2822cd301f70ae3fe53e3f8e5629401f204adaac4fcd9066845d4c91bc08165a

General

Target

68f636c3c02b8831e7345ac10263f293_JaffaCakes118.html
Size

216KB
MD5

68f636c3c02b8831e7345ac10263f293
SHA1

4913f0d13385d755c1ff3c786d2df5bec69b57e8
SHA256

2822cd301f70ae3fe53e3f8e5629401f204adaac4fcd9066845d4c91bc08165a
SHA512

2a10ace8056716fbfcd2b6e8f1857d81055a7710c1bb4c98cfeb1e12eba5a6c04c379fcea76f6d7b69908b4c3e1d0143587c5536bc2a4910983f6c93f0ea7b77
SSDEEP

6144:GEfAwwow/0cF8HLBl82w6qgs1WfkWk/GRRXe5NHw:DcF8HLBm2w6qgs1WfkWk/GRRXuNHw

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

3476 msedge.exe
3476 msedge.exe
764 msedge.exe
764 msedge.exe
2688 msedge.exe
2688 msedge.exe
2688 msedge.exe
2688 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

msedge.exe

pid process

764 msedge.exe
764 msedge.exe
764 msedge.exe

pid	process
3476	msedge.exe
3476	msedge.exe
764	msedge.exe
764	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe
2688	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe
764	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 764 wrote to memory of 1696	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1696	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 1368	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 3476	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 3476	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 4244	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 4244	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 4244	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 4244	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 4244	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 4244	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 4244	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 4244	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 4244	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 4244	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 4244	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 4244	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 4244	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 4244	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 4244	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 4244	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 4244	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 4244	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 4244	764	msedge.exe	msedge.exe
PID 764 wrote to memory of 4244	764	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68f636c3c02b8831e7345ac10263f293_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8c3c46f8,0x7fff8c3c4708,0x7fff8c3c4718
2⤵
PID:1696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,9740028081410533206,11851283441543261166,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
2⤵
PID:1368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,9740028081410533206,11851283441543261166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,9740028081410533206,11851283441543261166,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
2⤵
PID:4244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9740028081410533206,11851283441543261166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9740028081410533206,11851283441543261166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
2⤵
PID:4004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9740028081410533206,11851283441543261166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
2⤵
PID:3420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,9740028081410533206,11851283441543261166,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5188 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:776

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0bf11998-d530-4dcc-94ef-fd7cf5338608.tmp
Filesize
5KB

MD5
c2a4b66cb7fc4d06911c6ca1baffd737

SHA1
eba0bca2d2cccf681a625a84fb713bb60be5e0ad

SHA256
393b874ead4f9ee0ca0fc0a49bf395bd653083ebad6490a3c5e2e66d17d07d08

SHA512
4e5fb7c6b23287f059890f2d04b77a8101c5ef50afef34f78959acd61ff90311f7913d90d029cb4a76c3eaa5ab0549d8797b1823f04eb376d2df6eb5befaa61f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
96B

MD5
643f01f582af70217447b83adc535b50

SHA1
ecea2480f293d906613e51d199f8e5fe706a4535

SHA256
33ee5af61cccc80a440b1de06ef07729ba9f31f8e6c8d11740bcc2d41556e973

SHA512
042b635e8a2147edf2fd0f593658e1dcf4b4b22d62515f9d6fbaa89ba9c6dba68a880d5f8ac452c19903bfd96f28702c94e105128bbd79a273e2546b9ed5de7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
4dfae9ebe308532bc46e2ea1ef934058

SHA1
69bb617f299e0403c3c28806ea5316f97cb5233a

SHA256
99133d13aeabf0c256adb45e0f5cacc45ecd6d23f3ddcae81e40b7a3aa57887b

SHA512
143e2ef7294755142995339219170d81eb1bc79836084c1571dffe5ae354751c8610848587a4fb41d30e649b1f75966bc024b51f7f08524b45cbee20620c68dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
e9a3dbb22abafa3b9ef5e50193d6703b

SHA1
13ae32a243b596b47205b6aa20867a53122f90f7

SHA256
b519f4164e19165cb5d19b14c961441a8d31cee1345e8a7eeb215b264b55ddbc

SHA512
034056dc78cddea99b99c3e32a3f7fd23460a505ed5bdd0bad2f12ec2dcb764526aaf2417be2da4bd92e6889b0392261941b6538a8d7ca458db55f1c1cab0404

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
a3de6a80906fa61109a1354fc497cf81

SHA1
f8d0a9d4199c3b4346baecb059ec87cb82ce8521

SHA256
e7fd4d832c7918be6f0ae3a5977b8e7842a196e3b97070b3820626f944a277fc

SHA512
99989a43d3ab8e760b96431593286505a42c28b0a4bc386371a2c2e88a1139d66b7e9d22be05763e8674131f9fa2092e959196e4dd716cca20873051110798ba

Download Submit
\??\pipe\LOCAL\crashpad_764_UMMHKVHKOMUDEFPU
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads