7c393565fbb3cb580b30d95fba7435b032d5c3c2e7f9ad1aec2b3e80acf00cd5

General

Target

65962412b109b41948ba61834d985391_JaffaCakes118.html
Size

140KB
MD5

65962412b109b41948ba61834d985391
SHA1

7d7f99675d8107ac0cfc2f094d09932ef0e45731
SHA256

7c393565fbb3cb580b30d95fba7435b032d5c3c2e7f9ad1aec2b3e80acf00cd5
SHA512

82fe3644020267d67a87ee29dc415d796c61ea6fa8d7454a1eb1954402e0bdeb1c6f4fc1f0e9752d5f4b35c014012dce23e5e22dfcbe7ec4668ddc9868f696e4
SSDEEP

1536:ScVtoDbYClJPuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:ScVZTyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

4644 msedge.exe
4644 msedge.exe
1448 msedge.exe
1448 msedge.exe
3240 msedge.exe
3240 msedge.exe
3240 msedge.exe
3240 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

1448 msedge.exe
1448 msedge.exe

pid	process
4644	msedge.exe
4644	msedge.exe
1448	msedge.exe
1448	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1448 wrote to memory of 1496	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 1496	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 3212	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 4644	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 4644	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 1132	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 1132	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 1132	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 1132	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 1132	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 1132	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 1132	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 1132	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 1132	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 1132	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 1132	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 1132	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 1132	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 1132	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 1132	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 1132	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 1132	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 1132	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 1132	1448	msedge.exe	msedge.exe
PID 1448 wrote to memory of 1132	1448	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65962412b109b41948ba61834d985391_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9e7046f8,0x7ffa9e704708,0x7ffa9e704718
2⤵
PID:1496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,7163774894535048859,10176428149102904228,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
2⤵
PID:3212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,7163774894535048859,10176428149102904228,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,7163774894535048859,10176428149102904228,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
2⤵
PID:1132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7163774894535048859,10176428149102904228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
2⤵
PID:1020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,7163774894535048859,10176428149102904228,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
2⤵
PID:3288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,7163774894535048859,10176428149102904228,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2760

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
123277880b786ceffc34f5ccc62da9b5

SHA1
2eb7ab8e9f5359454379b45afce7624dab42f424

SHA256
44efc5c518b21409a961876e397c5d942421e6679d56869e04f4c32c66fa2cd0

SHA512
0457ae33ef1c20e659d667961e45b8d069f3799a83871de7c148023bf83e807d4a77f41d0c7c6d7c5d3b35c573c0e801113b53bae8c6db2bfb027a9b40a95e97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
88ac95e775c811ce46a2d2ae3616abcb

SHA1
43255b2119ba3d21a7030c31931e7945ce158fe6

SHA256
3d8ff74b52827876879906250d525393c5988df998e6a8f31d3a61dd7ebe71aa

SHA512
1c38994551c716e336be0113f995637c6b4f6683f0758d4349669f171f49c0970971a6f8231b61c1948c114784f08ad0fe87860cb19d1a322392a59570db53f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
a77f1d469348ebe57974a9a12ad8d3bf

SHA1
3dd62f28a8fcd32987e94bea847bcf13a695cd78

SHA256
96e018c8600b871eabe2151086de30134fd9ce0c6489d9699df758970b2c4eeb

SHA512
d3e698f5e474358c9f8e319aa715ec789922bd311b775fceb4beafdc530f1bf1418c3f674e5d9846354dcca7b5ae74765adfa291f2d9f348744ef4888d14b583

Download Submit
\??\pipe\LOCAL\crashpad_1448_TUJJPFDIPHEWWTZI
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads