5d08c410fab1de5d6bab76b27b75287184b7b752c02b882609cf3d0e2490dbc4

General

Target

65bb4f5cf606f8ca4727786dd30da166_JaffaCakes118.html
Size

166KB
MD5

65bb4f5cf606f8ca4727786dd30da166
SHA1

9e56c26f7ff5b4c6411466598c3b95938f302580
SHA256

5d08c410fab1de5d6bab76b27b75287184b7b752c02b882609cf3d0e2490dbc4
SHA512

2261f1ffc54531f934a2562f80fcb1c605f377c176dc7b13e651a491a1f810d0baeeff58de11d155ce7455d3a98d8fc8f3e0a6353c6a1eac270604b4e2f12777
SSDEEP

3072:SENR7zncS8+nGBIyfkMY+BES09JXAnyrZalI+YQ:SENhn78+nGfsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

3572 msedge.exe
3572 msedge.exe
1808 msedge.exe
1808 msedge.exe
3620 msedge.exe
3620 msedge.exe
3620 msedge.exe
3620 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

1808 msedge.exe
1808 msedge.exe

pid	process
3572	msedge.exe
3572	msedge.exe
1808	msedge.exe
1808	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe
1808	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1808 wrote to memory of 2792	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 2792	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4836	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 3572	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 3572	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4224	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4224	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4224	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4224	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4224	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4224	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4224	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4224	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4224	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4224	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4224	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4224	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4224	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4224	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4224	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4224	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4224	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4224	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4224	1808	msedge.exe	msedge.exe
PID 1808 wrote to memory of 4224	1808	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65bb4f5cf606f8ca4727786dd30da166_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa087846f8,0x7ffa08784708,0x7ffa08784718
2⤵
PID:2792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,13352543219153196438,11007387762847878097,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
2⤵
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,13352543219153196438,11007387762847878097,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,13352543219153196438,11007387762847878097,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
2⤵
PID:4224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13352543219153196438,11007387762847878097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
2⤵
PID:3468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,13352543219153196438,11007387762847878097,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
2⤵
PID:2840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,13352543219153196438,11007387762847878097,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2716 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1796

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
c9b2778a9fdf9fe9f1e7b32967b3a42a

SHA1
402995a71a7b75e4c2c201291de6b65db59a791c

SHA256
08ef8011e58cbc356fb71cd6e0c74678c6a8ef87c1d657f146f68adb72c9f1cd

SHA512
0babf1f4a9ac97ff57c5c7872235184bef500ef4cab2d030751a5a9139fe3ff3ac306d4c8071b33cbcddd22406329ec521c26ba98535dee3a009805f414aa47f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
24893bf8d527a835150ae066e97f5dfe

SHA1
4c809cccab69a3c3ec1918ad2cdccd36dffb4557

SHA256
d884b7e876312fa219b09382bd76731971187dbc8aec99ebc0eb43aeb139c00c

SHA512
7f971fed7c7c2ebd18d6fce025f822b10b335a7b7d50957f1046050bbd752df9cd8ffdede540420756061924985641814a2982f44db21d7dec6ef371a4399b7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
201764451abeefa0195c148b05dc36f3

SHA1
71188a7b366db84f7e9641e800065637aecb9d08

SHA256
bca6874e4efe31c1c3dfb90ef98523f01836886e7d73dc57b847679bce003e46

SHA512
fbf235293a599c8da3800871a98dcba3d53af5c9687a2560084c47e861e358d77d6ed45a4426376d0fca8645ae5a997e6803c3f0af30f076b796f3f0ff340e4b

Download Submit
\??\pipe\LOCAL\crashpad_1808_RWNKQYDPGPZNRPTB
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads