d966a91457c9fedc95bbc46c1add37ec50039f24efbb19781b2e904d92cf5e10

General

Target

657c1eb8179e351b0354dd24026cb372_JaffaCakes118.html
Size

126KB
MD5

657c1eb8179e351b0354dd24026cb372
SHA1

ad7f032cd4af36801f375602fca0f51e4fdf76cb
SHA256

d966a91457c9fedc95bbc46c1add37ec50039f24efbb19781b2e904d92cf5e10
SHA512

9ebcb09b2708b8b4f8a5e765461fc73d624c231ff2472c6318b586c2459a06b103fb0e101304a0801cad2c6037d9d05148e87908c037cbe3cc33d54634452d6a
SSDEEP

1536:SWr+BoA/yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy+:SWr+BbyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

1120 msedge.exe
1120 msedge.exe
3708 msedge.exe
3708 msedge.exe
2580 msedge.exe
2580 msedge.exe
2580 msedge.exe
2580 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

3708 msedge.exe
3708 msedge.exe

pid	process
1120	msedge.exe
1120	msedge.exe
3708	msedge.exe
3708	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe
2580	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3708 wrote to memory of 3380	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 3380	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1616	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1120	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1120	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1124	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1124	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1124	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1124	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1124	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1124	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1124	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1124	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1124	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1124	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1124	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1124	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1124	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1124	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1124	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1124	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1124	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1124	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1124	3708	msedge.exe	msedge.exe
PID 3708 wrote to memory of 1124	3708	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\657c1eb8179e351b0354dd24026cb372_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa44c646f8,0x7ffa44c64708,0x7ffa44c64718
2⤵
PID:3380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2276,3160835976310332563,483614146205862819,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
2⤵
PID:1616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2276,3160835976310332563,483614146205862819,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2276,3160835976310332563,483614146205862819,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
2⤵
PID:1124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,3160835976310332563,483614146205862819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
2⤵
PID:3624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2276,3160835976310332563,483614146205862819,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
2⤵
PID:516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2276,3160835976310332563,483614146205862819,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1844 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4584

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7280ee0cab4811964f5ef5710cb392fb

SHA1
1ee61eff7c870b4d0c26a4bc36a80ac59ffd8934

SHA256
f604e98b26953540a2b3b9757d7b768e80cea3ed1b0939cb7e9fd5925157ecf9

SHA512
4a1c8ce1f4780f50726a6a929e7666155632a63fe4c0e7a3929c78abbe3d76016b6dc32655a43213be2c00e4c3b1b0dae5ff894faa217b03deebe3f274a940f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f143e6dbcdae2292642ad8681055e2ec

SHA1
1ad9e4a7b3158d781ad7be248307cd8d42e88596

SHA256
d8d7377d8970959f0f3c004675531861f0745073a2f49c029f19dc634a4aca57

SHA512
1e83931358492f956d544d33e015c7ecc50f2c2a7e99c679d9091186cde51685d387b1423da640a6778430631b0174a079e66e189c947f5289077ff3dc8ce8b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f441b83ca6fc9e22fe25ef41fc3db054

SHA1
0bf2d8272a74d9c448e391c7bc8a1e19e693147e

SHA256
49f97c20e286d65236ee27855092268db5de19aa5f24d6cf5711acaa5a0b2e75

SHA512
02b33863cc5966e83fe67ca7e67edd65ea0ad7e7a27d50478afc0951381941baff52dcc7b9ca0a5d3a06d83d435c92a3158d8fa93886cfcced459d32b9bac3b5

Download Submit
\??\pipe\LOCAL\crashpad_3708_GQVSIAQSHZEVQJBY

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads