061199d0a1a6eed2fc438ea13091837e1c012032f7edee2955e90728b367ceb6

General

Target

657bba102569e730d0e6071495391311_JaffaCakes118.html
Size

36KB
MD5

657bba102569e730d0e6071495391311
SHA1

738708b96081455da751068826468e2d8df2c2fe
SHA256

061199d0a1a6eed2fc438ea13091837e1c012032f7edee2955e90728b367ceb6
SHA512

1b9d7e70df85ff9ca5cb39b60bd257d43f0e7777164259ad0db1bcd055e4e0c386e76ee826a011628872cefef5512d1125283c41b65a16405e6db907f617d615
SSDEEP

768:zwx/MDTHas88hARSZPXNE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6ThZOg6f9U56lLRx:Q/DbJxNVNufSM/P8wK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1252	msedge.exe
1252	msedge.exe
212	msedge.exe
212	msedge.exe
5072	identity_helper.exe
5072	identity_helper.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

212 msedge.exe
212 msedge.exe
212 msedge.exe
212 msedge.exe
212 msedge.exe
212 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 212 wrote to memory of 4484	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4484	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2560	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 1252	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 1252	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 1428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 1428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 1428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 1428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 1428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 1428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 1428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 1428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 1428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 1428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 1428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 1428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 1428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 1428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 1428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 1428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 1428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 1428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 1428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 1428	212	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\657bba102569e730d0e6071495391311_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd711f46f8,0x7ffd711f4708,0x7ffd711f4718
2⤵
PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,4067708341102789566,39708844184913670,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
2⤵
PID:2560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,4067708341102789566,39708844184913670,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,4067708341102789566,39708844184913670,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
2⤵
PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4067708341102789566,39708844184913670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
2⤵
PID:5084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4067708341102789566,39708844184913670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
2⤵
PID:976

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,4067708341102789566,39708844184913670,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
2⤵
PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,4067708341102789566,39708844184913670,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4067708341102789566,39708844184913670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
2⤵
PID:1604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4067708341102789566,39708844184913670,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
2⤵
PID:4812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4067708341102789566,39708844184913670,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
2⤵
PID:1680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,4067708341102789566,39708844184913670,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
2⤵
PID:1820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,4067708341102789566,39708844184913670,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
613B

MD5
6d76460ac76d63e01a2dc71ca48dc522

SHA1
71a273570374ae17a2a22bcfea01c989596e3fd8

SHA256
0d0e6b0220a2cdae4a5943e2bb877f9c25039e8f502c3f6ecde6f417abcd381d

SHA512
0ca3d97796ff6fe278921bc3129d2ce69dcffeeedd17658a38dd48f1c4cbefd9d8274e5c78c03253a808c368ef7ef56cd91404c1e641766f7be20b3d8afb49ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
71f4cfcc51ba103cc884949c6a783fe7

SHA1
d1bed811a63634e83dbb221ee378108390f56457

SHA256
fe10144e5a655220e68f2904f8e592e2603be59b6a524c0d407f37679304ae1e

SHA512
7399334e100c9fd96f7bb9cf38d6a481a766bc960e84908f7f03b51ec2cfc81b0d93211618f73c56fab4bb0aaf9db8477378ef1e36f5f4ba8c12d92b40779e55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a02d6acda39db090f43277d5dc6bf5ea

SHA1
9558315be5a46f13881f71a02b888a63d2aa0e38

SHA256
51d9d8f9c31a1fe838cb8be5787c5c2ea49d9cea8bd8ab73a10b3054bd2e7132

SHA512
894e2d4753784adc59eb5bacf96e72d322014fd2ea94d6a5f3173717de07a0c0646f681b34caf5fa0e82b3ca2e7470c61e98c2b68f321b2de0bee6ed3dfc646d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e7f65267d867740c24104132695a8750

SHA1
c692dfccb815126e0fbc87ba1c05851f239810a4

SHA256
ea69f163fd5cb6fb5af5a16c30b4615633e39d019cb84293362968ca0649e3cc

SHA512
9e9df8d25f673f553506da04da7557526fa375387010b0a0af2dfa2e614a936d1403536d0187d295ba1669a49bf61208240c043d0e8719bec77c96c5d845f813

Download Submit
\??\pipe\LOCAL\crashpad_212_WZZRPUCJBBBGETEC

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads