3183312f1787896fadc68c9709c6f95eb33fc74bc80c1abaa10da1934b800454

General

Target

6bd6eddc3eef6043814f46e7c19f04bf_JaffaCakes118.html
Size

461KB
MD5

6bd6eddc3eef6043814f46e7c19f04bf
SHA1

7125cdef6510625a7b59a229cae7de86c45fc443
SHA256

3183312f1787896fadc68c9709c6f95eb33fc74bc80c1abaa10da1934b800454
SHA512

e2df21daba5e937bcc5056a4eb27ae6d1f71d5014791524c38a4bfda8e55e836e3bceed975a3c7124cbb0438079257c85fdfcf9f670fefdcc752243f27a4a368
SSDEEP

6144:SAsMYod+X3oI+Y1osMYod+X3oI+YzsMYod+X3oI+YLsMYod+X3oI+YQ:95d+X3+5d+X3B5d+X315d+X3+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2772	msedge.exe
2772	msedge.exe
1944	msedge.exe
1944	msedge.exe
628	identity_helper.exe
628	identity_helper.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1944 msedge.exe
1944 msedge.exe
1944 msedge.exe
1944 msedge.exe
1944 msedge.exe
1944 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1944 wrote to memory of 644	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 644	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2956	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2772	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2772	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2376	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2376	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2376	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2376	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2376	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2376	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2376	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2376	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2376	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2376	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2376	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2376	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2376	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2376	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2376	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2376	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2376	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2376	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2376	1944	msedge.exe	msedge.exe
PID 1944 wrote to memory of 2376	1944	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6bd6eddc3eef6043814f46e7c19f04bf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb0b9946f8,0x7ffb0b994708,0x7ffb0b994718
2⤵
PID:644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,9323535478642543826,9097157842761087225,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
2⤵
PID:2956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,9323535478642543826,9097157842761087225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,9323535478642543826,9097157842761087225,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
2⤵
PID:2376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9323535478642543826,9097157842761087225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
2⤵
PID:3188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9323535478642543826,9097157842761087225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
2⤵
PID:3524

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,9323535478642543826,9097157842761087225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
2⤵
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,9323535478642543826,9097157842761087225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9323535478642543826,9097157842761087225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
2⤵
PID:4920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9323535478642543826,9097157842761087225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
2⤵
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9323535478642543826,9097157842761087225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
2⤵
PID:1104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,9323535478642543826,9097157842761087225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
2⤵
PID:3636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,9323535478642543826,9097157842761087225,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
be5bd4acf56731772ab5d7a4fc454121

SHA1
36bf8e543110644f5c056275d7e2b297bb756584

SHA256
3a081292f124060e8f6df002df74d358f2a0294a8de99ce850e4db2e5faf29a9

SHA512
291e2ee433ff450d3d50c37496234ed35186a5b95e62d0aa512f98efd484a5d68294b6a825b550fe34e225ea8713224dc7a96c1fb6ec58fe4da09eec8b7a0370

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
414575d5fb51f5f70da2759413243eac

SHA1
1a59f26a12d6c6c5900d3ac53d7c64081d46ce40

SHA256
0940b5411ca9e7c309c53a64ac031f2764d4277e61208b63479ec38287fdb2ac

SHA512
4bcf08756e43a99012f91eb0ddf82d5eae729bb9aba70a3e6756a0a5e979dee7b0eec3a5b4132737b8ff56c8c58956c629781452a83fff1f50c4dd6ff3512cee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
64480085cc090966dcf5a386b51d9eeb

SHA1
6813067a689fac869e55e2642448102ecb3e19b0

SHA256
ae1ef7fcc179ce90e4814d116f7806a465c308c197c7869fb830f04a1278c4fb

SHA512
be60f2e8dad739fcbad6920c499e81b7f66b7899f2f542774ddf259a70077c77d780ecfec47d09635a64e2d8e32a5ed3d948921488254adb4d60231739a7084e

Download Submit
\??\pipe\LOCAL\crashpad_1944_TGIUYQNYDDKKJYMV
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads