587e1ac4dc86b32615d8298ef542e57e2630aefd09d6936d0bfba557763da8a7

General

Target

6e88da8d75658c4ed4ed9c602a0f9eb0_JaffaCakes118.html
Size

177KB
MD5

6e88da8d75658c4ed4ed9c602a0f9eb0
SHA1

4a46f5835e7bddf6cf269cf1c3b585c6ccb61533
SHA256

587e1ac4dc86b32615d8298ef542e57e2630aefd09d6936d0bfba557763da8a7
SHA512

0e4a4f4bf08b3381d03d8e110bee5d8fa7bf8960f9cb87fc22dc371b93ba42f5c4f4942961b9e1d83944f98b89f0a11dc3a1983be6a947677bbcd61245f6d20a
SSDEEP

3072:Sl+q4yfkMY+BES09JXAnyrZalI+YFrGOiDXev:Sl91sMYod+X3oI+YRGDev

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4364	msedge.exe
4364	msedge.exe
1056	msedge.exe
1056	msedge.exe
2128	identity_helper.exe
2128	identity_helper.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe
3972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1056 msedge.exe
1056 msedge.exe
1056 msedge.exe
1056 msedge.exe
1056 msedge.exe
1056 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1056 wrote to memory of 3128	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3128	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 3056	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 4364	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 4364	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 860	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 860	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 860	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 860	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 860	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 860	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 860	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 860	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 860	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 860	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 860	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 860	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 860	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 860	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 860	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 860	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 860	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 860	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 860	1056	msedge.exe	msedge.exe
PID 1056 wrote to memory of 860	1056	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6e88da8d75658c4ed4ed9c602a0f9eb0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfc0446f8,0x7ffcfc044708,0x7ffcfc044718
2⤵
PID:3128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,15152789431853552535,7119036645618140588,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
2⤵
PID:3056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,15152789431853552535,7119036645618140588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,15152789431853552535,7119036645618140588,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
2⤵
PID:860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15152789431853552535,7119036645618140588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
2⤵
PID:1284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15152789431853552535,7119036645618140588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
2⤵
PID:1816

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,15152789431853552535,7119036645618140588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
2⤵
PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,15152789431853552535,7119036645618140588,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15152789431853552535,7119036645618140588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
2⤵
PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15152789431853552535,7119036645618140588,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
2⤵
PID:2800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15152789431853552535,7119036645618140588,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
2⤵
PID:2716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,15152789431853552535,7119036645618140588,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
2⤵
PID:1316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,15152789431853552535,7119036645618140588,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2696 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4272

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
f2263d6b9519e2d634f58d41f2b4831f

SHA1
cbe474547ff8faf911ff2ae240082d39051b18f9

SHA256
39307f3b0458cccf60e0c1e8de973aa640a3e8f6eae7ab1f02b897dfa9159833

SHA512
16e72df5a4bf26128842da4715ad32b7bb9369e845a9ba589ca3740957a25b916ffc982a961b35a90a90b03e65e9af75bb6b265674fe19ea4d8ebe026e126057

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
8108823489fda54f4fecb8bb698a532b

SHA1
3db96dcd335d93b0effe9b9e40fd6156d03459af

SHA256
7a4f3373571f708f0fef1e09c8f229ddceeafe6a5b17c518fd6617b34c10fc4f

SHA512
c97a69d06a9dd59b8e1326fb7a3aa4e4a553903cc22b701034689503e3115b32f644981fe7f03fd9612e90faa647f4ea9db49a3cc1818ba968d45b99624e6a57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
f306c7f42f8602cc9ef9188fa295deb0

SHA1
9d2418d991fbe13c1f238d19be8c6a14e0530410

SHA256
eef5660aade88986df8c86d0b6c3a1456e9ecd2191e561cca600256789528a31

SHA512
26da139b9d3a531fda0c1a3b78a89973472dee8d20722c194b978632dc9ccf3e3286e773184019941152b80f3d91071ceb9b7cdaaec9ecbf240f045c25071073

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
bda3017e7a80d0321531beb9ff862783

SHA1
47a5767a923b83a5439dbcc16c5544b764c1fa17

SHA256
b587fc69f1c6c6b2c9394717c490fe28af42212c6bc62b4e77a6518812fb6e60

SHA512
d74c2a6274105ee6dcdbd2bf1d574707f0ba53a20658fd0d805e70ccac4250ff3864c50927a3de6228d24d83ff43c60f4c6c0261159f6c0e2dc709c19cc40481

Download Submit
\??\pipe\LOCAL\crashpad_1056_BMVQLFOBTRMBCAMP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads