3b3ce82ed837bdb8e275ce9d3b2c10728858cb546b252595eaee3029f4fdd819

General

Target

64874728869536c0c36df334c25f762a_JaffaCakes118.html
Size

19KB
MD5

64874728869536c0c36df334c25f762a
SHA1

af74ae2064138234cf170d14cf5b03c4f7c4d6fc
SHA256

3b3ce82ed837bdb8e275ce9d3b2c10728858cb546b252595eaee3029f4fdd819
SHA512

6453064bb5ca38577a35daba3db498a3900bcba72c12f9b2621d25b540376d986b3302f1d275940b6e7cb85fc4001b54e52af23cf0c2e7a442954e6e5482eb24
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIy4OzUnjBhqM82qDB8:SIMd0I5nO9HBsvqfxDB8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

3984 msedge.exe
3984 msedge.exe
3204 msedge.exe
3204 msedge.exe
1956 msedge.exe
1956 msedge.exe
1956 msedge.exe
1956 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

3204 msedge.exe
3204 msedge.exe

pid	process
3984	msedge.exe
3984	msedge.exe
3204	msedge.exe
3204	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe
1956	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3204 wrote to memory of 3644	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 3644	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 2976	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 3984	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 3984	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 1244	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 1244	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 1244	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 1244	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 1244	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 1244	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 1244	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 1244	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 1244	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 1244	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 1244	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 1244	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 1244	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 1244	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 1244	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 1244	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 1244	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 1244	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 1244	3204	msedge.exe	msedge.exe
PID 3204 wrote to memory of 1244	3204	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\64874728869536c0c36df334c25f762a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97d9546f8,0x7ff97d954708,0x7ff97d954718
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3387103540270631267,1887604001389818151,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,3387103540270631267,1887604001389818151,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,3387103540270631267,1887604001389818151,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3387103540270631267,1887604001389818151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3387103540270631267,1887604001389818151,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3387103540270631267,1887604001389818151,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2a91f3ba39207869b087d5559060e4eb

SHA1
b5ac4791e003f41fc18b4b74d47a505f1e3ef117

SHA256
833c3ad02d5f5d5c0da131f37c1acc16bdac3d9f6a875df2f15484d8ef683c1d

SHA512
3619e914e28a0231668279f112a40f51b9cce51ddce6a900fdef577b50cef0f7eab83d4f54ec52c3e7f18fa40941eceb2898726a33bb5c03da911389fbb6a934

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a5273011cdba62300754322968962eb0

SHA1
d94b46e208bf3509097533ac6318623fa290fa64

SHA256
e05b45f4c250162afebf9e84d8c457e29e10a0aa4bf74213daccbce638ec9dc6

SHA512
ef1b54deec78baff4e1f3465161b1ec72fdb5e89fd4c913120a7dedef7ed61f74c6b66dfb7df1dd22e56bea391e9b7bae23f8bb8844346e862c1814c588b1d38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
40d218d92489352aedd1e769d885ea48

SHA1
9a81cb6aa288a488e6124c73b844dd11d5cee826

SHA256
79f77324568863f9eac252e1b31059309c4a3901d3ee846e1f6ff658603efa5f

SHA512
9cb2c5bc02f0f4574352c00cbddd1984c5a8e0aa4be39745f8b9d2e632cfc5ff0f2e4ee68564d2ba580f82f864bde72ebcf7e2e961f62dfa6b9dae955f740779

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
574a5df8aaf7bf53e29c86df7715a29b

SHA1
32d205064061ab514ffa676ef3f54da09329959a

SHA256
6d0718203efb77da1a4bfb1d4c9781ac73830b8bd7035e45fa9ba3203c69f69f

SHA512
229ee1ccf598a0ed156ec2d96d39366909a38b421dd832e4153126bf2e83d5904c45921d6978f1b0321dee6fc4f3facbdb4eba0b049eeda3da7664be06d19d72

Download Submit
\??\pipe\LOCAL\crashpad_3204_DVVCSBABGMDCUTKQ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads