e3c5d5a4d13cbb678b9cfd6a6cc29af03cba8ede1b50ce8018ad216ed769e6f5

General

Target

65c6605a84474f74111337b5b5cb1a6a_JaffaCakes118.html
Size

23KB
MD5

65c6605a84474f74111337b5b5cb1a6a
SHA1

f69f053530f92dffb2654e5d49fe48a67a56056d
SHA256

e3c5d5a4d13cbb678b9cfd6a6cc29af03cba8ede1b50ce8018ad216ed769e6f5
SHA512

b98a42479e9d63abb3c7d5a15fc1abc401314d195cffd8ecf7228c55a5354d119f9ed9f17ebfbd7d0598eeb4de7f335ce639b593ea296e9a742f32e4c19f9b09
SSDEEP

384:9TDaQRmaZO73fr6hmYjeCDQ/wqJml2Ap9ABc2deSq4SOx6ARKoDXG8:Ul

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4428	msedge.exe
4428	msedge.exe
212	msedge.exe
212	msedge.exe
4024	identity_helper.exe
4024	identity_helper.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

212 msedge.exe
212 msedge.exe
212 msedge.exe
212 msedge.exe
212 msedge.exe
212 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe
212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 212 wrote to memory of 2208	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 2208	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 3412	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4428	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4772	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4772	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4772	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4772	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4772	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4772	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4772	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4772	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4772	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4772	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4772	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4772	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4772	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4772	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4772	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4772	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4772	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4772	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4772	212	msedge.exe	msedge.exe
PID 212 wrote to memory of 4772	212	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65c6605a84474f74111337b5b5cb1a6a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb1a3646f8,0x7ffb1a364708,0x7ffb1a364718
2⤵
PID:2208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1776,13801647463382050157,2249331028487987369,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
2⤵
PID:3412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1776,13801647463382050157,2249331028487987369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1776,13801647463382050157,2249331028487987369,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
2⤵
PID:4772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,13801647463382050157,2249331028487987369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
2⤵
PID:4124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,13801647463382050157,2249331028487987369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
2⤵
PID:4164

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1776,13801647463382050157,2249331028487987369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
2⤵
PID:3120

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1776,13801647463382050157,2249331028487987369,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,13801647463382050157,2249331028487987369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
2⤵
PID:2128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,13801647463382050157,2249331028487987369,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
2⤵
PID:5092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,13801647463382050157,2249331028487987369,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
2⤵
PID:452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1776,13801647463382050157,2249331028487987369,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
2⤵
PID:1936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1776,13801647463382050157,2249331028487987369,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3120 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4136

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
4d109b721fffffb4366f8d94ae1f1c74

SHA1
a593ee04f3bd881e07ea6f51e71afb5592eaeb56

SHA256
65afef10b6356fab7b6fb81f028d8061f694b5f2bf9904f9cc2f8d1ea6e505ab

SHA512
0c0453ff070a33b7a638f4ac5f701e720a6cb2f3f68eeab34c637f2249c5518f944c07a3884f129b8676796328143b60bbc1885d7743bf508154e7adc01efeaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
57b28391731b8d9e88c60204962be279

SHA1
2f9b34dbaa6e3fd5baaed35b9b9790b1465c1ad8

SHA256
8953e6804ff9cab805b8c1aa4e3b67364d8bb2fa8ab79027a80e4f507166ddf0

SHA512
fb0ee291da9b07d41915840fc5e177dcd3ab07c963f7d701f49cb8aa7452f2dd65be1eae2aca352200c994ad371d23deb48d875e383f75536f5d93d5fa926cb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
10f2fb92a93cd1ce55dcc972002bd6c0

SHA1
285663abf024a86ba6e23e84832e322ae5ef934c

SHA256
30dede8631f3189a973012571dd9f7df2554e39635f779fb499382c7f8d46b6f

SHA512
0ab0789b512a8a9a02923110b0dcb9031ec226dbc15f3b5ee03b49dbcc5c001f3c5b2c2ba2e5ca830722c2eb2a5f8f1f26e112d2d59ce875e378f99ed0224da0

Download Submit
\??\pipe\LOCAL\crashpad_212_YXWQIUTSMZVZIGIJ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads