7ed1e42a85f2f3c4d7533d9506d24d823a4ad3fdd68f3d8bce5711ddd3759963

General

Target

6577a160463cb13bbd5aa77a0416df97_JaffaCakes118.html
Size

55KB
MD5

6577a160463cb13bbd5aa77a0416df97
SHA1

40b793e101653e0389605c13da4e248caf723d0a
SHA256

7ed1e42a85f2f3c4d7533d9506d24d823a4ad3fdd68f3d8bce5711ddd3759963
SHA512

1ddc36145ce4f90875d34574f954019ca746bc119bb9b5edf6ff44f88fe00868e93a547fe7c696a12f3497eb2b28500eb64810147658eb6fe619f90a7a9a0292
SSDEEP

768:KwNYQNxtqgsZ0AQflIPLz4oQcvVABMlfivi:KwN9tq/Z0BflE4WVABMlp

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

452 msedge.exe
452 msedge.exe
1612 msedge.exe
1612 msedge.exe
2836 msedge.exe
2836 msedge.exe
2836 msedge.exe
2836 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

1612 msedge.exe
1612 msedge.exe

pid	process
452	msedge.exe
452	msedge.exe
1612	msedge.exe
1612	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe
2836	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1612 wrote to memory of 748	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 748	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 1584	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 452	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 452	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 4324	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 4324	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 4324	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 4324	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 4324	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 4324	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 4324	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 4324	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 4324	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 4324	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 4324	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 4324	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 4324	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 4324	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 4324	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 4324	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 4324	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 4324	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 4324	1612	msedge.exe	msedge.exe
PID 1612 wrote to memory of 4324	1612	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6577a160463cb13bbd5aa77a0416df97_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf58f46f8,0x7ffdf58f4708,0x7ffdf58f4718
2⤵
PID:748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7851746526447348996,5029283592361447718,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
2⤵
PID:1584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,7851746526447348996,5029283592361447718,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,7851746526447348996,5029283592361447718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
2⤵
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7851746526447348996,5029283592361447718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
2⤵
PID:3396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7851746526447348996,5029283592361447718,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
2⤵
PID:3640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7851746526447348996,5029283592361447718,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
19d28dfd3ab73e8acee0609c8594d5f0

SHA1
5f36a1558b219b393e4dcb2cd3721db70d6b67c7

SHA256
db4b191fc891b9035262567cd7b849afca3d2eaed4815bde94baadb750289f04

SHA512
11fd60f05421917acc58522619074c770d3d53cb694b29123cb9343947c2b8dc258f489c027ff767b5f58a0bb8a265572d6ecc39e3d4119cb1f42b4d1e647644

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2f33c0c65449f0a015457abd7c53e6e2

SHA1
2b66d9a3e75ea2b7ac783c4bc3b65a19f1790aff

SHA256
e14d82019b4b93154ff50979b616135ca620a30166a345843d8302edb8468648

SHA512
1ac05726227d1bc308a488e05a4d57f50c644a5ef06be1e0acc54700d407a3cb0158ecef659242df845264cbef2217ae39371aba684ccbadf9c6b7cdb86e56b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
397af24e02bc837370f8629c0a764fc7

SHA1
29b34c1990cf9d54613c58f1b4e3991069dd3048

SHA256
17876d55adb2f3a0ed31d4d964e5183d7d6bbd3beb98d9d868e668d238aef007

SHA512
59127c83ab1d6ea2d922149fa5e711a51a7c91b3a42ca4271ee27085f6ab652eaec5a0449f282d17d2a2fcc808c3a522b92f729cd1c13bff1ce2cfc1c48fe40b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1ad5f8c5828b9a3b8cb5aa6bcef39588

SHA1
4434ca560d8b75120f6cdd9c8d1b2fdae38cda9a

SHA256
028766ed20198593e54c76fe151aa6e3c676d998ee9cc1be1e7bf65954775ac9

SHA512
39cacc801ef32483a562f35768363f39b26418b78caf4d10c51f65b3a08841f91d2ad3f9fda5520531e5cfa786a87a2fc6cc60bdd23ab7b15c22aad239da414e

Download Submit
\??\pipe\LOCAL\crashpad_1612_ZCVLSAGOTJJUGLAY

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads