0ff077adbc440a31157dba1ea60b1c789dd0abf4097f189c478acbd1a086285a

General

Target

366074e94cb5c8c325c44adf2b6c5044_JaffaCakes118.html
Size

28KB
MD5

366074e94cb5c8c325c44adf2b6c5044
SHA1

becf04e58264a78d374b2ece7726c72d13a28052
SHA256

0ff077adbc440a31157dba1ea60b1c789dd0abf4097f189c478acbd1a086285a
SHA512

5c37f71181c2d475a339ac6e2eef0c17b0296946ccfdcf7aa6d9220995ef55387a235dd703460402ff45fddb5243c22c6fb632100ad42ec2c3fb28d233ac9cae
SSDEEP

384:l2ZBeqKVEF36U8IQQQ7OiN1MR6NokYVjt+yHRs4Bw8KtmACFBCIN7oe/FqysVfRs:l256U8q8mG7YEf/l4C1Lbmj7

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2328	msedge.exe
2328	msedge.exe
404	msedge.exe
404	msedge.exe
1308	identity_helper.exe
1308	identity_helper.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

404 msedge.exe
404 msedge.exe
404 msedge.exe
404 msedge.exe
404 msedge.exe
404 msedge.exe
404 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe
404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 404 wrote to memory of 3928	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 3928	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 1788	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 2328	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 2328	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 4620	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 4620	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 4620	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 4620	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 4620	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 4620	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 4620	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 4620	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 4620	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 4620	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 4620	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 4620	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 4620	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 4620	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 4620	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 4620	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 4620	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 4620	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 4620	404	msedge.exe	msedge.exe
PID 404 wrote to memory of 4620	404	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\366074e94cb5c8c325c44adf2b6c5044_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa437c46f8,0x7ffa437c4708,0x7ffa437c4718
2⤵
PID:3928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,5989712782679175317,9101613037796334373,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
2⤵
PID:1788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,5989712782679175317,9101613037796334373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,5989712782679175317,9101613037796334373,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
2⤵
PID:4620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5989712782679175317,9101613037796334373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
2⤵
PID:2264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5989712782679175317,9101613037796334373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
2⤵
PID:212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5989712782679175317,9101613037796334373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
2⤵
PID:4720

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,5989712782679175317,9101613037796334373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
2⤵
PID:2744

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,5989712782679175317,9101613037796334373,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5989712782679175317,9101613037796334373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
2⤵
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5989712782679175317,9101613037796334373,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
2⤵
PID:5044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5989712782679175317,9101613037796334373,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
2⤵
PID:1404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,5989712782679175317,9101613037796334373,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
2⤵
PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,5989712782679175317,9101613037796334373,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6c86c838cf1dc704d2be375f04e1e6c6

SHA1
ad2911a13a3addc86cc46d4329b2b1621cbe7e35

SHA256
dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb

SHA512
a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27f3335bf37563e4537db3624ee378da

SHA1
57543abc3d97c2a2b251b446820894f4b0111aeb

SHA256
494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a

SHA512
2bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
093de8599c567a3065569f00668482f5

SHA1
8b97170a4179ebf61ee481c6fdf0198f3bdfe668

SHA256
a97fb68a2a17d4ec6a917a0b7d24f1c978e0a6615d6edb9a329f3d62fdb2c72e

SHA512
650a03b3d2e8024666640ec5378e20e479e364b66f0f38b93d278cba348ccbfed1728b2392cee0db5c425a9eebca0ac36a196d6f0eb0c3fc865d5b6e6d5a52c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c8e125c558f107d90f5c2cdff5717957

SHA1
c9dc4159aba45771c8dec2f4e815f383a6a79a04

SHA256
62aa7650d599da1eb754fa5865f265c951c603f672022b67f0ac5dc7326775ee

SHA512
b002d4d5ead5e5e2c72f3eef16d21458d253656a64226bca653aafbe318156fd19d0bea87a634a3e7b58b0e5d80e30a90399753d17f96fa8b7e959a03ef443d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
445a0d3d703853a9ba3b406fc5eb43cd

SHA1
325487e67fd5d0560d9f4e83dbd4299144b273a7

SHA256
c2ffb4353a264c780054dd4140aa35b2d2378369f8aeab89c94095f77f63a7db

SHA512
94b9c1cead555c24bf697fcf396e0899fba6276479ffd2159a46d5248c096647bbdc4600fe40fb06a8db6f7989cfd9e84f64914dbcfd801c93cee481fc4eb939

Download Submit
\??\pipe\LOCAL\crashpad_404_QCMRFCYYORMYPMKK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads