9a715b9d6aa2d45392398674c2ee462736525d7d614e5ab011c4f0a45d7bfbae

General

Target

6474c21caedf07777435cdf448030486_JaffaCakes118.html
Size

218KB
MD5

6474c21caedf07777435cdf448030486
SHA1

0ae70ef64a59c20e42ed6c5e8ea94fe3004d91ab
SHA256

9a715b9d6aa2d45392398674c2ee462736525d7d614e5ab011c4f0a45d7bfbae
SHA512

f264f068b1f6cee19b3c861003a68269bfee263643067a3b1cc5c1025f5babe0eb09669e5745352e07bace538057865f8f5852ff6213db77120e1328dbd48aec
SSDEEP

3072:SfIa/RWTVyfkMY+BES09JXAnyrZalI+YQ:SfIkR0AsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

4688 msedge.exe
4688 msedge.exe
1340 msedge.exe
1340 msedge.exe
796 msedge.exe
796 msedge.exe
796 msedge.exe
796 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

1340 msedge.exe
1340 msedge.exe

pid	process
4688	msedge.exe
4688	msedge.exe
1340	msedge.exe
1340	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe
796	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1340 wrote to memory of 1616	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 1616	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 556	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 4688	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 4688	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 2004	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 2004	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 2004	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 2004	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 2004	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 2004	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 2004	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 2004	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 2004	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 2004	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 2004	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 2004	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 2004	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 2004	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 2004	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 2004	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 2004	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 2004	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 2004	1340	msedge.exe	msedge.exe
PID 1340 wrote to memory of 2004	1340	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6474c21caedf07777435cdf448030486_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe6ed746f8,0x7ffe6ed74708,0x7ffe6ed74718
2⤵
PID:1616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,8930330209141860328,10467338705392266734,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
2⤵
PID:556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,8930330209141860328,10467338705392266734,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,8930330209141860328,10467338705392266734,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
2⤵
PID:2004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8930330209141860328,10467338705392266734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
2⤵
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8930330209141860328,10467338705392266734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
2⤵
PID:2916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,8930330209141860328,10467338705392266734,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2772 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4788

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
a633ebfc6567be5b41a4c6cf775e44aa

SHA1
7f236a28c6f9ffa79d6c32340a7890ae700a87e2

SHA256
6a0cee76bada3347bb65450b5a83957c5ca12c3d0d9dbb23e38904ad04285668

SHA512
d6fc00a606a5561e661bb94833b2e47907cd231c3818f144059383b2178642d9fede5036c0a91cbaa8e5ce7f4ea34c3450a98768bf3bcd86169de427cc0ed59f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
64bcd291084f0c1b2781a784c6cd7477

SHA1
f0c2b3ccd4a9a9040550b69f0646cf88190148f0

SHA256
f70166cdd91e9b727e631e9922344312a047561bf8a01dfb92055606416d4c13

SHA512
e8400d60f137d13fcc5a5516d9dd50e69c751664175800f5cd8c1c248e65c437aa21bb6828a8d7d9dc0233ddf528965c916dc9245d33dc5d1e07448a370a0fda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
fe75d85e55dd307d10d9189bcc3337da

SHA1
aa336b56ddcae092a4df3b90555dfa6b97413bc3

SHA256
96191c25b0ccfa20262e87d29d6dc512f1908e89d0c0334888a5902aa2b22a17

SHA512
7039e8f5245f069caa3b10db1f0832ac54767881fde94253b515853f2d8ad7f91425ce8131287c10f366eb547e4ebf6abe48c639127865ce99cf3ad3477ea003

Download Submit
\??\pipe\LOCAL\crashpad_1340_YYNBWWDPKBFSJLTT
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads