10367465064bdedb8d0850210ea17ac769c201aa369fdb57c50d450b73bd5c13

General

Target

65a16c813b696f771177a7c4c5a9577c_JaffaCakes118.html
Size

19KB
MD5

65a16c813b696f771177a7c4c5a9577c
SHA1

973b132c65c23ee3e2ca216e195c2b06bc5fb26d
SHA256

10367465064bdedb8d0850210ea17ac769c201aa369fdb57c50d450b73bd5c13
SHA512

9da21f9b9600053bf09c3300281a3b3d9a2f2a56f60ae2278dc2b65e02401f4bf86d85e4317fb98d663912508f2114197d2304e90ddeaa32e3685aa80a7ab9cf
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIe4wzUnjBhMW82qDB8:SIMd0I5nO9H/svMVxDB8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

2068 msedge.exe
2068 msedge.exe
432 msedge.exe
432 msedge.exe
4484 msedge.exe
4484 msedge.exe
4484 msedge.exe
4484 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

432 msedge.exe
432 msedge.exe

pid	process
2068	msedge.exe
2068	msedge.exe
432	msedge.exe
432	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 432 wrote to memory of 1692	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 1692	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 4020	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 2068	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 2068	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 3480	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 3480	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 3480	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 3480	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 3480	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 3480	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 3480	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 3480	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 3480	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 3480	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 3480	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 3480	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 3480	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 3480	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 3480	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 3480	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 3480	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 3480	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 3480	432	msedge.exe	msedge.exe
PID 432 wrote to memory of 3480	432	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65a16c813b696f771177a7c4c5a9577c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3b1046f8,0x7ffa3b104708,0x7ffa3b104718
2⤵
PID:1692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,6926639917606720854,9333260053294297752,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
2⤵
PID:4020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,6926639917606720854,9333260053294297752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,6926639917606720854,9333260053294297752,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
2⤵
PID:3480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,6926639917606720854,9333260053294297752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
2⤵
PID:1996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,6926639917606720854,9333260053294297752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
2⤵
PID:1784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,6926639917606720854,9333260053294297752,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3104 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
856ff4d14a39026cfe1a64c5b5d979be

SHA1
cb3493491862f6a724320859c70311eaf1b2ea53

SHA256
9246af87d1d691998083bd2410e18696c276e711684f8c6225a810850213435a

SHA512
43b932ee1434295727b71609a611641f2a5484c9170993f7861a151f988ed8a72d40053aae472f7f4c06df0eda8d7ac93aeeaf0364d796787e4776ccbdb6153e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e7f8a45f3bd2838f5cc1efcb722165a8

SHA1
029463362461720c065d5ace0a3687f75bc0231a

SHA256
133ef3c124a2cedbc6fd6d385050010c0eb583fbc8c13b2f396b87ce4ce4b59c

SHA512
f9782a1579731af8278ad900e8757c14807e5a75eec764cb118e2dd4c8d441ef6e76e63dd062c8ef263e75673602abd12d2b72f56c6a73eb487a0224856173cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
efb261555b97fda97025110f904a5bf6

SHA1
e36a4a36b6bdf0d7aac38cd0e78f31d712676d06

SHA256
50fe087cc546d1803da272eb5fc18d8ac4fbfd3f7f4a6f3ee397c13acbf40025

SHA512
004bc206cafd65aad38a3216ca94126d2d977f57cca417d51657fe3431ff3cc0152a16c24e98d4d8ae00ad9f61f3868e03083b1bab6d840748339c95a66a87a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4ebd2b067c870e28e00da12653491559

SHA1
5cadbcda94bce9500a2e273e3a0ea23bd615d698

SHA256
501857a5d13ca3dc22b1d49da94adb56b6a219dc04609bcb2c2d28439e05d114

SHA512
13d5256d7b99676fd91337987deda3f82fd5433efaeed31e1eb9f0fb174e9f46c3919ae7c307868b0862f213415762db8b2554aff7d9f6cbf2e02ad7fc5e83cd

Download Submit
\??\pipe\LOCAL\crashpad_432_XHXOJNQVSGERKBTK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads