39223896bd14f2c19c7132facffa5f2915240901613d3a218f8350eea4844e4b

General

Target

69104e6476fa288faafd3dcde97a0c3e_JaffaCakes118.html
Size

136KB
MD5

69104e6476fa288faafd3dcde97a0c3e
SHA1

bdfb7d6aff9ad32fef637fec7e1e84c069a834cc
SHA256

39223896bd14f2c19c7132facffa5f2915240901613d3a218f8350eea4844e4b
SHA512

15e40fc72c6d5a835f5db2891e2412f5fe35ccbc0a039a2d85c206efb2a14f11e4fc996ecd34603e8128428da86bc39d14b2a0049181a352e1db714037e3f5e0
SSDEEP

3072:rfrDNDSyIX/jBCe55TiNFJm9cWpJ7C+j0N8ssC1qqK6rwinQ03F3ts4crIR1FmcU:RDSyIX/zZ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

64 msedge.exe
64 msedge.exe
1968 msedge.exe
1968 msedge.exe
1968 msedge.exe
4020 msedge.exe
4020 msedge.exe
4020 msedge.exe
4020 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

1968 msedge.exe
1968 msedge.exe

pid	process
64	msedge.exe
64	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1968 wrote to memory of 4600	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4600	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4540	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 64	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 64	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4840	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4840	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4840	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4840	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4840	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4840	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4840	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4840	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4840	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4840	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4840	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4840	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4840	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4840	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4840	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4840	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4840	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4840	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4840	1968	msedge.exe	msedge.exe
PID 1968 wrote to memory of 4840	1968	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\69104e6476fa288faafd3dcde97a0c3e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99d5346f8,0x7ff99d534708,0x7ff99d534718
2⤵
PID:4600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,14270773749907946245,13743406888499760971,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
2⤵
PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,14270773749907946245,13743406888499760971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:64

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,14270773749907946245,13743406888499760971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
2⤵
PID:4840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14270773749907946245,13743406888499760971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
2⤵
PID:2700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14270773749907946245,13743406888499760971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
2⤵
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,14270773749907946245,13743406888499760971,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4792 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
668B

MD5
44fef2f8928b8d7c013b8873f5630409

SHA1
bae7001efec65a33278c0f80c62f259892e59be5

SHA256
f43e9d47a2e96b96e5214736b57e0bbd59c0db3d18874903bfd6167a0e3b5683

SHA512
2dc8d5a567b5cfaac1339eb52098fd4836b304462d158fe0789877b7a600213096590031b587abade9cec24e8c2da32f4058234a9206145431fae68b66869e81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ad20bc68379336f593d0b5a8d3725d51

SHA1
9caba863d74ce35d9a489f20015a5a4f59e38d11

SHA256
46b5faf1abaef5490826773fd5c78420799b02b7d935324afe4ce46fed7ea1fe

SHA512
67cd56dd8d599cf6512f7fbbc9280c6675af32d133e239be9a5539d1f0034fe5d57b923e4e26c300a6995fa3e866f5edc3c69d85704c5172b7fa6094b237228d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
17f36a1c185aa0283aeb2d79a1ac4bcf

SHA1
697857a1ef2188110b1ab71b826055a9b7546a39

SHA256
89ca1bfbc0a70186576880475111a6d044a48506c168f8cb92a30d0642ebcfe5

SHA512
ba232290b9410239b51ff3f8e2be98f71634ad5d13c9b8b53974fb627784543e140732a7942f9dae406a200d471b7f17d41cb4b91318ad15c55378de65f99e21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4835735d24bb977c6e193f0917224ac1

SHA1
05b467ae37cf6244f8f5cf5347b691ed4e04d68a

SHA256
63be12f79cb39c13661f3636b7a652b0502b714ee3ff335a3af5af6d04dcbba7

SHA512
a1e055033b4bd7e2ff598276485a7063322faeaf8324769bcdd43d3e1a505abaa9e7208986c8d4e292157afbaa51e4fac81371ee48c3a3e1a5146daa2b43afa3

Download Submit
\??\pipe\LOCAL\crashpad_1968_VXIGLHYMUFXFFXBX

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads