d8f7c2ed84d1ed0ce259fd977cdf950265b20403a2c3a2cc8021f85c399c86d2

General

Target

6cc78b43a778335c0fcf2c90ca35bd9f_JaffaCakes118.html
Size

177KB
MD5

6cc78b43a778335c0fcf2c90ca35bd9f
SHA1

374658fb1ca2aa56852a8b91538d2ad60eaceaf0
SHA256

d8f7c2ed84d1ed0ce259fd977cdf950265b20403a2c3a2cc8021f85c399c86d2
SHA512

189c8254fe386935e1eca7e52e83442dbc3156676faf68d5b281399eb4bc582b0d3d7523eeba1621a98501a44c2fdfed09fab6e167229f31a5b33bdf6f56d789
SSDEEP

3072:SOxMyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFiM:SWsMYod+X3oI+Yn86/U9jFiM

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1028	msedge.exe
1028	msedge.exe
3196	msedge.exe
3196	msedge.exe
1380	identity_helper.exe
1380	identity_helper.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe
2956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3196 msedge.exe
3196 msedge.exe
3196 msedge.exe
3196 msedge.exe
3196 msedge.exe
3196 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3196 wrote to memory of 4636	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4636	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 4604	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 1028	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 1028	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3976	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3976	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3976	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3976	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3976	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3976	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3976	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3976	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3976	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3976	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3976	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3976	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3976	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3976	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3976	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3976	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3976	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3976	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3976	3196	msedge.exe	msedge.exe
PID 3196 wrote to memory of 3976	3196	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6cc78b43a778335c0fcf2c90ca35bd9f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe6c446f8,0x7ffbe6c44708,0x7ffbe6c44718
2⤵
PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,7023559095433739543,5440247285512239921,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
2⤵
PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,7023559095433739543,5440247285512239921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,7023559095433739543,5440247285512239921,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
2⤵
PID:3976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7023559095433739543,5440247285512239921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
2⤵
PID:1608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7023559095433739543,5440247285512239921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
2⤵
PID:3500

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,7023559095433739543,5440247285512239921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
2⤵
PID:1800

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,7023559095433739543,5440247285512239921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7023559095433739543,5440247285512239921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
2⤵
PID:3320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7023559095433739543,5440247285512239921,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
2⤵
PID:4112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7023559095433739543,5440247285512239921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
2⤵
PID:3204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7023559095433739543,5440247285512239921,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
2⤵
PID:1212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,7023559095433739543,5440247285512239921,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2748 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:528

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
f16725768a6210eeb0c310f44ab91b4f

SHA1
4bfeec89f6861a9c93e6f4d16a1c3d7822b1810c

SHA256
44665ea38f54fe764e82b5ce0390fd900a965a849051dedb643988788c34a86e

SHA512
9d657ffd71c81a1045f7cc11780d312152e7aae6c43b45ba7cd16dd337989709c3babb88e30796d45402b9c95757238599e2245165f8ee0cbe27728bf27f87d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
91a5798dcec83f573f0b7b2ca19ad8f4

SHA1
9ca2dc58de5af635d894c32daceedba761d1da0c

SHA256
150a7f8a2ad06dcc1b5ea99cd46fc6ee55f3b5a5ceaca6a995250a5146bc7819

SHA512
57af6afbb350956447f3c06db3c4b2cce98b85c19e62201c89557a9ec5d772feac78b90df6e305b51558cba8b72febb9edbf175bdde9753c74c9a8562ff38d87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
c2742c1b8b509f617f4a2fa873928e26

SHA1
6aa60e72161ffa03b3189d82f85abb4c9eac2d7f

SHA256
002c55edf14705e54fcc246718c723c7fb5ca21aa19d468c5e48bd30fb170c09

SHA512
9010c868bc6b7527e900d5e4d5f21047c45de19afcfe6fe46370df997933ecce52e523766b8ca0a360eeebe013f760d2ef43cd9de5a49fce43d447d73a28472b

Download Submit
\??\pipe\LOCAL\crashpad_3196_XXIXQOXGBXQUSKNN
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads