4c9a68174dd67d7da637140a199eb8bf3125c3c63abdcb176c5d4189cb30f833

General

Target

a52082da88beb6958b666bea48a42d3f_JaffaCakes118.html
Size

672KB
MD5

a52082da88beb6958b666bea48a42d3f
SHA1

38f9be0e6abdd47942e96e924450246dba279e1d
SHA256

4c9a68174dd67d7da637140a199eb8bf3125c3c63abdcb176c5d4189cb30f833
SHA512

bd5244ef4312e409697cca279c5914c8bdf5a9b3f51912094b6a53642e9cd831a1dd5d74b021e410fb09b6762a015377230471b5eddacc771031e515efd48860
SSDEEP

12288:n5d+X3Z5d+X385d+X3p5d+X3Q5d+X3f5d+X3+:X+V+e+F+K+P+e

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1508	msedge.exe
1508	msedge.exe
4256	msedge.exe
4256	msedge.exe
3528	identity_helper.exe
3528	identity_helper.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe
2344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4256 msedge.exe
4256 msedge.exe
4256 msedge.exe
4256 msedge.exe
4256 msedge.exe
4256 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe
4256	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4256 wrote to memory of 1944	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 1944	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2988	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 1508	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 1508	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2272	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2272	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2272	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2272	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2272	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2272	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2272	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2272	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2272	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2272	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2272	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2272	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2272	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2272	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2272	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2272	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2272	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2272	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2272	4256	msedge.exe	msedge.exe
PID 4256 wrote to memory of 2272	4256	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a52082da88beb6958b666bea48a42d3f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc47d446f8,0x7ffc47d44708,0x7ffc47d44718
2⤵
PID:1944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,6693847246243311079,9717412673316374644,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
2⤵
PID:2988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,6693847246243311079,9717412673316374644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,6693847246243311079,9717412673316374644,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2952 /prefetch:8
2⤵
PID:2272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6693847246243311079,9717412673316374644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
2⤵
PID:552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6693847246243311079,9717412673316374644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
2⤵
PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,6693847246243311079,9717412673316374644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
2⤵
PID:740

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,6693847246243311079,9717412673316374644,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6693847246243311079,9717412673316374644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
2⤵
PID:1332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6693847246243311079,9717412673316374644,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
2⤵
PID:1740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6693847246243311079,9717412673316374644,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
2⤵
PID:3112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6693847246243311079,9717412673316374644,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
2⤵
PID:2464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,6693847246243311079,9717412673316374644,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2236

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
477462b6ad8eaaf8d38f5e3a4daf17b0

SHA1
86174e670c44767c08a39cc2a53c09c318326201

SHA256
e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d

SHA512
a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b704c9ca0493bd4548ac9c69dc4a4f27

SHA1
a3e5e54e630dabe55ca18a798d9f5681e0620ba7

SHA256
2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411

SHA512
69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
58d3951410cbd78f113a918a8a1684d2

SHA1
a10998b3403d2193f199b89babe8982329b1b8d0

SHA256
de3cd73d19727c0e237681d03c711178e3567a4153117afee5e96e48d53a6902

SHA512
6ce647e878fba7275b79af5da0585f30a091366efbd92adb56a0e9fda34b1224d8c4a288f851d34874989815620fdb1b2a39aadb09467bb991565d71a6c4953e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
3f431eb133516da420ee8842a0c30acb

SHA1
4da66ec1ac7d03f39cf0aac29e6b2e8fd43cf8bf

SHA256
3d9a7733694044f40392e8e51df31f934c9872d65491f3fb4d29dd915bdd06ff

SHA512
0fd38db63e0c5e57c1bad2bf5db80b6ba18b50be251d8db162270062ee17ea1d578120a880d18d3d07c0cc63915648aff653c690e9b497ab32c70294c573dc04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
35769666b7ee0944835600d7f451dda2

SHA1
f982431c097ddd4a959dc23a1391729555c0f5e5

SHA256
48c55ef2abdbbe03c9fd0c1a0de4c27f08d7ad9a93a34d778611d6a7df435ef1

SHA512
15dd8cbd4c5df6623c7d243f0f6cfcf988b44b3fcde11840f0568ed7b857df8f86111e8e6a815f84c184e3177b0eee008e4889001d56a02a9c5145528407df25

Download Submit
\??\pipe\LOCAL\crashpad_4256_EFKGWHDFGCQIUCJN
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads