7318f6efde7de1215c71c7c232df4c57305816f11167ce2d2fdbde55997fa994

General

Target

63b72a351489daedb45baf02f550aa22_JaffaCakes118.html
Size

213KB
MD5

63b72a351489daedb45baf02f550aa22
SHA1

c5a56d84fffdd869ffad1df4c25eab6e8649dfdd
SHA256

7318f6efde7de1215c71c7c232df4c57305816f11167ce2d2fdbde55997fa994
SHA512

6e95edf2d3b34b0ba6a8c564f7e216dc445b3f618b0805898d9607aab224578867d5f9c439a3cc1e700a83dc1826fe6e5dd042cede32d92a57913dda6491c498
SSDEEP

3072:Sf8B8elH5sBgMyfkMY+BES09JXAnyrZalI+YQ:SfMV/xsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

4308 msedge.exe
4308 msedge.exe
3508 msedge.exe
3508 msedge.exe
3144 msedge.exe
3144 msedge.exe
3144 msedge.exe
3144 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

3508 msedge.exe
3508 msedge.exe

pid	process
4308	msedge.exe
4308	msedge.exe
3508	msedge.exe
3508	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe
3508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3508 wrote to memory of 1088	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 1088	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4936	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4308	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 4308	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 2424	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 2424	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 2424	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 2424	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 2424	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 2424	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 2424	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 2424	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 2424	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 2424	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 2424	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 2424	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 2424	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 2424	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 2424	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 2424	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 2424	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 2424	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 2424	3508	msedge.exe	msedge.exe
PID 3508 wrote to memory of 2424	3508	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63b72a351489daedb45baf02f550aa22_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff99546f8,0x7ffff9954708,0x7ffff9954718
2⤵
PID:1088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,18028090275468486903,16935591894078839391,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
2⤵
PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,18028090275468486903,16935591894078839391,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,18028090275468486903,16935591894078839391,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
2⤵
PID:2424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18028090275468486903,16935591894078839391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
2⤵
PID:1468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18028090275468486903,16935591894078839391,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
2⤵
PID:3540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,18028090275468486903,16935591894078839391,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1344 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c4049e485cabe85ae1b5eb2406a22ca7

SHA1
1d0fa94e5e84a117aa4f132836639829ff28fa42

SHA256
9fa2d8c54629a51625232d465486efcf6b4e23adf4304da8914de64afe2d3e8f

SHA512
f507af24e9acceec5641407e9fbf40635591e19f0e866aec8c2ca89383c98a75376e53d8045f75a3c151fddf252b123f35b8c639116f759c3aca9861dcc00d66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fe3f8b47aa1cdf7e40eb0cf2cc406a73

SHA1
45f5cd1b8ad12f29e1c47e145630064adb18e49b

SHA256
4cb3df4d5fb905971b4c90e7df669dfb59a562f1a8b98264ca98cb98c43069f5

SHA512
6350266d6187ce265d98daf4765e35adfb22727ee40b1a334f89188dcd61145fd0f43ba7cb22200c7e3a374e4247a17bb4ab1c14d26d3f940c289a671b2a0342

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
02171e99279cfe3cace7da30030bfd9e

SHA1
0bc133aa1ead557c12804f49b243ea639b3ef5a2

SHA256
1dd5135bf43781c0d7828c4cc77dd4a07bb2ebd2bc301109c518c2e83cdb9adc

SHA512
4d0248e94e7be3d4343352b21c4a414f37bc5a04c7eb195ebd1b999b9c0e6ca4eecf37ee9258a6618fdbcac45bbdbd582ff3fedc2470bb02ab0c1831ea79750e

Download Submit
\??\pipe\LOCAL\crashpad_3508_NXOKIAHPNCROUKAJ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads