0e8456f2c2b6832d8684133a175d9dc58b4d1298c20c7c434ae7f596ed4f775d

General

Target

65d5d34ba3d2a404aa684ac673549358_JaffaCakes118.html
Size

4KB
MD5

65d5d34ba3d2a404aa684ac673549358
SHA1

64d4d62ffe7db59dfa199de51cf736dac25dec39
SHA256

0e8456f2c2b6832d8684133a175d9dc58b4d1298c20c7c434ae7f596ed4f775d
SHA512

0fea69faf39a4de1fc1c17b0693d804c192560f812597908bf146af1473b9b56c246564d89e4b1af2948634a25a6079c665687b804cb27ea13c54ebc20b0b162
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oVOAxd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pD6

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1952	msedge.exe
1952	msedge.exe
4852	msedge.exe
4852	msedge.exe
1268	identity_helper.exe
1268	identity_helper.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4852 msedge.exe
4852 msedge.exe
4852 msedge.exe
4852 msedge.exe
4852 msedge.exe
4852 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe
4852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4852 wrote to memory of 1236	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 1236	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4388	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 1952	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 1952	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4812	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4812	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4812	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4812	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4812	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4812	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4812	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4812	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4812	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4812	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4812	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4812	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4812	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4812	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4812	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4812	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4812	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4812	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4812	4852	msedge.exe	msedge.exe
PID 4852 wrote to memory of 4812	4852	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65d5d34ba3d2a404aa684ac673549358_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x40,0xb4,0x104,0xe0,0x108,0x7ff824c446f8,0x7ff824c44708,0x7ff824c44718
2⤵
PID:1236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,17602167999769019952,7662632798575861435,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
2⤵
PID:4388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,17602167999769019952,7662632798575861435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,17602167999769019952,7662632798575861435,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 /prefetch:8
2⤵
PID:4812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17602167999769019952,7662632798575861435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
2⤵
PID:5108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17602167999769019952,7662632798575861435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
2⤵
PID:3544

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,17602167999769019952,7662632798575861435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
2⤵
PID:3720

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,17602167999769019952,7662632798575861435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17602167999769019952,7662632798575861435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
2⤵
PID:4888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17602167999769019952,7662632798575861435,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
2⤵
PID:212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17602167999769019952,7662632798575861435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
2⤵
PID:4384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17602167999769019952,7662632798575861435,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
2⤵
PID:3884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,17602167999769019952,7662632798575861435,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
292B

MD5
c5167966c18921c45eaf024080318869

SHA1
8b956d5e709a4814b2ff20fd845e0e34cf5d0f68

SHA256
57790f8a824bd1e27808536bf9729be0802359bda21978738b0c784ee0b2d2b9

SHA512
126e12ce1e45ecb1a21e5c7c12b9f922c9e4562acc7e7550d2df489fdb6eb79dea668b29ed2587dd7a17047ba460f16f769aa943802ea535dee3428ed38b7d7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bd68bf4b599cb49fe469b8bff023d698

SHA1
2414c664f0e1cee24646e6cfefa0b72aa986d5bf

SHA256
cb01c0f45fcf4e3c79ca81426e4f2c612c452330fcca57a8b48a5b0ef4ecc5bd

SHA512
8114e7ad8def1a63e9975a93155b234978861071b1263d856ca22d69d43f570e435c0bd929a4e6a78b895fd762083616de08492122c04159cd745aca03cce78a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
233247d71d92a497c86e4909ef28b656

SHA1
02f55f9010fadd19ac3116d7607efb0387c0ff42

SHA256
c7ba80e186e1ca16c9dcefbffae2604fa2651f627b376b4a277a89f5ce5b66b0

SHA512
169f459a881bad4a72c24a045e90058aad769577be333874175a109bc746674b047ee06c2f5b1ca66ced6681313187e3feaa9944f564a6e8777746e25e60a5e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
807a750c7c07ffc62f9973e12332ad10

SHA1
245f8131daa8b3e02b235a728f3cd9728e532188

SHA256
030ee3489fc2009f25cf0a0afcb9283b8baad1f88b1846b5da87234c46e688d2

SHA512
b00dd6c76fa4e7f1e1865b42443423b375c3f0ca2a3e91b40a662b1096049bff118ba23160f2a2dff7a94c7a049922dc8d4b10958a694506748a67d411079dc2

Download Submit
\??\pipe\LOCAL\crashpad_4852_YXRCEGLBCGAGHQML

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads