464473aacb24d4098d4911b1219da702f0f216b1656a92d9d5c1c15c83dae3e0

General

Target

65b51ab2612127dd154c7fc46fec5cac_JaffaCakes118.html
Size

234KB
MD5

65b51ab2612127dd154c7fc46fec5cac
SHA1

c06c7259e50a4b53eccf71e8e8a2e46cac4205b5
SHA256

464473aacb24d4098d4911b1219da702f0f216b1656a92d9d5c1c15c83dae3e0
SHA512

6eb7f7468d90b08abfea259064789500434825a6341930441d8432b672f75393a73cc96a306b608f6989e0cdbbe53278ac9bd57dbe28c708229757f3573a315a
SSDEEP

3072:S9yfkMY+BES09JXAnyrZalI+YYzByfkMY+BES09JXAnyrZalI+YQ:SIsMYod+X3oI+YYwsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

4516 msedge.exe
4516 msedge.exe
2824 msedge.exe
2824 msedge.exe
904 msedge.exe
904 msedge.exe
904 msedge.exe
904 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

2824 msedge.exe
2824 msedge.exe

pid	process
4516	msedge.exe
4516	msedge.exe
2824	msedge.exe
2824	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe
904	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2824 wrote to memory of 3380	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 3380	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 5108	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4516	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4516	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4636	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4636	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4636	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4636	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4636	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4636	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4636	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4636	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4636	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4636	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4636	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4636	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4636	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4636	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4636	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4636	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4636	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4636	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4636	2824	msedge.exe	msedge.exe
PID 2824 wrote to memory of 4636	2824	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65b51ab2612127dd154c7fc46fec5cac_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc002046f8,0x7ffc00204708,0x7ffc00204718
2⤵
PID:3380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,4552152494486522515,12914252080569181837,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
2⤵
PID:5108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,4552152494486522515,12914252080569181837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,4552152494486522515,12914252080569181837,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
2⤵
PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4552152494486522515,12914252080569181837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
2⤵
PID:2068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4552152494486522515,12914252080569181837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
2⤵
PID:2316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,4552152494486522515,12914252080569181837,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3172 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
407ae8f165b77c541c865e6daa5f3907

SHA1
e292137c834d8b86580d1f6378cf50f70289251a

SHA256
e4fb431b55a4ef84f01e144bbbcec7a52cd951b12926b1a6056fe7d8a8db4155

SHA512
97a1088d499b63a79a06707a492e62110bdb0499dc3696722e2385125fed5e912f05c45792eef693a434f3f23c88aaf2eb801ef4876b009e1c860bfa8f7521ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
27ef2d1716a10e6a1fba11267dfdfe85

SHA1
d13127a41723a98e67b39af70901cd7b7d0dca32

SHA256
a227e56701400f8411e831df292ea8362ad792dcfab23ea172f46f1fce001035

SHA512
2471f3f4654cd2e31090d777cccd344f9ac655bed9e2d02c756ae12de1efd6897ed83ff03905aeac277e297aa9905279aef33ac4e7cd32175b7ad2fa24aaa2e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e91e38e559c7cc6f23e926ae3a07e829

SHA1
510530130436550139e5eccf1ec7b972badb9b05

SHA256
6e7b5f1ab749466c9b5999d154763da215a6a764e61579d41dd30c3eb6cd5f53

SHA512
30b2208d2adcd3505da2a752947df790e518e7ccd226677f03b81ad47480586c84f9194460d5687106748fbf572bd8aa86c8bf09743df35ecb44e52efa5d61f1

Download Submit
\??\pipe\LOCAL\crashpad_2824_ULQURRPCEJFIXGSV

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads