0f6ab3e9a2309f8ba6e680424feaa6ebca8904e616655523230d7b25fad29c58

General

Target

6cdfecf2e95f08a27142b4601f9b1617_JaffaCakes118.html
Size

133KB
MD5

6cdfecf2e95f08a27142b4601f9b1617
SHA1

f85dbcb5f31ac7064a5cd401bc300daa9bcf6121
SHA256

0f6ab3e9a2309f8ba6e680424feaa6ebca8904e616655523230d7b25fad29c58
SHA512

84f59cf893932b6de269b0a104de21cc7f0fa561509ab24b6be2a5738ea425d6f8da9248b8a4215611c73aba26165de6305abc53b94d4b8df7afb8d564bb4f72
SSDEEP

1536:S6F6BcMAByLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOZ:S6FtMAByfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2060	msedge.exe
2060	msedge.exe
4988	msedge.exe
4988	msedge.exe
4320	identity_helper.exe
4320	identity_helper.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe
1400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4988 msedge.exe
4988 msedge.exe
4988 msedge.exe
4988 msedge.exe
4988 msedge.exe
4988 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4988 wrote to memory of 232	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 232	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 4464	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 2060	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 2060	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1560	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1560	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1560	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1560	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1560	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1560	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1560	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1560	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1560	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1560	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1560	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1560	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1560	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1560	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1560	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1560	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1560	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1560	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1560	4988	msedge.exe	msedge.exe
PID 4988 wrote to memory of 1560	4988	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6cdfecf2e95f08a27142b4601f9b1617_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc801b46f8,0x7ffc801b4708,0x7ffc801b4718
2⤵
PID:232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,152759733008501204,9088217520211201953,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
2⤵
PID:4464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,152759733008501204,9088217520211201953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,152759733008501204,9088217520211201953,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
2⤵
PID:1560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,152759733008501204,9088217520211201953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
2⤵
PID:3456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,152759733008501204,9088217520211201953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
2⤵
PID:1208

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,152759733008501204,9088217520211201953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
2⤵
PID:2136

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,152759733008501204,9088217520211201953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,152759733008501204,9088217520211201953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
2⤵
PID:4760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,152759733008501204,9088217520211201953,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
2⤵
PID:5080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,152759733008501204,9088217520211201953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
2⤵
PID:4084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,152759733008501204,9088217520211201953,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
2⤵
PID:556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,152759733008501204,9088217520211201953,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
2f120b3d534658aef47a882fafdc0e6e

SHA1
24c53792fbb3dbc6f1bb4321f5717f7767da7733

SHA256
58c3873fcfa459d663987f4553de826d99c094df8100850d2da54bc7d1f0118f

SHA512
334d723840f74c69cc39cb1d209da2d2daccaf3777fe75cf41b7178e3e9edb911f2cbdd315fcca18e6001d0b0be4270d3d08294d3e8cdbe279c858223f4af514

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
c057332a54c9d610ce628a067a473b12

SHA1
e5a3515fb5ba5a03787ce97c34d005c512745214

SHA256
25fad1df41333ca7fe75c727bb2031b64e9923288308d2be267d50258782c710

SHA512
c7807e161dec36012687beb7a7d4cdd45cdcbd13d632ec976319c132209a17ef5ed131b4ca99ad688ad581150122cb23e9a9383c69f5dc239e6ede5a926219dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
10685b1e8393245bf44a5c6cb38204cb

SHA1
10027ab68c4bd97b2fe266158b7fa5b42ef46cae

SHA256
d5be4915f08a36ccb7cb5009fa16ea4382a7511ed8c8cb721c64cbe6ca961ff6

SHA512
68c53edfbffdd23afb1e6a09288d4c2522a06599baf6197e2566cb94dfc9b4b8d3ffd15f1f9d0b6804f2165b4656085c9efb2b9c7396c3c9288e3dff3233c0b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
947b20b1f5ab6ef96d760741d4ed7826

SHA1
ecaaa9f4b31bec2bba20d43a82ffd6785af186d8

SHA256
64986a3b8fc8beb26c45609821fd1a285c647f547406abcc172a349ec24e55aa

SHA512
6725baf449fdceed55e5edb91bed8eb211c0fc5c7d75486f9d8c904a76662252fae1b5d0aecf2fd24ae098e952595406689cefd54efdcec6f2a023145a290ff9

Download Submit
\??\pipe\LOCAL\crashpad_4988_LSMMRMHZEXGOTIEG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads