968af2dfd5b8aad699ec089bd63ed0f37ce435dd1df4f65899623093afa32d9d

General

Target

65da4993a6961cf88c88c2633da9dbd8_JaffaCakes118.html
Size

30KB
MD5

65da4993a6961cf88c88c2633da9dbd8
SHA1

121935ac99d906848a7134b394a120f34f91a4c5
SHA256

968af2dfd5b8aad699ec089bd63ed0f37ce435dd1df4f65899623093afa32d9d
SHA512

cbafec7c3ad8002813b0360ecd98028fc7c270566db92263a48f499b2d8c4734ec74dd2895e5598e834ea9bad3c570fb51d0587912a0ffa6a24e2772c21b49d9
SSDEEP

384:SbHAoGzygTeyUtTmF3i2hV+5cpCGUvMt/FHnS6xKZyRtcfx3yn:SbizyIeyUUO5U4B6x4yn

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

10 sites.google.com
14 sites.google.com

flow	ioc
10	sites.google.com
14	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3780	msedge.exe
3780	msedge.exe
2856	msedge.exe
2856	msedge.exe
1084	identity_helper.exe
1084	identity_helper.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe
752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

2856 msedge.exe
2856 msedge.exe
2856 msedge.exe
2856 msedge.exe
2856 msedge.exe
2856 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe
2856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2856 wrote to memory of 880	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 880	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3924	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3780	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3780	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3028	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3028	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3028	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3028	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3028	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3028	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3028	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3028	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3028	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3028	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3028	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3028	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3028	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3028	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3028	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3028	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3028	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3028	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3028	2856	msedge.exe	msedge.exe
PID 2856 wrote to memory of 3028	2856	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65da4993a6961cf88c88c2633da9dbd8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9e7046f8,0x7ffa9e704708,0x7ffa9e704718
2⤵
PID:880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4371603593452953761,15474684862712179797,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
2⤵
PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,4371603593452953761,15474684862712179797,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2468 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,4371603593452953761,15474684862712179797,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
2⤵
PID:3028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4371603593452953761,15474684862712179797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
2⤵
PID:4012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4371603593452953761,15474684862712179797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
2⤵
PID:4800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4371603593452953761,15474684862712179797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
2⤵
PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4371603593452953761,15474684862712179797,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
2⤵
PID:4948

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,4371603593452953761,15474684862712179797,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3268 /prefetch:8
2⤵
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,4371603593452953761,15474684862712179797,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3268 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4371603593452953761,15474684862712179797,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
2⤵
PID:4476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,4371603593452953761,15474684862712179797,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
2⤵
PID:2924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,4371603593452953761,15474684862712179797,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0a6e7fae-f02e-47f3-9b8e-1e75866a17cb.tmp

Filesize
701B

MD5
71b762540f16113faae6cd9336c82afc

SHA1
42fb4a1a709269cae739f7ab34359698a712ed9f

SHA256
2464af16b3f81510deb8b92fcf3abf0b43d883a610e5de9bceff06a6affe8a97

SHA512
5d2758676b1ffee4ebce1d7f120494224e4cafc180ac7dc1646fc442d858e4cb0907627e6580d1ef8795e93403e2a4c96b2221a6aa3e02803cdcbecbfd46b0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eff50fc4bd195ac81fbae8a998560827

SHA1
30cfbb66d3764271596a237ef87e5e45fe06a5db

SHA256
a6f8b3fed8fd0a4de0a0b109ee1428d286919b14bdca814cedfc32b160358841

SHA512
2a4cfc77a17a5e91f64aae4ef58daf54431f4599fd66c4521ee431c91f3da4914cfe3e85d0c920d40e9020bbccb961f1bb13f342750e6d4eb764f2d2cfbf08b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b8d6cfb8035346755c30f03089667b8e

SHA1
5e18498834038851625ec153785d3d05b5572e20

SHA256
91da114f68933d81595a9f21eb1f3c17e21341422367b6a8c86248c3055e9de8

SHA512
404141da89b1894fe5e4f5e61efb12d655a6a055943f4dd146ff0c2b8e0ab57845de20f81ed088239472a570cd2a4759c7a7ae226d5d8007c0b667316d99f374

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
990d36187557f007916f277a97043c9b

SHA1
239de72d27706b27ee5a92ca7cca21d0d422ea9e

SHA256
90a45978feaab41e100efa859c18b2d300bce457ac54a36081dfb7d48cd18839

SHA512
07045ae6700e1d8d228017a7566f6afae962a57abb8bc9db35fe6a54a6086f0bca9f45d5d14bf09d1b2d82ddd96623062ea71618a2e583ada81c3cd9694f9cb0

Download Submit
\??\pipe\LOCAL\crashpad_2856_HHPSQAGLFKSOJPFD

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads