301337d8e9e72f8558befea41b5d8c7654a3e82866f9fb95e62fdaedfd089e7b

General

Target

6ee038b979be37fba207bc6a88a3bc57_JaffaCakes118.html
Size

349KB
MD5

6ee038b979be37fba207bc6a88a3bc57
SHA1

73f400a3462d6860e6ca774440fa4826d73f8d6c
SHA256

301337d8e9e72f8558befea41b5d8c7654a3e82866f9fb95e62fdaedfd089e7b
SHA512

0c7a7b6f2bf214c1409dcb4e648c40fc817c1cfd67d033172ac8e1a60ff6945e9ad99ddb4ccd1ebb11c12ab022e27f48d108f7f572493dd210af5769e115659b
SSDEEP

6144:fsMYod+X3oI+Yx6IsMYod+X3oI+Y5sMYod+X3oI+YQ:j5d+X376W5d+X3f5d+X3+

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2304	msedge.exe
2304	msedge.exe
4696	msedge.exe
4696	msedge.exe
3068	identity_helper.exe
3068	identity_helper.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe
2648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4696 msedge.exe
4696 msedge.exe
4696 msedge.exe
4696 msedge.exe
4696 msedge.exe
4696 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4696 wrote to memory of 2252	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 2252	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 4060	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 2304	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 2304	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1648	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1648	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1648	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1648	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1648	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1648	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1648	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1648	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1648	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1648	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1648	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1648	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1648	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1648	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1648	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1648	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1648	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1648	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1648	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1648	4696	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6ee038b979be37fba207bc6a88a3bc57_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6b7d46f8,0x7ffd6b7d4708,0x7ffd6b7d4718
2⤵
PID:2252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,12070806274883500307,6515122280015929654,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
2⤵
PID:4060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,12070806274883500307,6515122280015929654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,12070806274883500307,6515122280015929654,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
2⤵
PID:1648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12070806274883500307,6515122280015929654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
2⤵
PID:1388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12070806274883500307,6515122280015929654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
2⤵
PID:2624

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,12070806274883500307,6515122280015929654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
2⤵
PID:3200

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,12070806274883500307,6515122280015929654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12070806274883500307,6515122280015929654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
2⤵
PID:312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12070806274883500307,6515122280015929654,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
2⤵
PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12070806274883500307,6515122280015929654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
2⤵
PID:4304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12070806274883500307,6515122280015929654,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
2⤵
PID:3828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,12070806274883500307,6515122280015929654,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1920 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3120

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
a5978c13f8b93ec22f4ac23af628cb36

SHA1
f973a2cc6cd313ab4a3a7a0feb65ea3e05fbae5b

SHA256
bdffbbefc6d10ed3b72770bcb01ceaa5d9512f63837ce7adfe780e92a6855922

SHA512
d470e33af628df9af4f65a3a12ee9ae173cb835689926fbdbcced9a3108344cbe6cec87497ae9c01c3e74103e8c3e908e1f7e1605f2a16f8ab338c0d139a2072

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
6bc8d48fb2fdea712e44946e837313f6

SHA1
58827a1a8c9f066579215a575aaa92038e249589

SHA256
21c084e3f2850a19634d4fba9f7a71dcfb395693cce27a428a8c1c58d9981afa

SHA512
7b5e53e5e0939a65b4de1c438669f30ecf5091bed7fc9243e743f9cb30cbd2af734506d3b56ac45ad1c3978485bd0685fbe2a627f74bd3e6838bc7e99eb0e2ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
0c8b3f2e6bc63c97cd356ef80d6fd2b9

SHA1
21481baaca02e77db8b2b93c41929765f0633a79

SHA256
0c7a39667f03540b68bf7cf8c4cf147eb0383bba583cf5f20159b1189cc6d380

SHA512
6362b59ce864ffdd0ad4158908114b00f870c106a3460477c3504e4f486a295f4b22b0f42a4f987ec718536645875f5d8e98131baf93c4f436c62c7f80d7ed1c

Download Submit
\??\pipe\LOCAL\crashpad_4696_MVIWBIBZGMNBWJFU
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads