bed05eacc0b879bfeabfd5860978c30daf9135a258e562cf9f8044a97442971d

General

Target

68d92365dcf653c048984c5aec5200e0_JaffaCakes118.html
Size

18KB
MD5

68d92365dcf653c048984c5aec5200e0
SHA1

889c70d8b6793cc3c4551ba9568f70495be8c590
SHA256

bed05eacc0b879bfeabfd5860978c30daf9135a258e562cf9f8044a97442971d
SHA512

4398ec06aab99160c7dc048a7838742a549ad0f4d754e61a959af7f3e927c22f778fe8553ced8e851c175654575239027877fa1961d76e54cd49b8b2907ed30c
SSDEEP

384:SId/Biti1jFHj7FNVaPBJ6ztD/7HSHr0ygS/:S0itAvNUBJ6zF/7HSmS/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

2996 msedge.exe
2996 msedge.exe
3452 msedge.exe
3452 msedge.exe
3908 msedge.exe
3908 msedge.exe
3908 msedge.exe
3908 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

3452 msedge.exe
3452 msedge.exe

pid	process
2996	msedge.exe
2996	msedge.exe
3452	msedge.exe
3452	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe
3452	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3452 wrote to memory of 1048	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 1048	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 4940	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 2996	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 2996	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 2728	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 2728	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 2728	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 2728	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 2728	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 2728	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 2728	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 2728	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 2728	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 2728	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 2728	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 2728	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 2728	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 2728	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 2728	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 2728	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 2728	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 2728	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 2728	3452	msedge.exe	msedge.exe
PID 3452 wrote to memory of 2728	3452	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68d92365dcf653c048984c5aec5200e0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa37e46f8,0x7ffaa37e4708,0x7ffaa37e4718
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,5214736370152579202,17739806507531976739,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,5214736370152579202,17739806507531976739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,5214736370152579202,17739806507531976739,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5214736370152579202,17739806507531976739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5214736370152579202,17739806507531976739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,5214736370152579202,17739806507531976739,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3016 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
86f2b48b016c547f1a81158a800d0392

SHA1
c46c470791c8ca2413fccad5467d2a79c2c55f24

SHA256
6536bc0b15dd28743f8aa2ccde7457d495cf9601668ee07d254f476af639052e

SHA512
7e8080e8c5cf27ed84b62f827c7093b4baaae4aa0de03e99116d10b063558b8e50f3808e2d991d02de8cb36970ed4e2bf0b270c6b39d679a4914ac5e9446aff7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5aca09d3d9cbe7f0d79e0cdd51be8ff8

SHA1
d155b0c3f2af6e5dcefb47d281dd8b15234725f1

SHA256
8c1e2b846ed916fcc68263bfe5002fedb91a7bca4efb7afe39f9cf8a86b285f8

SHA512
ca97081d0611d1603befbd587dd125ec6568df407451b6fbfb8dbb4bfb4ff1f21b485ff75f58c9ca6c8c876c7f75efa65d36b5aa5b56c4eb634d833d3b278cbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8141659dcd7df80fe4e52aef42e643ca

SHA1
0c81350f8933704890f11649a337f4022d714947

SHA256
7c51469c94aba35e2333d87a772cb79db107184f53834dcac61fde180d82784f

SHA512
2f172d137a08a26a79f1c8d6af88604c727bb580feb52508aa60e5f3fb297d03abc4091b28db57ea518d4e5c5d33dd7a8ee38e0f63ed08a8de3c56963efccc62

Download Submit
\??\pipe\LOCAL\crashpad_3452_VDFVVXEKNQLMWPGQ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads