e23ed72b67e8adadb4753d2b4b1ee73c4a67cff3d01cd516199d6e0bec2300cb

General

Target

65e55981e592d9809c2b2f5981172390_JaffaCakes118.html
Size

497KB
MD5

65e55981e592d9809c2b2f5981172390
SHA1

0c72ffb7889e2b2a7638758b228246040087ebb3
SHA256

e23ed72b67e8adadb4753d2b4b1ee73c4a67cff3d01cd516199d6e0bec2300cb
SHA512

6c61b08e41e8ba61353fca7d58384479f26c4105270c810db4b0f3893bbceaa712d6e20c7977681060291d43c0b48fce9969ffb486863c858c8e78cf13770534
SSDEEP

12288:zRbuvqZ1vGyEbaJGtUrYNzIupy+jsbuO1c/1E:VSG1vMt7pS

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
5100	msedge.exe
5100	msedge.exe
1388	msedge.exe
1388	msedge.exe
3704	identity_helper.exe
3704	identity_helper.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1388 msedge.exe
1388 msedge.exe
1388 msedge.exe
1388 msedge.exe
1388 msedge.exe
1388 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1388 wrote to memory of 3184	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 3184	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4760	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 5100	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 5100	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4604	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4604	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4604	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4604	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4604	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4604	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4604	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4604	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4604	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4604	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4604	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4604	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4604	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4604	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4604	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4604	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4604	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4604	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4604	1388	msedge.exe	msedge.exe
PID 1388 wrote to memory of 4604	1388	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65e55981e592d9809c2b2f5981172390_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf44a46f8,0x7ffaf44a4708,0x7ffaf44a4718
2⤵
PID:3184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16323306360846055522,15335330262498928560,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
2⤵
PID:4760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,16323306360846055522,15335330262498928560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,16323306360846055522,15335330262498928560,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
2⤵
PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16323306360846055522,15335330262498928560,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
2⤵
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16323306360846055522,15335330262498928560,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
2⤵
PID:3932

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16323306360846055522,15335330262498928560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4108 /prefetch:8
2⤵
PID:3696

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16323306360846055522,15335330262498928560,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4108 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16323306360846055522,15335330262498928560,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
2⤵
PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16323306360846055522,15335330262498928560,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
2⤵
PID:1084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16323306360846055522,15335330262498928560,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
2⤵
PID:2980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16323306360846055522,15335330262498928560,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
2⤵
PID:3756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16323306360846055522,15335330262498928560,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1936

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
326B

MD5
1aac375b60827b9859d42965b9701704

SHA1
9147ba7c2472942aadc3808fa6e108fd02db0161

SHA256
4458d711bd3329b93eef1f32fd1d8dc86b204d0dc4d25e298c84a9d4029f4645

SHA512
f1252f9318554833230d72fea3a846693f025c5c75b4bca736f092c0106348c86f37c6bca3085fc8dcb4eaf74baeda59952e415f255820d70a8764030b2795d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
2a9c35b77b3f15c693142329d99d51ab

SHA1
69948b847978157b0eac4dea6a8b2de030bcb970

SHA256
08511725a0bf0a7c2a03ba9d41cf33019d3db5912e1b05f1a60172ec2d60a93e

SHA512
aa133568cc118f68532fa8a910e596f96987c85504f410469647128ca549ea17f32e37df3a8961b85eb8f353d6bcf2d5f1c0e360364a51928f82c016ecb20546

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
d92638e5f379a68f4ac7f9282879ce26

SHA1
5501481776adb14f7914f1bbeeef1835ce6676cb

SHA256
4d7a82435d70af7cd48f37480ea2392466b9317201f0f0acc12b399892dde272

SHA512
a37950dfcb2508c4ba8a62c5cf8abd69a4cbb02b8659e691f1b2f819de9e228b572fcc512e1f440ef85a33c2d4d3a3f10fce44b3d8ffb116b033ce6f6b41452c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
d58c4eba32c1130ed8c5d29c7b764c43

SHA1
41ec87086924659cc92fedb2ca8d9113349e18dc

SHA256
bd68d1be31fdce310aab79b62b731444a8d058a1e1fade0d65c7b98251708b1e

SHA512
28c0ccb842ebada78a2f1314a1b7a5484b2547129f6d9ba61911254b388caaf32fd322e0b9d58054045aee500e3d449d9e4118d3a332e8d7383ee5b78225d59f

Download Submit
\??\pipe\LOCAL\crashpad_1388_RPLVESECKZCFCFXP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads