a6fe4371ddc92a29de501feb5bf05b8c02788c82104d20cafff0a4df51ffc7fb

General

Target

84de40d749ee0d226b8a304c6fd5a570_JaffaCakes118.html
Size

21KB
MD5

84de40d749ee0d226b8a304c6fd5a570
SHA1

66b973763f37290ba40a949336a59217fd391aec
SHA256

a6fe4371ddc92a29de501feb5bf05b8c02788c82104d20cafff0a4df51ffc7fb
SHA512

21a2698f0a1344c5ab88192c1a7e5b790eb5d13c9dac002448ce499197503a7be7c756eeb3bddcbba59e52603208dbfa09154bf52b434e0eeea2235b0243ce0c
SSDEEP

384:5t29t2WAnkD01pR29lRVJJ3nDql6eIF0zLBXrPBpFJ:a2H0lf3DqlvBXH3

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
4880	msedge.exe
4880	msedge.exe
3248	msedge.exe
3248	msedge.exe
4568	identity_helper.exe
4568	identity_helper.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

3248 msedge.exe
3248 msedge.exe
3248 msedge.exe
3248 msedge.exe
3248 msedge.exe
3248 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe
3248	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3248 wrote to memory of 1500	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 1500	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 2664	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 4880	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 4880	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 4764	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 4764	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 4764	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 4764	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 4764	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 4764	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 4764	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 4764	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 4764	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 4764	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 4764	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 4764	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 4764	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 4764	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 4764	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 4764	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 4764	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 4764	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 4764	3248	msedge.exe	msedge.exe
PID 3248 wrote to memory of 4764	3248	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\84de40d749ee0d226b8a304c6fd5a570_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec00246f8,0x7ffec0024708,0x7ffec0024718
2⤵
PID:1500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,7139125707951226987,11616030558417820951,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
2⤵
PID:2664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,7139125707951226987,11616030558417820951,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,7139125707951226987,11616030558417820951,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
2⤵
PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,7139125707951226987,11616030558417820951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
2⤵
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,7139125707951226987,11616030558417820951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
2⤵
PID:4108

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,7139125707951226987,11616030558417820951,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
2⤵
PID:4092

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,7139125707951226987,11616030558417820951,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,7139125707951226987,11616030558417820951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
2⤵
PID:1908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,7139125707951226987,11616030558417820951,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
2⤵
PID:2932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,7139125707951226987,11616030558417820951,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
2⤵
PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,7139125707951226987,11616030558417820951,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
2⤵
PID:3240

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,7139125707951226987,11616030558417820951,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1296 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
181B

MD5
48acd0580b57338ddd7c29ffea4642bd

SHA1
5bd6e19fad71270e87e8ce5dc3db56c1de8baf8e

SHA256
54143088fdb43cba2a74c23cd90570b44e2fcabd67d3163e283a6f41adff43d0

SHA512
9b42c2a77593a72b5f417570e2b2f831797a8372529368cfe56157bb9a6e7fc01660ef6acd547f6723cb66e19fc4c946c124b63c57ed4c438a58149453333d2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fded9787e858ece3fc81a7d4e7fe2071

SHA1
f7b0718e1d97beade52025c38a793785dac0d33f

SHA256
0ad6e2a85fa450ad57102bcdd07aa026aae16220aee166d97f09dfdf20e3b48d

SHA512
aa25320ccbba18caf69440f1b983a32110e3a99e52020e1cb2fcc6b45aa3644dea208bb163360ac1be4b0f3620c09f5ea74ece96c2dcbeeb3babb65422ad565d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cd0b7cd11d521d95c1d9fb8759c8e16e

SHA1
4a120f0375374c896041e8e55e20c34180955679

SHA256
dcd6e522f11a472361ec85b123539dc896d1aa7b3f3d447ff31b8936fab06a0c

SHA512
9c98e7134c18c4e5a95ab523a700951d8b2051ef7f92d76968e297025d490ec9287d600f700282d7db4d962e2758a81ed37f0ae66846f042b5baa910c83abbb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0bd2580deb858d9d5189687fe1ee4e46

SHA1
4456a243db3082949ea5a7c89556c52308d592f1

SHA256
a0a165d51e43e0a98aa97cc604a12616afe173b5fc65669121db03f5e6d90057

SHA512
3c81e8b6da917604890eb5fba6b2e87c0c54caa2b754e63f15472d3bc107fa4576348e7928971153bd574d8c8dae0c46479aba9aaf56d262596e247002cb3fd8

Download Submit
\??\pipe\LOCAL\crashpad_3248_YOPXKNODWEKQCKMM

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads