8bf5debfed474ddb97c26013f0017847e720687f0582462a4ccc953adc9b5781

General

Target

68fc0fa04a92ca0d8eb66347b0b33893_JaffaCakes118.html
Size

18KB
MD5

68fc0fa04a92ca0d8eb66347b0b33893
SHA1

86efe05c9e76916b6341ae8b7a34f2337ad6e5f6
SHA256

8bf5debfed474ddb97c26013f0017847e720687f0582462a4ccc953adc9b5781
SHA512

ae35920e4979c7e83cf4aa99df0768876256eac445db42016a5fe61655e449584353e6472f3e64ee62c07e2eca38bc15a092ec3143278d707541f9c16d49f91b
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIj4HzUnjBhl/82qDB8:SIMd0I5nvHRsvlExDB8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

3552 msedge.exe
3552 msedge.exe
4392 msedge.exe
4392 msedge.exe
772 msedge.exe
772 msedge.exe
772 msedge.exe
772 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

4392 msedge.exe
4392 msedge.exe

pid	process
3552	msedge.exe
3552	msedge.exe
4392	msedge.exe
4392	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe
4392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4392 wrote to memory of 4724	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 4724	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 2408	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 3552	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 3552	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 900	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 900	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 900	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 900	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 900	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 900	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 900	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 900	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 900	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 900	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 900	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 900	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 900	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 900	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 900	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 900	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 900	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 900	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 900	4392	msedge.exe	msedge.exe
PID 4392 wrote to memory of 900	4392	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68fc0fa04a92ca0d8eb66347b0b33893_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f40f46f8,0x7ff8f40f4708,0x7ff8f40f4718
2⤵
PID:4724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,748656377727672571,11487129939671583624,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1980 /prefetch:2
2⤵
PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,748656377727672571,11487129939671583624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2544 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,748656377727672571,11487129939671583624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
2⤵
PID:900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,748656377727672571,11487129939671583624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
2⤵
PID:3324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,748656377727672571,11487129939671583624,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
2⤵
PID:2132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,748656377727672571,11487129939671583624,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2008

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
7c25dbdf3aefaf99de7624d8c5774f2e

SHA1
891d7863fb5d443241fe5c12342fa955c9bdb28d

SHA256
05fc7f44b03b67fb68546546e287f34b5ea6d499bbc538891ec460641a88ccb1

SHA512
1b9719caea11ef933a3d7fef483261a9e27b5fd8b2e0bcc7d461a63f24d4284bd72a3d410802b5faf25d5e47e9e8408051f519bfc864693d6c12493ea12fdf3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
55b4abb61c68c6694aba4ce16676003f

SHA1
c9c05fc6fbe996d77821298be396c6692c5dd807

SHA256
f1972005795de644ad83b2c1fb189f7f9bc8babe5447623f25c6cea57c3e0b4d

SHA512
604ef15b433434c4ea082ab144abaf9b8f2fd2d768db2d4f0c56efb167eac980b0d3fbf5d60f59c26a8224fba81a2cc2242cd4cc7ced7f61e34de1ac009c8dc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
c8e07f1966322b089e6aeaf24c2228a5

SHA1
45f5abf5ee7e55437b71e25de1b81cf64cee2e64

SHA256
8210f96b7501b0d0f4ace4b6e22a7488c23cbfd41913f4b71cc277a5fb2d5b00

SHA512
18b1a47fcea7781b6d0085c982de53f66e8e9540c0f0f27224d16602894913d2079615d48c0e64a14d268dedc5f731ffaef2c2e7b04519a7cc5cbe411b7b958d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
47a1141d37868503704d0a0a85252012

SHA1
2a4d5c71e6a77357eb2cece022951ce2066a9b5b

SHA256
a21fceaaea87814a50b4cf6bb72232067724af3318737351982349c8dadf1d8f

SHA512
7974a06e2c9bd18ddfb9c40ea6d712cd7f99f48e1416b88f3d2a84150a557ff5dad2228d3bc478f0b9f7572388deb7e8714e4b25eb5dd8cb22e40c5bacd1447d

Download Submit
\??\pipe\LOCAL\crashpad_4392_JAQXSASKGGRZFRUW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads