729e41b4302b51462a8b49992358716aae0b780c9606ef1d852855a13216b9e3

General

Target

65b95fdfb1edf06563d13632a9964a54_JaffaCakes118.html
Size

214KB
MD5

65b95fdfb1edf06563d13632a9964a54
SHA1

0487b8a86ab1e233f4bf2d9184fecddbda9156a2
SHA256

729e41b4302b51462a8b49992358716aae0b780c9606ef1d852855a13216b9e3
SHA512

ab2ef46e15be6f20cce1a8dcf40f3adfd63ff7479603960110c5aa794aa7197cdec59b7bef060f172fb6213fbf407af45bf4770fcd0bf9f4397d9d062a545caf
SSDEEP

3072:4rhB9CyHxX7Be7iAvtLPbAwuBNKifXTJj:gz9VxLY7iAVLTBQJlj

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

1836 msedge.exe
1836 msedge.exe
2700 msedge.exe
2700 msedge.exe
1588 msedge.exe
1588 msedge.exe
1588 msedge.exe
1588 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

2700 msedge.exe
2700 msedge.exe

pid	process
1836	msedge.exe
1836	msedge.exe
2700	msedge.exe
2700	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe
2700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2700 wrote to memory of 452	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 452	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 3620	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 1836	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 1836	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 4548	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 4548	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 4548	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 4548	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 4548	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 4548	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 4548	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 4548	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 4548	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 4548	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 4548	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 4548	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 4548	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 4548	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 4548	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 4548	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 4548	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 4548	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 4548	2700	msedge.exe	msedge.exe
PID 2700 wrote to memory of 4548	2700	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65b95fdfb1edf06563d13632a9964a54_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc468746f8,0x7ffc46874708,0x7ffc46874718
2⤵
PID:452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,15641136296738217076,11995303213202853915,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
2⤵
PID:3620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,15641136296738217076,11995303213202853915,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,15641136296738217076,11995303213202853915,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2196 /prefetch:8
2⤵
PID:4548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15641136296738217076,11995303213202853915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
2⤵
PID:3352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,15641136296738217076,11995303213202853915,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
2⤵
PID:3388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,15641136296738217076,11995303213202853915,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4892 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2596

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
1b312e8ab3d3f2703a15ef19fa7bd7b0

SHA1
af7a51cda36840b45030e23992d94b195df99f98

SHA256
fd3d13f5a97f98290273a2f6a2861ac7208f8143141109f1a4ba31aa3434a840

SHA512
dedf0dd15bd73bd8bd145c00e21e99e521560493236d539c8ce36201456ea2c609c5c383774f78e83128159c999de16f92d887d1d41120fae226ed67012d7008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
a2b897870485ef14c8dc55e8db41434d

SHA1
c5734820534c6adcabbd62e01b1b4eb4740c592b

SHA256
8b151071e546b95fd9b212c55f6a8d35d0e5dc1b3d55fb0645408e0d46010dde

SHA512
6be600339bc3ebbbbc66f56132259188a7b3acd16a919e082dd15d4af1f907e2e11a10856caf0adf4576e8c4d92bc4095490a66c170ff2b632084345cc121b56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
b10e464fc9c5fe5befd64f6f0f4be61b

SHA1
ae30317c443f9a98e021e4824f9362a7b4e295ca

SHA256
fe58dc2bc1ee02fc7d0f2770f07b81ee95faf1c6702082fd3adf2758eaf34d48

SHA512
b21e85d279072384a7b61c2b75c0d99a186ac1f9a9f56574b4dbb9ca3395e25a805019677de5ef167fb76340d89a1857b1ee013e242256befa35d1a9e88e1742

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
46404fe6d411131d16520d7b788f2ae3

SHA1
bf288b1c13a4797618fb9fc6705a5f1701129ce5

SHA256
16d2d95d7146944dfc5410703b5f6326204cc4669dda5ae9eb68b4ffdd6649fd

SHA512
7e8fc8e8e9ccab4d30ac52ee93a8cf9f9f803a0df2812bfda8aa06edaa99d5acc576be9b2e3f621e020a477c48f85f078006dd99085b73d9eb86a93cb342db7c

Download Submit
\??\pipe\LOCAL\crashpad_2700_KARNGIQYRAMEFXRB
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads