231d00c6bdc3
SHA512

bcecbdca49a696038b216bdc9c9326661b1b2d9919a9a81928c29dcf4bad8f87465d0589449ec04f47165dcccb7cdf87f9dd07655e0ea11b6b9a6a5323d04d63
SSDEEP

6144:SssMYod+X3oI+YtsMYod+X3oI+YbsMYod+X3oI+YLsMYod+X3oI+YQ:/5d+X3X5d+X3B5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3036	msedge.exe
3036	msedge.exe
1896	msedge.exe
1896	msedge.exe
1904	identity_helper.exe
1904	identity_helper.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe
3780	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1896 msedge.exe
1896 msedge.exe
1896 msedge.exe
1896 msedge.exe
1896 msedge.exe
1896 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe
1896	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1896 wrote to memory of 3004	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 3004	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 5076	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 3036	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 3036	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 1876	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 1876	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 1876	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 1876	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 1876	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 1876	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 1876	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 1876	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 1876	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 1876	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 1876	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 1876	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 1876	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 1876	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 1876	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 1876	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 1876	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 1876	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 1876	1896	msedge.exe	msedge.exe
PID 1896 wrote to memory of 1876	1896	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\655a1a7d3ddcb11798ceb5b8d36f4144_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffddd8146f8,0x7ffddd814708,0x7ffddd814718
2⤵
PID:3004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4457298086958190538,14579960839466793562,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
2⤵
PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,4457298086958190538,14579960839466793562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,4457298086958190538,14579960839466793562,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
2⤵
PID:1876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4457298086958190538,14579960839466793562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
2⤵
PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4457298086958190538,14579960839466793562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
2⤵
PID:1960

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4457298086958190538,14579960839466793562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
2⤵
PID:3704

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4457298086958190538,14579960839466793562,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4457298086958190538,14579960839466793562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
2⤵
PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4457298086958190538,14579960839466793562,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
2⤵
PID:3208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4457298086958190538,14579960839466793562,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
2⤵
PID:4408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4457298086958190538,14579960839466793562,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
2⤵
PID:1584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4457298086958190538,14579960839466793562,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2704 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4048

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
1a45f0d256d10a91f32365b1b539bee7

SHA1
56c41b3d0ae908deab91c54c195f265fba8133da

SHA256
bb421fff55046f5282950a2e84a6ab6cc46190e85956af0fed58acc9f6dd5f17

SHA512
6eff296aa14d98f27cc2a9f9e814a46108888ae1e7219c39a348f3c6f4882a93b7ef4eb6b11329ceec7635fc82d669e0c24d1a2a8161a0d6dc5985595e513e15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
adf93705673deb7ea7e4e0f54ab410bb

SHA1
ffa5c7a36717d40391a7aa276a227a624c3f3a1f

SHA256
9b5ae6bcfe1bfd108b9bb39deaacb227266cc63f0ef43a1440b4d1c7999fdd99

SHA512
d417146f98c12c6b9e9b341cc2e2c6ee8ae54a6b5fd1cfa32ea8bdd427924fbf2b8028c0eae6ca163293052b127bdb71b8a3706f0b0d096f87765a627f4c135f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
c4a83e51e2d15c93c1b2bae65c98f386

SHA1
64f7773c5430accde2de7ed143497da00c5a5204

SHA256
74444c3f1c0147614716dfaa92b930ccebc73d35e76c23bb618c124d097f1504

SHA512
352159f6fea8b2a0921a07774376f070686269422c1ccf792fa7e03ac31d79a6db27af7d6cd0e291ec86419fd103ed6d85cd430b19abf4a4e3eac7dfbf58a3f0

Download Submit
\??\pipe\LOCAL\crashpad_1896_TZZTHFITXNCNPHPM
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads