491139a6d2106ee02da5f87042edaa58643b985f3f870b770fbead0c62361e6a

General

Target

69119224b148c276d949bab2d051ea0d_JaffaCakes118.html
Size

19KB
MD5

69119224b148c276d949bab2d051ea0d
SHA1

e6d0041b7ad97b9708d76c31c09c01ab978bbd98
SHA256

491139a6d2106ee02da5f87042edaa58643b985f3f870b770fbead0c62361e6a
SHA512

20b77b005212e4817aecb5434db0d036a68c3b1958db52bf39f262ef8bbc0f28f7baced6e03bf9288ebc322830fae6c0409ba17b13b7a507f17ec33270fb4d88
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIS4izUnjBhC082qDB8:SIMd0I5nvHtsvC3xDB8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

1376 msedge.exe
1376 msedge.exe
4696 msedge.exe
4696 msedge.exe
2756 msedge.exe
2756 msedge.exe
2756 msedge.exe
2756 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

4696 msedge.exe
4696 msedge.exe

pid	process
1376	msedge.exe
1376	msedge.exe
4696	msedge.exe
4696	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe
2756	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4696 wrote to memory of 2596	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 2596	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1108	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1376	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 1376	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 2352	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 2352	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 2352	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 2352	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 2352	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 2352	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 2352	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 2352	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 2352	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 2352	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 2352	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 2352	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 2352	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 2352	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 2352	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 2352	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 2352	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 2352	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 2352	4696	msedge.exe	msedge.exe
PID 4696 wrote to memory of 2352	4696	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\69119224b148c276d949bab2d051ea0d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6b7d46f8,0x7ffd6b7d4708,0x7ffd6b7d4718
2⤵
PID:2596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,5154365729698761952,4802235452051429147,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
2⤵
PID:1108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,5154365729698761952,4802235452051429147,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1992,5154365729698761952,4802235452051429147,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
2⤵
PID:2352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,5154365729698761952,4802235452051429147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
2⤵
PID:4716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1992,5154365729698761952,4802235452051429147,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
2⤵
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1992,5154365729698761952,4802235452051429147,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4784 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3216

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
ee0789bc3858b966a8639bc416d23659

SHA1
a83875bea37369cc2cb70207589393088ba5d8a9

SHA256
751cf4c17a8f02c8aa086a3ba7b766d8bf238b7b35a70156e12bb2565595fffb

SHA512
7d42fd0aac76b727f5ac0b446a6beb84af80b5773fe432b07a47a6cbac052b3b790ff4672dad1617010040b1a47e43977679ebec4c66e80547c35983ce0f94ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
ba126b500ddf1336d485bbeb7cc83abf

SHA1
f316f2033328d0bfdf021ec985550ad70af7983b

SHA256
48216d1a0a3dc3063766312b7c7569e3bb6ed977b820dc9c40181131d02f09e3

SHA512
6cc5bce3d3b1ab1e141463ebe37b21d18e7c0894bf4cd7e1d4932ecddb89de026a800569a80178df48fd5480d7a93cc849669c584f8fb08c19c672febdbb9fc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
ad2e9734f0b2bffafe79cc6d30138f9b

SHA1
3b6a48d0b9b933e02ec87bb9e61c735f727e9dcf

SHA256
9da45c01788e2c71b3719441580c8b744063e3e5460137cdded1df0eaee3651c

SHA512
33778f43675130eebeed7344b9f0d21a478a2c9473cb8819d71dddab4cb57be6837ae1e48b09ca278eaeb38ef7e70307eba1e2ff92dcbcaa0f2774c99a2e8d03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
344699e67f1e0cb67f589fbdf8b65a6f

SHA1
282123681130c184aed3d87083fcd92dbbdef8f4

SHA256
6ae16ab8dfd9b5eda81fab2f6aed5e5a1ac69515865ec191f14cee98c197fbe9

SHA512
ff5fd544d7df17fb5538affc83912cd35ade41b5c3f6533d2224421336eee1d7b2ad4ff053185875124c7124787fb771b7a7766c4c6116568edd59b00d26c92e

Download Submit
\??\pipe\LOCAL\crashpad_4696_BHSCTWTCWVJHEQWN
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads