46966681918b5210d7f37480683350ba3ef43de433a0890c0ba07b7a2c626a93

General

Target

755299803f2729d567d9fadc3ba7c4fe_JaffaCakes118.html
Size

139KB
MD5

755299803f2729d567d9fadc3ba7c4fe
SHA1

40967138e08a6fe8919f636021089887bc00cab0
SHA256

46966681918b5210d7f37480683350ba3ef43de433a0890c0ba07b7a2c626a93
SHA512

1595adb07eb4ba12cf73cf310709eae5171ef575c5790fef589af3f4e2e6cf67b10ab63183b692686203ed927cd19503c976d92182a1462728c403635eafdac1
SSDEEP

1536:S8Q7hvXgvyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOZ:S/vwvyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3688	msedge.exe
3688	msedge.exe
2928	msedge.exe
2928	msedge.exe
2984	identity_helper.exe
2984	identity_helper.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

2928 msedge.exe
2928 msedge.exe
2928 msedge.exe
2928 msedge.exe
2928 msedge.exe
2928 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2928 wrote to memory of 1176	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 1176	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 2636	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 3688	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 3688	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 3896	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 3896	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 3896	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 3896	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 3896	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 3896	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 3896	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 3896	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 3896	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 3896	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 3896	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 3896	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 3896	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 3896	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 3896	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 3896	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 3896	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 3896	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 3896	2928	msedge.exe	msedge.exe
PID 2928 wrote to memory of 3896	2928	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\755299803f2729d567d9fadc3ba7c4fe_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc8b8946f8,0x7ffc8b894708,0x7ffc8b894718
2⤵
PID:1176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9646551083286267201,13376680781148129895,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
2⤵
PID:2636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,9646551083286267201,13376680781148129895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,9646551083286267201,13376680781148129895,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
2⤵
PID:3896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9646551083286267201,13376680781148129895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
2⤵
PID:4488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9646551083286267201,13376680781148129895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
2⤵
PID:2492

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9646551083286267201,13376680781148129895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
2⤵
PID:636

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9646551083286267201,13376680781148129895,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9646551083286267201,13376680781148129895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
2⤵
PID:2264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9646551083286267201,13376680781148129895,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
2⤵
PID:408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9646551083286267201,13376680781148129895,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
2⤵
PID:2308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9646551083286267201,13376680781148129895,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
2⤵
PID:3372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9646551083286267201,13376680781148129895,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
bd7a6d9e7556376ab303ffa7fa481fd0

SHA1
fcdf92f20a5cd2ab33659fffec1e4241446dbab1

SHA256
979953cb529a8902714773ff40088623f01081a51930e7a10183b65fa5071147

SHA512
8c5871713e754b92a5b9ff3dc893e1610b7a47ea86936127d6fafe8d50aa91a166e80bf35a7d2efc1e545ccfc788d7d5deb266a053f09d8b2118ec897c74b8ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
0b05aca4095e179c81d400cf93d75b2e

SHA1
52a751a3481518f666b26fc45a4f5d1e31a6eed6

SHA256
f22598fd178f41555d309bb17ec2a15a08c999547c50823c1d24b2a565f0e02a

SHA512
546969bb22af5248d9b4bc44c01d56ef806157a1eb29bba2f30a684c379ccd7b7bf76deb952e077576d9e496867d4a0ce1fe6daa35c3a0748f8a0d31d6856816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f122fbfc-9473-4dd8-8472-9c2f1613c910.tmp
Filesize
6KB

MD5
643a2b809ae77750cbad8e4c4c985933

SHA1
5a3e7f65a78c2bfad590ef0a54474d2264a5dea9

SHA256
7b597d65f72a1129e9c7439d3adc098321347541728cdf80821ae67f149f1cd5

SHA512
772a420ec512a33dd5f30a898de268115328d382d722e8abe7395e5e7557a26db974ede50e2deb1110ca3d31e7ca5aae67b0542d01c8041aa3a61ac5059e98c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
6c80cf13cfd8c1627882051b3fa28a5e

SHA1
0747cafafa3b6599ecff895cd8a0b6af69f35d1d

SHA256
d5b66abc4cb3f6c3a45bee4299bd5d31f75839e4ddc73b6a6d88abb53fe3a25d

SHA512
291f8b81118f04e1d803518835f8df3b9632ffcc711c6298cc9acae6c5faa126061b228f2088fc85d8160d9d6df52c067c864ff04cce938ad71b07bf2959ee3a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads