ef1a798c1944d17c598f18c3e347f968f34f2d3a8008e52f8eafdf2d9cfec309

General

Target

63dbea24fae8e05c230a50fc07ba44bc_JaffaCakes118.html
Size

139KB
MD5

63dbea24fae8e05c230a50fc07ba44bc
SHA1

c452c485fe064e75ca64220ca25f9d29d516e59a
SHA256

ef1a798c1944d17c598f18c3e347f968f34f2d3a8008e52f8eafdf2d9cfec309
SHA512

a534e999e2676865d874b4fd967acf8000b90b00fd3e2ddf89195ec9f205c9bf9ced41a1b5534d31070b98f74e468eacfdbe9089e50ff8be56e86076e9a124ae
SSDEEP

1536:S0NtfL3Ol/yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTs:S0LOyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

4516 msedge.exe
4516 msedge.exe
8 msedge.exe
8 msedge.exe
4532 msedge.exe
4532 msedge.exe
4532 msedge.exe
4532 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

8 msedge.exe
8 msedge.exe

pid	process
4516	msedge.exe
4516	msedge.exe
8	msedge.exe
8	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 8 wrote to memory of 3368	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 3368	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 2512	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4516	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 4516	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 1636	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 1636	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 1636	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 1636	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 1636	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 1636	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 1636	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 1636	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 1636	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 1636	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 1636	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 1636	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 1636	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 1636	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 1636	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 1636	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 1636	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 1636	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 1636	8	msedge.exe	msedge.exe
PID 8 wrote to memory of 1636	8	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63dbea24fae8e05c230a50fc07ba44bc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffc763c46f8,0x7ffc763c4708,0x7ffc763c4718
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,17958059954052000912,322933095333694015,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,17958059954052000912,322933095333694015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,17958059954052000912,322933095333694015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17958059954052000912,322933095333694015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,17958059954052000912,322933095333694015,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,17958059954052000912,322933095333694015,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
15413c1fd52d3c29ba93c1fc50d969e8

SHA1
3649d0bf1bb79c711a411fb7ff087cfbddd3ba26

SHA256
0625f7f745b3f8069d235390a77a63da3f5cd8523c6b149c7af984258100106d

SHA512
8aca720ba4ef9e2a2053c90c1e96876edc35c499faa1a8a3307d7ec889642deac3daac5c942bf12ceeae8576574ac7b886c9c31abe7baad464797b397405f47f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b40463eb74bc2934e2a92ebc9405b0eb

SHA1
d9b550f06a9f410ca6bd43db2c884b59a1ce0f7d

SHA256
9f5b419648a67749887dbeb5ab2d52b4b3a3d9b170c5169967a44fe55d89c72c

SHA512
23d2a75c8826e5292101442950132178aff1f4f22d8c572984c1087ee9a00120591a57034088b6d059c17c061b5d05ac799356100dcf3fd00739e4273eb36320

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
071bbd1d3f34fd890fd36acf1105a325

SHA1
df920a39efa78b4fee0cd4b970d6a35d8af8e6c0

SHA256
f8aef613f80e686a638f345ebdc61b996fd34772e623e1d590f1f09581becc79

SHA512
59d910df85b4000b40ee3f70dbfd7ddfbcc72fd3a646d4099f1791e45236e44f76b4171890bbc855f211ce6353e0a238a5e9505450c71145189fb0f45759b651

Download Submit
\??\pipe\LOCAL\crashpad_8_RMUGWOTWFILCRTLT

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads