10de1068d32cb459e3140171e5a03b7d5f11542c76d4e1b3e7c0f617f4625f64

General

Target

63e78e2c715c7f8977792e12766b45b5_JaffaCakes118.html
Size

84KB
MD5

63e78e2c715c7f8977792e12766b45b5
SHA1

1adb1b3dbfc617522a9481870bad097270c1d42c
SHA256

10de1068d32cb459e3140171e5a03b7d5f11542c76d4e1b3e7c0f617f4625f64
SHA512

76d2f5ca7171589ffa6b86cc9319b9054728612783bdafc43172bfa125335d01a89ca264b85e04dd8f0da37e12976a8d5fe0b53c3b58eee03193f2b2bcf6e923
SSDEEP

1536:NsRQfNDxJy2GEGsVn/32QujHMQG6SKZ0ePc8SBojKGawac2QAOAQAvpWkv6dziFH:Nsef1KGeBlXxuHclQN0YHms

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

2744 msedge.exe
2744 msedge.exe
220 msedge.exe
220 msedge.exe
4032 msedge.exe
4032 msedge.exe
4032 msedge.exe
4032 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

220 msedge.exe
220 msedge.exe

pid	process
2744	msedge.exe
2744	msedge.exe
220	msedge.exe
220	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 220 wrote to memory of 1864	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 1864	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 4700	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 2744	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 2744	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5028	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5028	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5028	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5028	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5028	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5028	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5028	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5028	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5028	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5028	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5028	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5028	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5028	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5028	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5028	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5028	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5028	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5028	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5028	220	msedge.exe	msedge.exe
PID 220 wrote to memory of 5028	220	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63e78e2c715c7f8977792e12766b45b5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffafda846f8,0x7ffafda84708,0x7ffafda84718
2⤵
PID:1864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6712153263704140745,7948774509801558279,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
2⤵
PID:4700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,6712153263704140745,7948774509801558279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,6712153263704140745,7948774509801558279,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
2⤵
PID:5028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6712153263704140745,7948774509801558279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
2⤵
PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,6712153263704140745,7948774509801558279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
2⤵
PID:3880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,6712153263704140745,7948774509801558279,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9857f46f-3183-4dfc-84cd-bef44a53abf7.tmp

Filesize
5KB

MD5
7094210622216a7760e3b055816eb766

SHA1
fc36461fd0b9a0ad1db3f484881c6e2d00f41656

SHA256
e42c86222b0003864c213b34bc672c8e4975a4e617aecfe61b7016ab30e3a8d7

SHA512
935bde46420919156ac87c49aa14edbac0221a4814ba10851eaa33ebaf3aaf491d160cdbe49986431c7faedb39d86e15fb295611d7f47d704859c4dc2e66df18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
309B

MD5
8e5c8c4af273453fa53f49f60d6881e5

SHA1
d1334f3fe58941c46292effc45ce5606553d8cfb

SHA256
b676c5f52ed73af5853efbc2ec84fccba1a417b3c8de188a29a0ac46244a2b31

SHA512
c60d31a0b99b929ff10a963edc35b3877d6eddea3dae84e7d5395f1744600ad6920b8a7448b1e950fda1c6d63222f5d93b5803d1ccd31e16f8032dbdb487bd24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6ac4a761c5188e4265783b35a61b15e9

SHA1
86df71b46ff558fd9d478d252de9bfb9c04b2ff4

SHA256
8db71da3a246a05ee0ce1ecbadf307cf548e424ce78c20ac29942fd3eff4744f

SHA512
1e68af098fcde64d61bc0a4dd39173d689614b8641e104bb078ee40b5f5e0854cfd3e122c5790f19d1665eb510421abcad7baa09ea94d89b5e00885a19108be5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8d01c3a05a71c7a2781ee8abecb8cffc

SHA1
b4d05b21b6cecc3d10210f9a4504224b1db0a8f1

SHA256
3ea90259e580366d5657e8d849d7ce3eaa463469bb708fcb8d7e1c007d85f238

SHA512
0e789d7cd51c1ee5289a31779599bd7a47b9a6ee6ba024364b00742913c1ecda9b09753e83b42a51967cb0c00eee3d72483cb6c830a95c640b37b490476fae68

Download Submit
\??\pipe\LOCAL\crashpad_220_ALBLDUJJSUWOMAGQ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads