f8f5c5c584533ed014039ac6694e1b9ace98030ace6b0fe43ccc0b7d4974e7fc

General

Target

63bc66cba00c177ed8590e48f4b06887_JaffaCakes118.html
Size

36KB
MD5

63bc66cba00c177ed8590e48f4b06887
SHA1

3a8cdcee45d059b27c4333b11eb1e25954a71276
SHA256

f8f5c5c584533ed014039ac6694e1b9ace98030ace6b0fe43ccc0b7d4974e7fc
SHA512

9ae206e4eb6f251747b31867d71721a714d242c0180357248abd2e9b680cb6e175d766291e84fa857082ca93e78fbc6e07c70e1d07c8502295a41b4d00812036
SSDEEP

768:D7izOhkTPiPd0m1J8yj/dB6B+RxwkwU8QJ5fsLKtj3YGNx34QcEnZm0Y6GPFZ9CM:D7izOhkTPiPd0m1J8yj/dB6B+RRwU88i

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

4936 msedge.exe
4936 msedge.exe
3452 msedge.exe
3452 msedge.exe
544 msedge.exe
544 msedge.exe
544 msedge.exe
544 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

3452 msedge.exe
3452 msedge.exe

pid	process
4936	msedge.exe
4936	msedge.exe
3452	msedge.exe
3452	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe
544	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3452 wrote to memory of 2132	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 2132	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 412	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4936	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4936	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 3448	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 3448	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 3448	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 3448	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 3448	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 3448	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 3448	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 3448	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 3448	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 3448	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 3448	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 3448	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 3448	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 3448	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 3448	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 3448	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 3448	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 3448	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 3448	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 3448	3452	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63bc66cba00c177ed8590e48f4b06887_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffedb2d46f8,0x7ffedb2d4708,0x7ffedb2d4718
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,9738461560554269209,14066446965258090662,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,9738461560554269209,14066446965258090662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,9738461560554269209,14066446965258090662,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9738461560554269209,14066446965258090662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9738461560554269209,14066446965258090662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,9738461560554269209,14066446965258090662,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4156

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bee5323a6b096c290c48389c5e8a6c23

SHA1
b01db9c6f87f398dfc88985ec8df25967ef6705d

SHA256
73ae88867ac1589b5844ef848600aecbf3d6418fa43f5e512e5e72e7f29b7b6a

SHA512
a687153d7bce5fe241aa208c01b132eeafa4fcb054b041517d077cc7a243fd8ba51bba974968af37ed407ccd168af27cf3c8c497bed750f1ddb7f4e099236add

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
34334d9353735f5b09206779dc8fab0a

SHA1
5ce6fd1fdd17669bcbcee4299a3a42c74054e771

SHA256
5d24f439fa1209c2c18456585bd969a4ab20535473a4c0ef2e5d3f793caadcbf

SHA512
5b5b375ae0f07df121584993cff663c7c14fe02f8717a5b49e500c32f3c2fd3617f449515c59e7183ef1eff536698659cb4b7c8e4f74cefa18276308d517f4f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
493754b0ee0d82754c3fe8721fa583e8

SHA1
8f1d7fc8e68d0bfdad942e8e2d0d8a36ffa40d8b

SHA256
a36235455fa1764af929a3002a842b4b45071327d66dce28bcfdda53ad3b9ea4

SHA512
53586a6b86c5a75da5e318c60530f8785d1073e4adf9807fedb521597722ecde726528469669ada3536c495fb0880623f2ebaa85a698431309563d55390254b1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads