1da189871473c58ff2b35337e7be9cf13cdc7c2bc42d829b8db568c91c918d3c

General

Target

65cdb1e18835cdda9ffc7503a4c62006_JaffaCakes118.html
Size

36KB
MD5

65cdb1e18835cdda9ffc7503a4c62006
SHA1

68aefa9855d3d1bd217895e7a22d34c2baf991e5
SHA256

1da189871473c58ff2b35337e7be9cf13cdc7c2bc42d829b8db568c91c918d3c
SHA512

a9ffce664ade47b2af289c4fcd4fbe7dff579d58ff276a3c271bc397fa6912217fdaf0c8b772e2b55a9580e4b8bc1672e74b3c85fb4850d40d46a1a6736481a8
SSDEEP

768:zwx/MDTHqc88hARxZPXgE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TxZOd6DJtxo6qLh:Q/fbJxNV/uxS0/88jK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3532	msedge.exe
3532	msedge.exe
2280	msedge.exe
2280	msedge.exe
3712	identity_helper.exe
3712	identity_helper.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

2280 msedge.exe
2280 msedge.exe
2280 msedge.exe
2280 msedge.exe
2280 msedge.exe
2280 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2280 wrote to memory of 3716	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3716	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3576	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3532	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 3532	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 2708	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 2708	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 2708	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 2708	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 2708	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 2708	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 2708	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 2708	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 2708	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 2708	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 2708	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 2708	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 2708	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 2708	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 2708	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 2708	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 2708	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 2708	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 2708	2280	msedge.exe	msedge.exe
PID 2280 wrote to memory of 2708	2280	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65cdb1e18835cdda9ffc7503a4c62006_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5ce246f8,0x7ffa5ce24708,0x7ffa5ce24718
2⤵
PID:3716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8170137031337461563,12225199672876251582,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
2⤵
PID:3576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,8170137031337461563,12225199672876251582,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,8170137031337461563,12225199672876251582,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
2⤵
PID:2708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8170137031337461563,12225199672876251582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
2⤵
PID:2404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8170137031337461563,12225199672876251582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
2⤵
PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8170137031337461563,12225199672876251582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
2⤵
PID:2656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8170137031337461563,12225199672876251582,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
2⤵
PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,8170137031337461563,12225199672876251582,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
2⤵
PID:1560

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,8170137031337461563,12225199672876251582,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8170137031337461563,12225199672876251582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
2⤵
PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8170137031337461563,12225199672876251582,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
2⤵
PID:2032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8170137031337461563,12225199672876251582,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4904 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
614B

MD5
9fa5dcac21db378a3fba31775759aa68

SHA1
8c1301ad33d70d388847ee295a435e54cd56b265

SHA256
ed95cee22b28a7b9d1c162239922664711d1c2672751cd90870884a15ac10144

SHA512
ef9eb560c47e9fa3bf2c40d2d189217790edc853e823b31d0d998377588e7f2f2e89884a45a928399ef0fd52680510a4958ca048f90e4de20df72f509764271a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9437a9abb26bd55610d2e48a34b1b188

SHA1
75d840f5d0e980d581e05661514f7db4593a3570

SHA256
bab30915f773ce53838781c3bdec49d89421bbb7d6f7b5a9a217abc49ce41539

SHA512
d0f3604529eb3fe6d43ac87a3f8a6baf8be77e82480c28372dec3d1eeb9c8a889938777eb1d8014d27e9167a52f7c30155b9f8f31c116a891af42e82468b5ce1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8a36baf91bcdcbd4e8cad0b0b2714211

SHA1
5064f6bd4821560f2d85dcea15a1d69944d69553

SHA256
63969794415a156b915b032206466b1dc6d49319599984b8fb08fa808d102cb2

SHA512
44c414302e370fbe5be4ed53a95df2e88e00a03634ea68982aa5ce70434c841239bf44e54c68c8ea4b251b5d8805061a1d009da4d18a97f64bd0a91b8a724548

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e07b16a9f2b5c0bebfb54d34a6c5191c

SHA1
d08434f2e8061bf6513c96fa678a7d675fc3dc61

SHA256
e2be69c657e14b64cfd5d5ece927a5a001b64ba99e03c6ad46543408f7762105

SHA512
2ecd9db0f37b23da09be7774f9ca70ea6ab4be5c4ee5f95c909fceefb5dcaa4de8d962d4b9ab644fa62d4e7103bac91edb4fdf675fb3ad1d97ad697ddb00f435

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads