1190456dee4d9711923a2121cf341f7d93052a435afb101dccff31dc8ca38723

General

Target

6915ab9eb8f249d5bdf46d3400d5e347_JaffaCakes118.html
Size

97KB
MD5

6915ab9eb8f249d5bdf46d3400d5e347
SHA1

27ab97ae35360ca67f6b28a7fc4d4fabf2d4d154
SHA256

1190456dee4d9711923a2121cf341f7d93052a435afb101dccff31dc8ca38723
SHA512

35a91877c8f3c33f70244dfb1cb5c7373dcc12d38ef98d7229c03a91a84eb1a6006c177550839580b6601cb77c31214afab861659b54f573fbaa4fc40df82a00
SSDEEP

1536:Dc01baD+uotmrj0/2nR9rWka2B1ReS08fInV1t81wFQ1GafbEueeeegexdueeeex:Q/DBZs8ak1Z1Tc5V

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

3212 msedge.exe
3212 msedge.exe
3328 msedge.exe
3328 msedge.exe
4388 msedge.exe
4388 msedge.exe
4388 msedge.exe
4388 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

3328 msedge.exe
3328 msedge.exe

pid	process
3212	msedge.exe
3212	msedge.exe
3328	msedge.exe
3328	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3328 wrote to memory of 2484	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 2484	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 1996	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 3212	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 3212	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 2608	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 2608	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 2608	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 2608	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 2608	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 2608	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 2608	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 2608	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 2608	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 2608	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 2608	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 2608	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 2608	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 2608	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 2608	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 2608	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 2608	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 2608	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 2608	3328	msedge.exe	msedge.exe
PID 3328 wrote to memory of 2608	3328	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6915ab9eb8f249d5bdf46d3400d5e347_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa75c46f8,0x7fffa75c4708,0x7fffa75c4718
2⤵
PID:2484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,4764334172229516421,16218096770920738170,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
2⤵
PID:1996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,4764334172229516421,16218096770920738170,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,4764334172229516421,16218096770920738170,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
2⤵
PID:2608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4764334172229516421,16218096770920738170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
2⤵
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4764334172229516421,16218096770920738170,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
2⤵
PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,4764334172229516421,16218096770920738170,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4080

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
309B

MD5
2ee2768675acdfcffa71d7232503c03b

SHA1
e2075bd09c4558c448e35e03e58f06d708ec9938

SHA256
619b66e6fe7a45aadc2ae7d7d0e06e7a1487a973850909bad1df4fe12d43c799

SHA512
03fb7401676d83fe8bbe6f604c1b6007a39359eb9ec9d179625075dd4b9687552cc8c0a8d889ea6c5070afecf7c76b9409130459fdf249a61505e8ce74db3040

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
a97172e8a9b1675869ea8140a39588e7

SHA1
ceff01f38048be999160d2f54496bf06394da28d

SHA256
62b3d2ff3ecdd4216f3cddbb26f5a4febed0ae3384a920ffbfc3b4de37fe01e2

SHA512
30a5b9f64a8c72ed0fbef4d210be09388218eaed2a6ac5f7f4ea989ec0a134ebcc1288fb810d865d3ecb9c53146ceaaf88c21da4a863b03799eff91e143815c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
3d008f75a804706a89ad31c582b288a3

SHA1
37ffdc40d491918ebf842fd08c7758bbdc4c28ba

SHA256
3defd76d65b10abb51388be25a80dac6c9cbca61f69a737ac6e2389888c8b966

SHA512
608c51d2c96fa1adfb6bfeaae7ec43367654e964d38745aa8a95bad92741e5edb387cb065f4e40d9e4a5ba1561eff59cb53de93f9dab5c0dca9b405976698017

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
b53f1345f16b1866e150321a8eed458e

SHA1
1d919606907109f57e477fd53f6b43af0caf9242

SHA256
badbbca4a0deb873471e2540f9cb5d5598c10ef3d805233076da29fccc0f12ca

SHA512
eb0012190cba0b2190b2edc593e398f91a0e5394175cac2a6e74d85f940c032d1200f6b853a19a6dfc153902ca974e60e939f8a43e731383653224b68a977169

Download Submit
\??\pipe\LOCAL\crashpad_3328_PBQMYNFNXJBHLRPN
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads