dc961f0cbef643805b1f83ac562498e268da3aac9f36c2e4c0f638056a166403

General

Target

6c4782220d6e3d0df0e611a2d7a08ca1_JaffaCakes118.html
Size

141KB
MD5

6c4782220d6e3d0df0e611a2d7a08ca1
SHA1

91fa08fd1da80137fdb27fc61ddb4717ab566997
SHA256

dc961f0cbef643805b1f83ac562498e268da3aac9f36c2e4c0f638056a166403
SHA512

147e5ea3da6d7de4aa2a0bc68e45328b7ff1d40b93c8dd51bd783782bcb05cb9a1305c2434eb03eb96f59981edd067c4f69c0d018ccce4a951e1a5530b454e28
SSDEEP

1536:S8u5XwnNyvj/jTuQLxyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXAZ:S80LxyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1976	msedge.exe
1976	msedge.exe
3172	msedge.exe
3172	msedge.exe
3360	identity_helper.exe
3360	identity_helper.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3172 msedge.exe
3172 msedge.exe
3172 msedge.exe
3172 msedge.exe
3172 msedge.exe
3172 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe
3172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3172 wrote to memory of 4496	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 4496	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1584	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1976	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 1976	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 2792	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 2792	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 2792	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 2792	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 2792	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 2792	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 2792	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 2792	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 2792	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 2792	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 2792	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 2792	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 2792	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 2792	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 2792	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 2792	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 2792	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 2792	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 2792	3172	msedge.exe	msedge.exe
PID 3172 wrote to memory of 2792	3172	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6c4782220d6e3d0df0e611a2d7a08ca1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdba7a46f8,0x7ffdba7a4708,0x7ffdba7a4718
2⤵
PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,8944483589145722840,10372223597850399374,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
2⤵
PID:1584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,8944483589145722840,10372223597850399374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,8944483589145722840,10372223597850399374,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
2⤵
PID:2792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8944483589145722840,10372223597850399374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
2⤵
PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8944483589145722840,10372223597850399374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
2⤵
PID:488

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,8944483589145722840,10372223597850399374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
2⤵
PID:2200

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,8944483589145722840,10372223597850399374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8944483589145722840,10372223597850399374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
2⤵
PID:3656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8944483589145722840,10372223597850399374,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
2⤵
PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8944483589145722840,10372223597850399374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
2⤵
PID:4920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,8944483589145722840,10372223597850399374,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
2⤵
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,8944483589145722840,10372223597850399374,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5500 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3228

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
799bc0d1627c1bec927686d2990a26fa

SHA1
97be10d7ce54c58958cf34d2b0a49e742cd080c5

SHA256
3b1e0c81c72a95708ade6240519d7864475474420b0d17dadadea683d8722aaa

SHA512
8978c95b7e5d0d2c6008d3c814547ee76ce618f773b97fc2fe9533a6cb3bd3fd22d6e86022042a9a3df1aa2d5fb12aa9d1eff52905e851d73ac7ffcd3f459e94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
2310bfd6358a60beab70b0693f9e6cf3

SHA1
d2a0387f05f255e84df44b0e338e4e8d245cb891

SHA256
d0994820150ffc823fdf28bc1cdfa44ceab6d0ee6db7602c2c71ba05999fc16d

SHA512
50172322a011669a88db498bc20c98cf95b8a9f834575043e40a61cf756f0096197ae7cec0706303675307affc98dbab45a35a4118798c75ab34a245b0b669a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
e05d6299bc9640be7bf8b5fe6fc5b45d

SHA1
69ff6bdb58c367f4b7db8aea0c7ed0dbe3d83d2c

SHA256
ade96380bc842ae803c49fa30529c0783e8ebf0fe2c023ff33915efaf925113e

SHA512
45e356b26bfb6fcf2274157cb0ee14f89bba7d2a4bc28cb51de6e78985e423d6c65141859701e0a2eeecc22cd551ef0360c04f1db2ce61f517cc667bdcf73686

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
4f44fc81220b3a641cd645e8f3cad963

SHA1
b3c4b76b440b174b65a664b710566fa3ed608c1e

SHA256
56a7f2a9dd3e31c9a051078cb9299a05a6681cedd27b6fdb3249b5a1f3296096

SHA512
57ece136da704a51fea092fbf7411e60008fa88e7b86e105f4a15999ed89ec39e2eb839bd5e9869b65baef1f8c8e804201a18514a82707c83653130332dda880

Download Submit
\??\pipe\LOCAL\crashpad_3172_EAEURFQIBNPQPJZJ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads