443e74ca2959c07befc65aa24e84bc19f33ed85d4f7be549ea94cb67ba53ad77

General

Target

36624d1f9a074f795d7be3ccb223834a_JaffaCakes118.html
Size

11KB
MD5

36624d1f9a074f795d7be3ccb223834a
SHA1

348f9f0929df498aafe2072d930c03d0392b2854
SHA256

443e74ca2959c07befc65aa24e84bc19f33ed85d4f7be549ea94cb67ba53ad77
SHA512

d26fbfc217057066a4852e6f0a044a1aaafee698962ae686ab974e003914beb33989f5a510a5bf5bc72a5b9fe19e93e66136643ad4bdf33af01fafed5a566843
SSDEEP

96:uzVs+ux7GoLLY1k9o84d12ef7CSTUAGT/kDGpwcFGCU6JFGCUTXOFGCU5FGCUelg:csz7GoAYS/BIwFdNwAPHb76f

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
2780	msedge.exe
2780	msedge.exe
1572	msedge.exe
1572	msedge.exe
3052	identity_helper.exe
3052	identity_helper.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe
888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

1572 msedge.exe
1572 msedge.exe
1572 msedge.exe
1572 msedge.exe
1572 msedge.exe
1572 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe
1572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1572 wrote to memory of 2424	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2424	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 3924	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2780	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 2780	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 220	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 220	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 220	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 220	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 220	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 220	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 220	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 220	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 220	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 220	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 220	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 220	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 220	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 220	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 220	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 220	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 220	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 220	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 220	1572	msedge.exe	msedge.exe
PID 1572 wrote to memory of 220	1572	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\36624d1f9a074f795d7be3ccb223834a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd24f546f8,0x7ffd24f54708,0x7ffd24f54718
2⤵
PID:2424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,14056539510980239401,16256271983323095111,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
2⤵
PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,14056539510980239401,16256271983323095111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,14056539510980239401,16256271983323095111,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
2⤵
PID:220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14056539510980239401,16256271983323095111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
2⤵
PID:1420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14056539510980239401,16256271983323095111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
2⤵
PID:4792

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,14056539510980239401,16256271983323095111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
2⤵
PID:1176

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,14056539510980239401,16256271983323095111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14056539510980239401,16256271983323095111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
2⤵
PID:3220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14056539510980239401,16256271983323095111,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
2⤵
PID:4112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14056539510980239401,16256271983323095111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
2⤵
PID:448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,14056539510980239401,16256271983323095111,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
2⤵
PID:3912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,14056539510980239401,16256271983323095111,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4772 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e06a2cab9e0571b6cf76a2ec7bb9d0b1

SHA1
f66afe07b1a5ed43f537fa43be079a14f9845f39

SHA256
86ffd7447695fed7e1c78b0cb99073ae5e1dee3144e12833537aa0a92707a977

SHA512
22ea2e34a689761d6d968bcd2e01e7b8b02c780cfa59bdd9cea18cb51f2ff3a21ca38d135683294086ee098e4dc371852be2e1799fcc6598e8a262f589a5f5d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8415df1524aafe9155d0e7d324bdc5b6

SHA1
216a38a78a6d74f80b4b461f98520d00ea35a8eb

SHA256
9219df0c4c981fb3a344d343eb0f4b1d0fb1175d35a5c7451d82a6a94ca55106

SHA512
a6e1adbd779f150216a7c9da4721ca17c8b19041a26c4c6770bf936978e331b6c4343a6dfc9fc39b3db756d1db6c0c8a44c1cb5e127da2c36b5ef12f8504766b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
849db5745825354de32ee8b2863fb822

SHA1
4325abde72dae209e88454cfb306cec450532de0

SHA256
2536799a2f11d5e911794c642e6600f78392d43265140f54e9d09a8599ebff4b

SHA512
e836c83d06fcbac72f4284c65b2d434f6bd17ccaaa99f5f837cd55a11d15f6d3d497765e00284c975f4edecc963501891cb115734a8eaa171ab4b703f361cd26

Download Submit
\??\pipe\LOCAL\crashpad_1572_JHNOEKSAKXXUAPHW

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads