f359ab0dc2176147e9760834b26168ef2046bd1bc592030c29b473963b323831

General

Target

73eec6f016ec627a35a8176c81879a83_JaffaCakes118.html
Size

159KB
MD5

73eec6f016ec627a35a8176c81879a83
SHA1

6808599dca1ba1deb38f534f098f030a76a64645
SHA256

f359ab0dc2176147e9760834b26168ef2046bd1bc592030c29b473963b323831
SHA512

30274925da5e021b67f5f54e665b0cf2300f6db082e2ab493613e4ed5e8f8a9d0db8260fd5965b08dd0eddd9a6f3cd362ca7af7b61e07a858d0e40529ecd3491
SSDEEP

3072:isbx9Zj6RqW9yfkMY+BES09JXAnyrZalI+YQ:ikV+RqWIsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
604	msedge.exe
604	msedge.exe
2664	msedge.exe
2664	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
4456	identity_helper.exe
4456	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

2664 msedge.exe
2664 msedge.exe
2664 msedge.exe
2664 msedge.exe
2664 msedge.exe
2664 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2664 wrote to memory of 3208	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 3208	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 2912	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 604	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 604	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 960	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 960	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 960	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 960	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 960	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 960	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 960	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 960	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 960	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 960	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 960	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 960	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 960	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 960	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 960	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 960	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 960	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 960	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 960	2664	msedge.exe	msedge.exe
PID 2664 wrote to memory of 960	2664	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\73eec6f016ec627a35a8176c81879a83_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e77046f8,0x7ff8e7704708,0x7ff8e7704718
2⤵
PID:3208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,14109904210467324671,8991793523261807022,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
2⤵
PID:2912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,14109904210467324671,8991793523261807022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,14109904210467324671,8991793523261807022,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
2⤵
PID:960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14109904210467324671,8991793523261807022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
2⤵
PID:4920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14109904210467324671,8991793523261807022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
2⤵
PID:2776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,14109904210467324671,8991793523261807022,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1844 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3932

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,14109904210467324671,8991793523261807022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 /prefetch:8
2⤵
PID:3664

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,14109904210467324671,8991793523261807022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14109904210467324671,8991793523261807022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
2⤵
PID:2892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14109904210467324671,8991793523261807022,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
2⤵
PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14109904210467324671,8991793523261807022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
2⤵
PID:1172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,14109904210467324671,8991793523261807022,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
2⤵
PID:2004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1708

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
c9294e7d1883bfb3a95cad785ef4ff1f

SHA1
9b4282e1e4f9764eae5f18287044b5d0ef4aeb7e

SHA256
ba89257a3b622d471e17c775a2f9419d746883c477bd801ceff1e6f6218ae269

SHA512
1e6a1dc10768fceeba98a612282f884edb93ebd5c433f4ba254a398e7362a6eb02f4d7306c1c22cc941849509592550a1cf1dbc66f58303da1ba03f567b55e0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
63c67acf26455afb45165df3c17ace1b

SHA1
d8e7c3d606280cc4b1b678ca15817f9833345464

SHA256
f3deee65d5586436d8298caadc2b7b77e647cb1e6a2b049060077a8ec67c108c

SHA512
aa45a63347fad729aac9170c2236cebc891d411f57ed86899ae41c74f089f9a7a693431fa93a2f94bc7da682f0105b44803050ccbf6123efda34d488b474c040

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f6b9dca6-8476-41d9-8167-70c8da725847.tmp
Filesize
11KB

MD5
b00a1b689dd50334f966bc8f2b90d186

SHA1
f3d087136eb26f7b2059c79476dbd4228c87227e

SHA256
79aaad266e595313648a5bf1d89b04cfc5aca99874a6121c8da68d6bae2cc685

SHA512
0417968cc32f0b99d093214364a4f8181b2f840d4857a17f9bcf1a3916fdb16cf518ba7eb10dd5c26ec72848f68823f58a82c7e0d67302e8db8f28f3e83a4cef

Download Submit
\??\pipe\LOCAL\crashpad_2664_ZSUENPKDKBFNXWGI
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads