c61e7bd3ed0ac242f74cf68e852115d577e4d14f487ed4d6b5d15fe8e216ba2b

General

Target

612c890ee10eac0e52425624684b771b_JaffaCakes118.html
Size

18KB
MD5

612c890ee10eac0e52425624684b771b
SHA1

9341ed7d32f7bd0380b0b1f8dbe0a9f2d0c7782d
SHA256

c61e7bd3ed0ac242f74cf68e852115d577e4d14f487ed4d6b5d15fe8e216ba2b
SHA512

66c7ceeb06d7ba2edf71be68de17857a6df0f01d2114b85dad13df5347d5b39c7eaab275984ed62e16663d2af20b107b19a12b2398fa97ba597b2846c4231f2c
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAI7195h54kH3/398tmWzUnjBhM60082qDB8:SIMd0I5nvHHsvhwxDB8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

3068 msedge.exe
3068 msedge.exe
232 msedge.exe
232 msedge.exe
3544 msedge.exe
3544 msedge.exe
3544 msedge.exe
3544 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

232 msedge.exe
232 msedge.exe

pid	process
3068	msedge.exe
3068	msedge.exe
232	msedge.exe
232	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 232 wrote to memory of 2100	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 2100	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4724	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 3068	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 3068	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4280	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4280	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4280	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4280	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4280	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4280	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4280	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4280	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4280	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4280	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4280	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4280	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4280	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4280	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4280	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4280	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4280	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4280	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4280	232	msedge.exe	msedge.exe
PID 232 wrote to memory of 4280	232	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\612c890ee10eac0e52425624684b771b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ffe542a46f8,0x7ffe542a4708,0x7ffe542a4718
2⤵
PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12893519371540967491,6542723585549067019,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
2⤵
PID:4724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,12893519371540967491,6542723585549067019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,12893519371540967491,6542723585549067019,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
2⤵
PID:4280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12893519371540967491,6542723585549067019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
2⤵
PID:3800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,12893519371540967491,6542723585549067019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
2⤵
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12893519371540967491,6542723585549067019,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4716

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
17008810066ef94599319e6c2cd713b5

SHA1
931ed06efd3ab1a83581aa8f8b136132f8a7b051

SHA256
2caac12c4c29530e410bd17456451f29cc45aae058bec9d90b8ce2db6f6f39ee

SHA512
aa0e22d6b18e0b1d0589aa488d25f5c0e2e0461fa0975abaebc85fcace600b290187d52820091c12d38d41a10c7e4bc27eec48065fab5837b0ac37aa739e739d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
84c56360d134e7e62394d947554224ba

SHA1
3a64ed1ab5061725c218cb912f2ccc4600660938

SHA256
7e94716600875b64e31055a116cab4ea533f22eecebde37545baa8d3779b306e

SHA512
c28904b587cbc37cf8c15a35db4e681d7994b55d0929d811be5533c835bb3fcd2d068c179805189e125d20c7c033288f0ae27ac2b06ddb8e3d7877869d591104

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
b78f50f6f90c0ea88eaa61d30fca7da6

SHA1
17ad1031b2585346426a028353e12aac1b2e2df9

SHA256
5567bd06876f35035be21ef36c17b9f7bcd83fa76034b5d3770bd4844776cbc4

SHA512
c533a3a630c7d341105fc54963beea8e29b80b41edecbea87ba32bba6391a347c6b7eee7b1a1f88b15866b774dedf54480f9ad2ccd88406ba9b26be37a0218df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d33272a9-b620-4f60-801c-20e9fb28d342.tmp
Filesize
11KB

MD5
3e8a5aae3e7d700c6f83cbbf172b66b1

SHA1
985e510e245eac56a861c03c0b832587a3a27317

SHA256
c2ae05e06a7bce1a8844b4575493354ed56c1608cd21d7640925550ff4622b8e

SHA512
db255c5ea01ab976d57466a09bdbd19b5a81a5fa261f6e2128a167174fd08ef35bf6c5ba2f1e4d9c7f3404e93137de85bc16c13b7a8226b51b6ebac41a48b643

Download Submit
\??\pipe\LOCAL\crashpad_232_FPNNKSPQCOFNZAMQ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads