80cac0e58f514cb36b121d2b96c5dd3ef805d26f44f9a05d0fe3fe9e84fe4bb8

General

Target

8473264651452c1bb7e26df989c493d7_JaffaCakes118.html
Size

156KB
MD5

8473264651452c1bb7e26df989c493d7
SHA1

0d28333d8fe2d3da75bf57ca1938dbfe49143c18
SHA256

80cac0e58f514cb36b121d2b96c5dd3ef805d26f44f9a05d0fe3fe9e84fe4bb8
SHA512

9b3d87791868d71418941e4057f7c01bb60eaf7a6f6f03b7fb6ff150d815afe0d21e4cc87e504b3a06436ca73dc2036280dab75afad960c681b0f2b67ec2e46d
SSDEEP

1536:ifRTB01Z7JMm8MyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:ixAJ3DyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

1364 msedge.exe
1364 msedge.exe
4504 msedge.exe
4504 msedge.exe
4520 msedge.exe
4520 msedge.exe
4520 msedge.exe
4520 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

4504 msedge.exe
4504 msedge.exe

pid	process
1364	msedge.exe
1364	msedge.exe
4504	msedge.exe
4504	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe
4504	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4504 wrote to memory of 4820	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 4820	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1392	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1364	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1364	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1956	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1956	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1956	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1956	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1956	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1956	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1956	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1956	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1956	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1956	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1956	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1956	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1956	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1956	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1956	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1956	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1956	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1956	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1956	4504	msedge.exe	msedge.exe
PID 4504 wrote to memory of 1956	4504	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\8473264651452c1bb7e26df989c493d7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd3a146f8,0x7ffdd3a14708,0x7ffdd3a14718
2⤵
PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,15151090082058187405,8478299985111975857,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
2⤵
PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,15151090082058187405,8478299985111975857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,15151090082058187405,8478299985111975857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
2⤵
PID:1956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15151090082058187405,8478299985111975857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
2⤵
PID:4472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15151090082058187405,8478299985111975857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
2⤵
PID:4884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,15151090082058187405,8478299985111975857,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3096 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4520

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,15151090082058187405,8478299985111975857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6128 /prefetch:8
2⤵
PID:2484

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,15151090082058187405,8478299985111975857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6128 /prefetch:8
2⤵
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15151090082058187405,8478299985111975857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
2⤵
PID:396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15151090082058187405,8478299985111975857,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
2⤵
PID:4348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15151090082058187405,8478299985111975857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
2⤵
PID:1580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15151090082058187405,8478299985111975857,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
2⤵
PID:1744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b98c9f9bbbc6411ef2887c1aabdeba73

SHA1
78acb12a0e1bdaafe1552f94d0c3d162b76082c4

SHA256
de8999aee9a9afa5702bdf8ab03d578dc4de713a88b892eb92e041f9d4c2e8ad

SHA512
f9cdb0b02a9c61fd83a8890418a640c2a0e7a4d3deb10237e31a3028c0c7d4864731ecb9ee302d94c1b71eeab41b283a2ede76402417ddfa82766bbad6c34178

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7c9d6b1d81143a99437b9150f5870976

SHA1
ca6e346352c678a9d5c3ffac188586fe680360d0

SHA256
49948cc2b2b26128e70d1af01f3f6cd63fb6b45393992e426a3a1a9c6d52cdfe

SHA512
8e76a195d5f771f0c4cd3dfa39673b885e39e5570e330b808218ed008ed49c58aab2d80b01ede2b35af27e80452763a5c72f5e17d8b34fa874d0bba193f36003

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0f8f6d5393ae5f7f9559c93b043ccbbb

SHA1
830ee20f909bea3be0f300f6cf11360d13e48ecc

SHA256
a7491a7412816436d67afc08755544c1fb58a9e0d2ba070c8f3351bcb0244bfb

SHA512
f12b3bbe1d16856cf5e911b3bfa607555969eb7ef3cd82a99ab2ea66a8143906550b36e167d468c5b8a5bedbbf64721eb9d50f6e582deb08c306a0f536ded44b

Download Submit
\??\pipe\LOCAL\crashpad_4504_JKPGPEKDLMZZDZCK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads