edffb83aa9feb7ba300f2987d395a42217089a37f2623fa129058f38307c28a1

General

Target

b14811b2b6c5648a6a3566069907a29d_JaffaCakes118.html
Size

230KB
MD5

b14811b2b6c5648a6a3566069907a29d
SHA1

b565f09ae17132f0020608201f85b0c7304a7650
SHA256

edffb83aa9feb7ba300f2987d395a42217089a37f2623fa129058f38307c28a1
SHA512

e7c8d5ffbbd87acbaf6aeebaf357b4cbe6d27e17f0612dfa73c37cbf7d8ef20331dad0f9d6655d10c70eb4c42a9dea14cc0181d126f9bcbf1d94c301916eaccb
SSDEEP

6144:hLuq9+VgopUNqswBaxHRt6jwjzHNVJ9VWaGaLU:1uA+VgjvFDF5s

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
5064	msedge.exe
5064	msedge.exe
2904	msedge.exe
2904	msedge.exe
3192	identity_helper.exe
3192	identity_helper.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

2904 msedge.exe
2904 msedge.exe
2904 msedge.exe
2904 msedge.exe
2904 msedge.exe
2904 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2904 wrote to memory of 4632	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 4632	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 3812	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5064	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 5064	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 1432	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 1432	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 1432	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 1432	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 1432	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 1432	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 1432	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 1432	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 1432	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 1432	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 1432	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 1432	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 1432	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 1432	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 1432	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 1432	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 1432	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 1432	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 1432	2904	msedge.exe	msedge.exe
PID 2904 wrote to memory of 1432	2904	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b14811b2b6c5648a6a3566069907a29d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbfd7a46f8,0x7ffbfd7a4708,0x7ffbfd7a4718
2⤵
PID:4632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,9611896991523273961,2020038661741068751,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
2⤵
PID:3812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,9611896991523273961,2020038661741068751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,9611896991523273961,2020038661741068751,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
2⤵
PID:1432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9611896991523273961,2020038661741068751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
2⤵
PID:3216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9611896991523273961,2020038661741068751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
2⤵
PID:1488

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,9611896991523273961,2020038661741068751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
2⤵
PID:364

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,9611896991523273961,2020038661741068751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9611896991523273961,2020038661741068751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
2⤵
PID:4312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9611896991523273961,2020038661741068751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
2⤵
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9611896991523273961,2020038661741068751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
2⤵
PID:1864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9611896991523273961,2020038661741068751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
2⤵
PID:1840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,9611896991523273961,2020038661741068751,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3052 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4728

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
1KB

MD5
6cbfad4ca6cd79471fd8e293759ddab7

SHA1
efe78b9fd1fe4529ad27663149ee348d2f819782

SHA256
c9aa10a6527c2fc22c163eb546780a364fed7520807a4ad3c7b2b1e6f57b69e9

SHA512
f4bd1f1115477f24be596c755d091aaaa1da6a8be16f60842a450ffb172b8a57251a71ecad1687bfce4837c06585bf16e2dd370b5b25757fa940ba33445ee9a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
10977da1fdbe8c4dd9da52f0a1273254

SHA1
8cff12ea5b1c9a2bf5c1a3598897ca5d31add9eb

SHA256
e0a1266c2687ea71c30a034abf93ff38ae1e2cef3ecb7aa6948123fb4b9d257c

SHA512
08efac60e4cb2097e9821d8807c800c54876aad3d8dff16f8ba5b75c2e2efa132b762de04520194575b3a23d4d1c55be834d37bd421e393d56de9a1da068bfce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
cb0deac1c23ac3fdefc6224edcfc14de

SHA1
602fc88456924a8ff922ab9a1f29bf74cab4e05c

SHA256
1696d99bfce7911374977c0713ed9a37c0a1f361f208bea7e65def22cd4981d4

SHA512
c7754aafbc1b85602251773afad8f154971678f6c8208ef2edc8145d75aa5b717f295bd5f8aec1a2845a34308e426a6063c4f4cf4f70c0b860cf4ffa7c8502e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
e6e99437adc5d8a5c523df246638a8e2

SHA1
4a877bb4117c14fcf5190f6c5fae18d204a2d526

SHA256
7b02a5681a9645e1c8def9665c0c98ed121641a368df2b28294eba2e360b8312

SHA512
354115283dc8128ff6be0dc91f4c2a1621d923ed23c029cbac726df75a462e637851680c85a7f1917cbc90f2717c5e636ea414ebf40ae3937569bb61c376fd5d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads