56814f9a062c2804ebbbd697bcbbcb7442b1a58a89d60e766e366ba92e2cb67a

General

Target

65b3560bab5ac55a301c37e5f0e483f8_JaffaCakes118.html
Size

69KB
MD5

65b3560bab5ac55a301c37e5f0e483f8
SHA1

aa0a4289e5ca63835fd9d3ad01a76f9d7918610a
SHA256

56814f9a062c2804ebbbd697bcbbcb7442b1a58a89d60e766e366ba92e2cb67a
SHA512

32b1d1ac01d91f3bd4bc16fe1e302638b258ba5e360e0e052a236cbc4eb50d0855f7f708dac8464852e4c0e702380a1231b44219f6750b996cb73e0d372c481f
SSDEEP

768:JiegcMWR3sI2PDDnd0g6s9GEoTyZ1wCZkoTyMdtbBnfBgN8/lboiGhcRoQFVG8sB:J4uTSNen0tbrga90hcJNnspv

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3952	msedge.exe
3952	msedge.exe
3816	msedge.exe
3816	msedge.exe
4524	identity_helper.exe
4524	identity_helper.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe
3420	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3816 msedge.exe
3816 msedge.exe
3816 msedge.exe
3816 msedge.exe
3816 msedge.exe
3816 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3816 wrote to memory of 4732	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 4732	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 1552	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 3952	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 3952	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 220	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 220	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 220	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 220	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 220	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 220	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 220	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 220	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 220	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 220	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 220	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 220	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 220	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 220	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 220	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 220	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 220	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 220	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 220	3816	msedge.exe	msedge.exe
PID 3816 wrote to memory of 220	3816	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65b3560bab5ac55a301c37e5f0e483f8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbac3746f8,0x7ffbac374708,0x7ffbac374718
2⤵
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,16342416903988749700,17677821281004293411,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
2⤵
PID:1552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,16342416903988749700,17677821281004293411,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,16342416903988749700,17677821281004293411,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
2⤵
PID:220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16342416903988749700,17677821281004293411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
2⤵
PID:4972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16342416903988749700,17677821281004293411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
2⤵
PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,16342416903988749700,17677821281004293411,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
2⤵
PID:3580

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,16342416903988749700,17677821281004293411,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16342416903988749700,17677821281004293411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
2⤵
PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16342416903988749700,17677821281004293411,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
2⤵
PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16342416903988749700,17677821281004293411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
2⤵
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,16342416903988749700,17677821281004293411,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
2⤵
PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,16342416903988749700,17677821281004293411,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3244 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3468

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
11bc2cdf902378664ef7f209e6bcdb75

SHA1
594b8559860025c511fdb3ee7b50fab5c1431a31

SHA256
1b41f33c6114ee81d1579159711c70a7422022c57f5939a3abb07a029c3e775f

SHA512
a569fa07994980d1b09d999872e9fe1e667a992c5a3381c33406378d6d9d07b8afff91c7f6dd33f7d2903272b5f7c2fa711ea0e34e2f21c1f1b4170c831d9374

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
acc4b859de9e1ba916f7270e81b012b9

SHA1
ac138f7ae58554b560fa4298642d4547a65514c0

SHA256
a758f5475c9f90057096f72aba69fe6e58ce3e8a3dd65d6dc80c78b569959866

SHA512
69524bf0ed6a2114fad6a179f5fb64d74c09fa6bf85cbd7fcddf9324ba2504b9a15bd8901639f35c827261487ff76e230968525319f66ca2ea3edd73103c85a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
8e3db84cb21053a689a54e545cf88841

SHA1
3273b67444b4ef40d29a0bfd2d6b3cc315b281c7

SHA256
d0435b34eb45c2d4b89beed3c91eef514959bce9fb594de052ba17e699a43165

SHA512
182f5d2a952bdf3e69ff45147f9cadcf150e6950e91ae8e807c624d1a9cffea0f692f89f9f18b6cf86c49cc495949257bbdbce5da02f7aed750f46910fd4f6f7

Download Submit
\??\pipe\LOCAL\crashpad_3816_WFKVUVKCQWFVZYFF
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads