4417ab9d60546d00d36efb37e756a97091b55126f75fade1cc7de7e65d602675

General

Target

65cb4c5f759e4828d488ef83b91fa7f0_JaffaCakes118.html
Size

119KB
MD5

65cb4c5f759e4828d488ef83b91fa7f0
SHA1

553b828cbc28a343f13dab477da8290a071cfa1b
SHA256

4417ab9d60546d00d36efb37e756a97091b55126f75fade1cc7de7e65d602675
SHA512

63eb2be5d2820148038213698d68f431eddea0c44e66cd653dbe469959c8d513b45368a55a33ea5dd47eb8132ab1f8fec04376211c18f89eaed34411cab05e03
SSDEEP

1536:ybayLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsn:OayfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
468	msedge.exe
468	msedge.exe
1180	msedge.exe
1180	msedge.exe
100	identity_helper.exe
100	identity_helper.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe
1920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1180 msedge.exe
1180 msedge.exe
1180 msedge.exe
1180 msedge.exe
1180 msedge.exe
1180 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe
1180	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1180 wrote to memory of 2004	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2004	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2092	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 468	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 468	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2616	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2616	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2616	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2616	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2616	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2616	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2616	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2616	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2616	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2616	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2616	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2616	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2616	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2616	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2616	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2616	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2616	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2616	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2616	1180	msedge.exe	msedge.exe
PID 1180 wrote to memory of 2616	1180	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65cb4c5f759e4828d488ef83b91fa7f0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc8f746f8,0x7fffc8f74708,0x7fffc8f74718
2⤵
PID:2004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,13665550258895111676,8012563784720540494,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
2⤵
PID:2092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,13665550258895111676,8012563784720540494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,13665550258895111676,8012563784720540494,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
2⤵
PID:2616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13665550258895111676,8012563784720540494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
2⤵
PID:4040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13665550258895111676,8012563784720540494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
2⤵
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,13665550258895111676,8012563784720540494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
2⤵
PID:1492

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,13665550258895111676,8012563784720540494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13665550258895111676,8012563784720540494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
2⤵
PID:3860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13665550258895111676,8012563784720540494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
2⤵
PID:3704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13665550258895111676,8012563784720540494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
2⤵
PID:1844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,13665550258895111676,8012563784720540494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
2⤵
PID:3212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,13665550258895111676,8012563784720540494,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4748

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
c8138d206d566aa058ecf0772393a68f

SHA1
f946c4315e366af311a77dd70ba48552f85aadb1

SHA256
6d4438a3923759692ece4cb6c63b47332ea14cbd1ee63a630220147cfae0225d

SHA512
36b7f7397a5d157108b1ad59c5aa49b37a004e202d9ab2e5999d2a1a0343393e831d7e8ef6ed935a0088681ec9cc51fe37085831f9ae9e8ee2a489d2059a8695

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
93c6c2f6a9363d4b9ec6c8d0a9be1fd9

SHA1
680734bb7fe98821abb37e1c6d219cd66052ba81

SHA256
a15c121a631c38c18b6e5690a8c55f80e68c32dc9d1030868ca10bc78da7e36c

SHA512
dae854a5ed36b247acf4cf7093dd7110ee762987cfed0552c97d7c7c203ccc975d74e8f4ce993b61719c65ac3af4a71533b370811a2b811f564e9e70f4016808

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
ecb8e922e67e23162b209f9cdf77cae3

SHA1
90de27c64253113af87510f7f42c1a63018f4220

SHA256
46db9910eccfcebcb378af5d4d46aa23a0500887d2e024d29487a58dd10ba449

SHA512
b7179cfaac1e8cb0500fefa0ebd1391803179eacf26b97ebb622e2166422697ded6f243e3fd8634a78047f24203e0f8623514394d9494be346c338618daf3394

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads