d006d302de43e316bad7304d776bb56097c265f209f3142ed5d24adc7948e0dc

General

Target

a834d6f3deef8f12f769e69511bfaa58_JaffaCakes118.html
Size

158KB
MD5

a834d6f3deef8f12f769e69511bfaa58
SHA1

dc34ed18027763cdb05438533c63a6b7b9a7de8b
SHA256

d006d302de43e316bad7304d776bb56097c265f209f3142ed5d24adc7948e0dc
SHA512

c4d267bdfea839258357591fbec3a8c2697c1c7c25ee702f19f8280a77a801797cb0630efc4787e9bc62ed5cd770238b0ae1921e7b308d08c8d522625566bd6e
SSDEEP

1536:ilRTyllaq0grjedb5dDZcyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09wd:iTy5W1ZcyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
3944	msedge.exe
3944	msedge.exe
5024	msedge.exe
5024	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
4968	identity_helper.exe
4968	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

5024 msedge.exe
5024 msedge.exe
5024 msedge.exe
5024 msedge.exe
5024 msedge.exe
5024 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 5024 wrote to memory of 880	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 880	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2020	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 3944	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 3944	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2028	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2028	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2028	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2028	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2028	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2028	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2028	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2028	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2028	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2028	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2028	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2028	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2028	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2028	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2028	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2028	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2028	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2028	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2028	5024	msedge.exe	msedge.exe
PID 5024 wrote to memory of 2028	5024	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a834d6f3deef8f12f769e69511bfaa58_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffb7be46f8,0x7fffb7be4708,0x7fffb7be4718
2⤵
PID:880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7167205841259037597,13295022539412994288,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
2⤵
PID:2020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,7167205841259037597,13295022539412994288,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,7167205841259037597,13295022539412994288,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
2⤵
PID:2028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7167205841259037597,13295022539412994288,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
2⤵
PID:2720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7167205841259037597,13295022539412994288,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
2⤵
PID:4124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,7167205841259037597,13295022539412994288,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3032 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3988

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,7167205841259037597,13295022539412994288,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 /prefetch:8
2⤵
PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,7167205841259037597,13295022539412994288,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7167205841259037597,13295022539412994288,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
2⤵
PID:1636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7167205841259037597,13295022539412994288,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2372 /prefetch:1
2⤵
PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7167205841259037597,13295022539412994288,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
2⤵
PID:412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,7167205841259037597,13295022539412994288,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
2⤵
PID:2436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4016

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
477462b6ad8eaaf8d38f5e3a4daf17b0

SHA1
86174e670c44767c08a39cc2a53c09c318326201

SHA256
e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d

SHA512
a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b704c9ca0493bd4548ac9c69dc4a4f27

SHA1
a3e5e54e630dabe55ca18a798d9f5681e0620ba7

SHA256
2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411

SHA512
69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
6b6e3a06d569dd3e22c7b2636dddf8f6

SHA1
4dfb0257773ee5547c1f796aa127c500ab3e24b8

SHA256
3c309ed42d31fac09eee6449c25060eee3eb2388499cf5b722f4d47d860d8289

SHA512
339701a4fc4871bb44175d71f50e1d85739ad87d2697ce495248036931840b9b9e566b9de98b72a3688b0fcc020598051927520ae1dd0bad8b8f720cd972b169

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
5ae706292e84beee61ef0b4a625a15c4

SHA1
4300987a87da82c97038125111dc1ee7996b5558

SHA256
6adbe75faf836f13ad0cb3be0c0d85899add1b81cfc31c82367564425e8d8f85

SHA512
827b507b549789c631226388d43162b0d36a10b91b63ca5f1b2642a6f3ffe9ba6f06d20d808e617011629fccefbc858ebaab700d6b670cf61526f87c49d18f87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
32e6013ea884a8428b511cf9f7393960

SHA1
c77154717992e366f82cae8cee04f660a6e61517

SHA256
5c619c42f42a1f6ccfeba13c38b5938461f5a011184cd24df35899b6715ac32f

SHA512
e2e6f93d52a2117a74bef57242de99030ef7aa395ba3e7367af3e85b4515d57d13a9162b776e35e8792339d430e95f63a92bd4b1345cce9e45aba75f76b95203

Download Submit
\??\pipe\LOCAL\crashpad_5024_OCDEQRQLLHUBHJSK
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads