dd5f89c5e4cf842f27156d95fc7211472a4f0d80e677c04c4022e9622069587f

General

Target

691d407da644f7f7c4f3e2673426040c_JaffaCakes118.html
Size

7KB
MD5

691d407da644f7f7c4f3e2673426040c
SHA1

eba9ff8e0aafc87276e4bcb4bc8eb06fca4b055e
SHA256

dd5f89c5e4cf842f27156d95fc7211472a4f0d80e677c04c4022e9622069587f
SHA512

ae581e6407b943601f32f32bce4df3f445c3662289aefacbb0cea1d32d16a3be6ec6596acbf1afd9b66f4a1ae13b0314afb78ac7e7286a3bcf061ab9453ce6b0
SSDEEP

48:ImMq1Up8vmbBsj2gAiEgVr+CflxYOZAyNGWBXtz44xt5YWDrWN8+ZWQdxdXX/1D8:SIPdf9NBXYwoldxd2StUf1dRKmcRC

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2448	msedge.exe
2448	msedge.exe
3528	msedge.exe
3528	msedge.exe
3212	identity_helper.exe
3212	identity_helper.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

3528 msedge.exe
3528 msedge.exe
3528 msedge.exe
3528 msedge.exe
3528 msedge.exe
3528 msedge.exe
3528 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3528 wrote to memory of 1428	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 1428	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 4000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 2448	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 2448	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 2688	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 2688	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 2688	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 2688	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 2688	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 2688	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 2688	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 2688	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 2688	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 2688	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 2688	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 2688	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 2688	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 2688	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 2688	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 2688	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 2688	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 2688	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 2688	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 2688	3528	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\691d407da644f7f7c4f3e2673426040c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc19cc46f8,0x7ffc19cc4708,0x7ffc19cc4718
2⤵
PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,17106089916162560949,13176716114953455291,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
2⤵
PID:4000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,17106089916162560949,13176716114953455291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,17106089916162560949,13176716114953455291,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
2⤵
PID:2688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17106089916162560949,13176716114953455291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
2⤵
PID:1764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17106089916162560949,13176716114953455291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
2⤵
PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17106089916162560949,13176716114953455291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
2⤵
PID:648

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,17106089916162560949,13176716114953455291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 /prefetch:8
2⤵
PID:4256

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,17106089916162560949,13176716114953455291,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17106089916162560949,13176716114953455291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
2⤵
PID:3236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17106089916162560949,13176716114953455291,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
2⤵
PID:2064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17106089916162560949,13176716114953455291,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
2⤵
PID:1548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,17106089916162560949,13176716114953455291,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
2⤵
PID:632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,17106089916162560949,13176716114953455291,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5132 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3236

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
72B

MD5
7f88a0e038be9be539994e4291735c9e

SHA1
ed04fa614b3736edcef205873dca3e6ab7165c8e

SHA256
bbe568598eb2b37873868958a82b8d75253a85ad4a6c23fccb97379a6d9188b7

SHA512
ecc00086ecb40ba211fbcf98fdda9db2f9fc18d8df9db3aa8603e51a2540c5ae1f21dc11fad4e3b8ac06bc3003ca7459423b37463b2b7b4ddb809a851cf57cec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
7324cd709ce4867a984eeef4b509947b

SHA1
ac5b9c12e1c0949f8868b290730fef461eb9de69

SHA256
998be712826c965d79b491fed607b50e3976844505e7df0ad69f0bef4e530042

SHA512
f1b3225310f652a0f6b206a0dde6b2fbf2bff1da7f5f29683e4537a248c25f4bd8d002d281682e150aa60dc39ffcae719abc373beef258f75257e08b616581cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
981512f85d2e7d526145da9c14c2be1e

SHA1
6e30985fd378aa67bf0f24ae04574bf96f38a50c

SHA256
edcb11dda7b7696f84a291fd90500c2d5c72568c644e550ae3496831cc72a098

SHA512
fea63462842b2a8f856a366edb3498b56f2c80c7bcef99fa0118cccfb767b0d0d080e523e3e53fd737af9d40669b85ac33a67734c5a32b0c7e5f4f6cfeb5c808

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
b8d3592167c00302f3cdba038e78a992

SHA1
893d50143a5f04c6ab901defcc872443d6c8ec10

SHA256
cbbacde8500df9ce5b85a6499c114f3bb38fc2f7d38412f2941443a77a28cc59

SHA512
0d97664ddc306c9aa315645f00354d9206d74d05ee58ffa9c35ddc8d3ddf89d461ca7328b9dffabcb6509ecf0b12bc67be01788526f971ccaf12c6ae4fbb3961

Download Submit
\??\pipe\LOCAL\crashpad_3528_PFXQDNKUHPJFTJXD
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads