2666af152f5d9cefd90e3cd7b376a2ababa442409eae144e6bfd2f33bef640e5

General

Target

65ddb6cb632839e01ef52debf25d6931_JaffaCakes118.html
Size

158KB
MD5

65ddb6cb632839e01ef52debf25d6931
SHA1

c1c76413a8440b264e109c57fb01459632109dbb
SHA256

2666af152f5d9cefd90e3cd7b376a2ababa442409eae144e6bfd2f33bef640e5
SHA512

8bdb0cc3d694133e4318448a29cab41a4cfe79734c26c318af52b22fe9a026f1fae858b0c6781475646fc41521c91d887e412c3ee0529da16f6efd57cf2d413c
SSDEEP

1536:Sxl9PNwzlE7TJyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:SxlrL7TJyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

4820 msedge.exe
4820 msedge.exe
3584 msedge.exe
3584 msedge.exe
1516 msedge.exe
1516 msedge.exe
1516 msedge.exe
1516 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

3584 msedge.exe
3584 msedge.exe

pid	process
4820	msedge.exe
4820	msedge.exe
3584	msedge.exe
3584	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe
1516	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3584 wrote to memory of 3952	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3952	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3556	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 4820	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 4820	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3480	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3480	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3480	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3480	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3480	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3480	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3480	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3480	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3480	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3480	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3480	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3480	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3480	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3480	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3480	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3480	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3480	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3480	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3480	3584	msedge.exe	msedge.exe
PID 3584 wrote to memory of 3480	3584	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65ddb6cb632839e01ef52debf25d6931_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3ad546f8,0x7ffa3ad54708,0x7ffa3ad54718
2⤵
PID:3952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2288,3670402656119020350,14419984913985033658,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
2⤵
PID:3556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2288,3670402656119020350,14419984913985033658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2288,3670402656119020350,14419984913985033658,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
2⤵
PID:3480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,3670402656119020350,14419984913985033658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
2⤵
PID:3144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2288,3670402656119020350,14419984913985033658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
2⤵
PID:3440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2288,3670402656119020350,14419984913985033658,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6136 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3aefb53a94743d748fac270a49861076

SHA1
77f2ae61909675d21d83f63078a16988b76a4838

SHA256
cdc3814d3f5b2bf90af578aa4b926d9e154c00096be9fe01353b742f83ba9e29

SHA512
8169f201f122b529cfe0814f7d426c6a282aa4dfe1a384b8cddcc8b9e5fbfa0cfe63f8017a5e7aed31c6b1622eaf10ad58d361a7c882d652ba2238966b1983c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1ada50048d66693274309145dc97d13b

SHA1
87b46038ba619f3d470f2feb9434fa94f8f6216e

SHA256
5771cab0dbf94f5b263a24ec984c7db001db2043a7b6eb3ba92a73f74e33940c

SHA512
882c79058669c59ec3bb41a571548a613d67bc254efea6bb5f2587c8b1af887b790e022e0992371a5c9a61bb42363168246f59fc68038be168a1b02e886a9249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2400434e06a4a394d0160043b5da7f45

SHA1
279716061e31b6245ae7e59f0442523e0b7d4f0f

SHA256
994deba63e9674aa89a75aae86ae4f89acc9f757053cccb28b94008ac65cab85

SHA512
c56f6db5337a4ce6d26dae35bb5c9cdf0da34991d1a62b6e2ae1b9912da2d4bdb0f0059774a0494b05f9205881449e182c06250e1d7caeb55a1b2e3b2e12d626

Download Submit
\??\pipe\LOCAL\crashpad_3584_AIUKNYQWXGGJRCBS

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads