20866de0399e4a16dce104be9f4355ba23c3203140bbdd554705cb846e8b09e3

General

Target

73389e5f31872a3ac7ff31a09cbcd8ad_JaffaCakes118.html
Size

153KB
MD5

73389e5f31872a3ac7ff31a09cbcd8ad
SHA1

84fd381ce0ce4475bd3cab6d3d671e6f9ee20a97
SHA256

20866de0399e4a16dce104be9f4355ba23c3203140bbdd554705cb846e8b09e3
SHA512

24302cf69fe4fabcbe387a5af63cf4217d72f862a9a6d8040bf5b4f8fb43ee150be6ac3fb40c78b8330c1302f7c0ce54a2bd1201486d6b7aee21f9bb604aae4a
SSDEEP

1536:DjujMiTymeX1XEJcH6OXYKXp6XfXnHFgXHXbX3HA7XZXSXyXGHb4XrX8cXxlzyLd:/ujzxyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3600	msedge.exe
3600	msedge.exe
1320	msedge.exe
1320	msedge.exe
2316	identity_helper.exe
2316	identity_helper.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1320 msedge.exe
1320 msedge.exe
1320 msedge.exe
1320 msedge.exe
1320 msedge.exe
1320 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1320 wrote to memory of 652	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 652	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 808	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 3600	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 3600	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 4696	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 4696	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 4696	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 4696	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 4696	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 4696	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 4696	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 4696	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 4696	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 4696	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 4696	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 4696	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 4696	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 4696	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 4696	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 4696	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 4696	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 4696	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 4696	1320	msedge.exe	msedge.exe
PID 1320 wrote to memory of 4696	1320	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\73389e5f31872a3ac7ff31a09cbcd8ad_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdb8546f8,0x7ffcdb854708,0x7ffcdb854718
2⤵
PID:652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,12905638378935362337,11783220320830719653,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:2
2⤵
PID:808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,12905638378935362337,11783220320830719653,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,12905638378935362337,11783220320830719653,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
2⤵
PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,12905638378935362337,11783220320830719653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
2⤵
PID:2624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,12905638378935362337,11783220320830719653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
2⤵
PID:1060

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,12905638378935362337,11783220320830719653,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
2⤵
PID:2556

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,12905638378935362337,11783220320830719653,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,12905638378935362337,11783220320830719653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
2⤵
PID:2592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,12905638378935362337,11783220320830719653,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
2⤵
PID:3512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,12905638378935362337,11783220320830719653,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
2⤵
PID:3660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,12905638378935362337,11783220320830719653,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
2⤵
PID:3012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,12905638378935362337,11783220320830719653,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2564 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
d42743b24d76532385049dbc01c147b1

SHA1
9a0fdedf21a90658d0685af6eecd94bee02d86fb

SHA256
5ef4d4af087790949f0fff9f9c96456b7c742c71dc7e3784e234cc3621121c22

SHA512
b0d88185aaa8b15d8e7715d8e35ffd314ddecd16b17274d14816820c542869a0fa4ff8f59f9a0bc370d92148a1ce21d309d6cdfef88f96cd412d08c1fbcc9383

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
9cf403ee4bd5e911cfda47d9b45593b3

SHA1
0a7fd383f448dd7f417514a97f9caea97024f86e

SHA256
b4793473cb5e7ec27a966e0ab3ef037c93af9888d255ba984f0316ae3fa7223f

SHA512
aaa05240e93aa0b9f40e570a0c7060dc0b843c29229c1abbc7faad6d26ab31b5b95f51e259875d452ef54db86472b84aba96071e84590f5f9a6704f6b04c66cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
8d19b86a77e186e2447ab93a6b841257

SHA1
1d656d3ad6c736bf638dd154b9b86b70cec0fe5f

SHA256
e296bb136b2fae2dc0d9672ff27265979c76d5a6eacbebe9e9e4b6fc754fb914

SHA512
9840d1fb962aafb3764e05ab27150169d3ad82adbcef6301020267ec38d9c6d8a97601961d9b7ed6168f99015656e5f509435c87f7526ed00e0c8860fd6af57b

Download Submit
\??\pipe\LOCAL\crashpad_1320_LOZRJCBGEENYASWP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads