8cc35271f0f46c4484149e0829f9ae56b4cd6859994a0e5f2027b23462b2e377

General

Target

710e4d56f221729bc9034ed77408f38e_JaffaCakes118.html
Size

119KB
MD5

710e4d56f221729bc9034ed77408f38e
SHA1

771a909b55d13fca88e7edf1c6bac8cf553cd9ea
SHA256

8cc35271f0f46c4484149e0829f9ae56b4cd6859994a0e5f2027b23462b2e377
SHA512

08fec6cd855916e6ecf975f3e80dddccbcdbb005a01539ec189d7a5ca804aff9c353a340e0b8bc476b7fa3ba800deaa8e488d43dfae2829f5a856679a905238f
SSDEEP

1536:Be5yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsF:B8yfkMY+BES09JXAnyrZalI+Yi

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3084	msedge.exe
3084	msedge.exe
1628	msedge.exe
1628	msedge.exe
3224	identity_helper.exe
3224	identity_helper.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1628 msedge.exe
1628 msedge.exe
1628 msedge.exe
1628 msedge.exe
1628 msedge.exe
1628 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe
1628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1628 wrote to memory of 1800	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1800	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3136	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3084	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 3084	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1704	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1704	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1704	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1704	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1704	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1704	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1704	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1704	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1704	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1704	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1704	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1704	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1704	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1704	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1704	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1704	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1704	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1704	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1704	1628	msedge.exe	msedge.exe
PID 1628 wrote to memory of 1704	1628	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\710e4d56f221729bc9034ed77408f38e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd092d46f8,0x7ffd092d4708,0x7ffd092d4718
2⤵
PID:1800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6985211147636901420,1092807346821417880,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
2⤵
PID:3136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,6985211147636901420,1092807346821417880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,6985211147636901420,1092807346821417880,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 /prefetch:8
2⤵
PID:1704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6985211147636901420,1092807346821417880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
2⤵
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6985211147636901420,1092807346821417880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
2⤵
PID:2304

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,6985211147636901420,1092807346821417880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4480 /prefetch:8
2⤵
PID:3784

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,6985211147636901420,1092807346821417880,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4480 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6985211147636901420,1092807346821417880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
2⤵
PID:748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6985211147636901420,1092807346821417880,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
2⤵
PID:1240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6985211147636901420,1092807346821417880,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
2⤵
PID:1500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,6985211147636901420,1092807346821417880,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
2⤵
PID:2236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,6985211147636901420,1092807346821417880,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5968 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2376

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
17c41b0681c3e944cb413758198447be

SHA1
74e6a1608a8a23c97923476c4f2fc6d27d7c081c

SHA256
4ee056dc711ae2362a8ac8ed4a25b8aeb830b50525da0ccd1e156832f96f105e

SHA512
998d08096b693770500e675a1eb8bb95458680c3e34caa6085daeabb0f9a686a5b604ee8c29b09d8858446dc10dbb0a2b1f92492265168542b32bfc7c26e9266

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
77e043afd985c41cf321fe7eb54067b7

SHA1
ba3873866fec58e1a8e83c3a3e41f20e995765b4

SHA256
c002db82f6f9188ee62c508e61cfdcdcf2ef2029f6d859e35064550c54a006df

SHA512
25f1d5b374fb7e012d6ef6c974edefb307334d38bbb3521be19fb39aa957a3d5b4e03216a5a21aaf5e046acffcaee04281761da9783c5d44d0157bf54e6bc1fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
03d9b1660827cfee42df920cfb6e55b1

SHA1
3acfd0d8342153fc96c29e0bdc5bd83061cbacaa

SHA256
031293e28f5c996f2741b74a2699d3a296e8ee8a5f87b06692be7c007c9c02c3

SHA512
96abe28ad804e09a6d78fd4bd1b70073e74296516302c5bd997e8a6090060cc96b6442084918de789de0212ef71bf141396666971339edcba380acf2e483a1e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b2b16893-71ca-44b6-a7eb-eb165aa5fd64.tmp
Filesize
11KB

MD5
62b1308a8256c793d97bb5255e2875f8

SHA1
6b65e75b675ef17f575b5d79449a13efd2aca30c

SHA256
674f80aeaf383eb7e9110157f0a536a7589fa44a970895970642fd737120755b

SHA512
7cf80162a3c6474b67efb995e0729b99de364e504024e1890cdeb09e6abdc91e8e80851bc836e727743c6d7634ddeb27b3a9053f8b332ce1f5ac908209f8dbe6

Download Submit
\??\pipe\LOCAL\crashpad_1628_WFXCSGEUNFEEAWNV
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads