e38ef5a09be6e7e62a1b4476527b3da5105718eb59158ea207ebdb7786e80607

General

Target

366245cf2789361ce500421766b35fb9_JaffaCakes118.html
Size

7KB
MD5

366245cf2789361ce500421766b35fb9
SHA1

c1f5059226fc9964d4059246b3fd183b0193bc8e
SHA256

e38ef5a09be6e7e62a1b4476527b3da5105718eb59158ea207ebdb7786e80607
SHA512

cbc36183104aacffbbce49e483cebba58d7ba50f19adf216ec78fb564cf8a41b81d5daacc8734c4959fcfd987cf3a56adbf86a70cf239ea48f2a90c83ba29222
SSDEEP

192:Dmo+/baQcAVlB/GDqmXHDq9T3ZRzUnaY9:Dmo+UKWjDqbCv9

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
564	msedge.exe
564	msedge.exe
4168	msedge.exe
4168	msedge.exe
3920	identity_helper.exe
3920	identity_helper.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe
736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

4168 msedge.exe
4168 msedge.exe
4168 msedge.exe
4168 msedge.exe
4168 msedge.exe
4168 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4168 wrote to memory of 1096	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 1096	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 2592	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 564	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 564	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 4632	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 4632	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 4632	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 4632	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 4632	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 4632	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 4632	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 4632	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 4632	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 4632	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 4632	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 4632	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 4632	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 4632	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 4632	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 4632	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 4632	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 4632	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 4632	4168	msedge.exe	msedge.exe
PID 4168 wrote to memory of 4632	4168	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\366245cf2789361ce500421766b35fb9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9cf3c46f8,0x7ff9cf3c4708,0x7ff9cf3c4718
2⤵
PID:1096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,16610455929470099106,12962842462999819696,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
2⤵
PID:2592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,16610455929470099106,12962842462999819696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,16610455929470099106,12962842462999819696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
2⤵
PID:4632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16610455929470099106,12962842462999819696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
2⤵
PID:404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16610455929470099106,12962842462999819696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
2⤵
PID:116

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,16610455929470099106,12962842462999819696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
2⤵
PID:1688

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,16610455929470099106,12962842462999819696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16610455929470099106,12962842462999819696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
2⤵
PID:4520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16610455929470099106,12962842462999819696,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
2⤵
PID:4464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16610455929470099106,12962842462999819696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
2⤵
PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16610455929470099106,12962842462999819696,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
2⤵
PID:4652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,16610455929470099106,12962842462999819696,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5476 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
584971c8ba88c824fd51a05dddb45a98

SHA1
b7c9489b4427652a9cdd754d1c1b6ac4034be421

SHA256
e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307

SHA512
5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b28ef7d9f6d74f055cc49876767c886c

SHA1
d6b3267f36c340979f8fc3e012fdd02c468740bf

SHA256
fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37

SHA512
491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cdc4770e08c1cb3555e4d01b47a88dea

SHA1
0d41033a26bde453002977b809919485df2bd508

SHA256
32c7325ffd618fd28434660bc4f7520f7e200330f33913761578a349f953f404

SHA512
102b9a084fac2910c7c2121f631ed273c1080d3efdf904af0b9d9001245d0f8ac449ffecb119c879bd757d28d8941139e06af648cc4964421528cbe96feeafd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eb061d6167d31bf78009d7236695a905

SHA1
74bf0864859747cac15f8beea8c98625ca994129

SHA256
08d27d6ba4109369efbc892f32d7dc16da5f0a966c5b7d7d64a4e4ad6177b317

SHA512
4f1aed9ad42959d70158209d20fc1dc588e0557146337c917b864d2c3f8c8c3293ebc1d34eb8faa24cc081c12043f7418e457815b72ea8700bee444e2a237daf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8445fa439f63a213692ceaee328f8e63

SHA1
bc9f9f1e73373faace3d95c520cf3a35634a3753

SHA256
d640b9538e35aa95454b8477ad5ed5e936436028d8c70133c44b8666a5c59095

SHA512
e5fa4045dc23a6de868b086a9d7e6d2a0ebcabda170112e93c59346da30895879a80f01f340cea7f3bcb5939a33e83a97531f8bb5499c8c88798ba44738b1e90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
af05f3d3603994277b67bb999bfb3359

SHA1
a9fcd910ea5ce8ce50296f6f0d74c882b69da162

SHA256
e728a41253a96d9b2146e5716fdb5a3587da805c213c28af575ec12577a1541e

SHA512
c2e1803ff3c27f41352cae28f723b1c95ea82b0efaa8b89cfcebfa54cdabd4e91243749680d9828cb61a6119c1dea9ea9a98e072783d03e3a108e57f2bcd987d

Download Submit
\??\pipe\LOCAL\crashpad_4168_DFGGAVYDFWFKVBAZ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads