6dd95fcfef5b645f22ae2f30863ea0b8d576d56931497508247eb3e65c1fb4e6

General

Target

65d1283e7cd1bb8837396c903744d214_JaffaCakes118.html
Size

19KB
MD5

65d1283e7cd1bb8837396c903744d214
SHA1

396e487d8abae05e879dc39b6b497a56d8007680
SHA256

6dd95fcfef5b645f22ae2f30863ea0b8d576d56931497508247eb3e65c1fb4e6
SHA512

7117cfe38f1edb6d04f62eaa8b8d1740150eed2816c9c6d2d72dd1952f872e21cded55e63266353b262cadd32cd53dc6dab6e1813c6cca95370e726f2edc4b8b
SSDEEP

384:ziMKhgESiVBD8c4Q3R+CScBjmLxXucfBk99heizVc9tj:zilSigcb3wCSEmQOBk9SEqtj

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2896	msedge.exe
2896	msedge.exe
4540	msedge.exe
4540	msedge.exe
1940	identity_helper.exe
1940	identity_helper.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4540 msedge.exe
4540 msedge.exe
4540 msedge.exe
4540 msedge.exe
4540 msedge.exe
4540 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4540 wrote to memory of 1732	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1732	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 1608	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 2896	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 2896	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 884	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 884	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 884	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 884	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 884	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 884	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 884	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 884	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 884	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 884	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 884	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 884	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 884	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 884	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 884	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 884	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 884	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 884	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 884	4540	msedge.exe	msedge.exe
PID 4540 wrote to memory of 884	4540	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65d1283e7cd1bb8837396c903744d214_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccfeb46f8,0x7ffccfeb4708,0x7ffccfeb4718
2⤵
PID:1732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,15559251705085609720,3368059229955463269,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 /prefetch:2
2⤵
PID:1608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1988,15559251705085609720,3368059229955463269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1988,15559251705085609720,3368059229955463269,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
2⤵
PID:884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,15559251705085609720,3368059229955463269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
2⤵
PID:3552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,15559251705085609720,3368059229955463269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
2⤵
PID:828

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,15559251705085609720,3368059229955463269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
2⤵
PID:1188

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1988,15559251705085609720,3368059229955463269,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,15559251705085609720,3368059229955463269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
2⤵
PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,15559251705085609720,3368059229955463269,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
2⤵
PID:3092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,15559251705085609720,3368059229955463269,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
2⤵
PID:4256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1988,15559251705085609720,3368059229955463269,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
2⤵
PID:3388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1988,15559251705085609720,3368059229955463269,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2760 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7f766de9-8076-4ccb-acf4-3fbb22f22bca.tmp

Filesize
11KB

MD5
171086ae50948bd347645523ae0f820e

SHA1
fd674c2a8557065398ae301390d06554f9614a3f

SHA256
bbdcdf41bdf422ce8a1ae7c73e89a434ebc09f8a26af90cb7eb7bcd675ce8498

SHA512
b13f130fd8545a29d23ee7d01179c423553f30ccfa92d225bbcaf509684d5687d1f76af33aeef989be235a4b0adae05865dff368153ba1ddb122588c8c73d747

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
303B

MD5
350badae40a7d4d1b432eff898c5c81e

SHA1
6b19d0d44fa12a3237c228c67dd67860ca3b37c0

SHA256
b8a82abdaa6909b2208816af72c71742279c611f34584c346d0443d68a033ecb

SHA512
3b19b3fccbb2e387327e603f0927880dcbf79572bf45ea26de89a8ca6b31645850be475b77f7e01fed3883b59f578a43f895f21a7ab441ac1d46e2162ff8bca3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7111d5ac07be984fac3633faa6b4edf7

SHA1
5409b3558088d1be080129be085492fb58250a20

SHA256
c6ce4b2f833536a19a69fc9cf1b077db3b71564e8b94bb8d20eb0830d174c616

SHA512
d6eb042f8fdbbf6b86a7c397a5a04de98ecaa52fad01858e4ea36aa66762fc4d11123fe47a811c3c837ba99c7ccd5dc9082c176fd1d80950203f70142ef0ca6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9726a7b444e403c7057dca505533264b

SHA1
0910806b539580f22d7f9758be12bfc51e37dbe4

SHA256
24a19ec322e313d5c37215e7c439093782a12b84cd54d5665bfa0908df161e19

SHA512
64a195b186f4dc8e6acea5f7da9f1729160af89afff74b79e4e352a928dae8557f1cf8a18dd2a9f9d09def53b6962b9e78ac5d4abfb5bda12e92faaebd194105

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
\??\pipe\LOCAL\crashpad_4540_CLHNVPHUVVQWHQPT

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads