fa793dc6f6b37e5231b5a34f01fcced0c177eeb032c26a145db3a950e8d1567d

General

Target

65e0960d1819ba02275f2d01e993e8f9_JaffaCakes118.html
Size

845KB
MD5

65e0960d1819ba02275f2d01e993e8f9
SHA1

4be3fec8f1ed337c5e43b130c34b1990c1df7227
SHA256

fa793dc6f6b37e5231b5a34f01fcced0c177eeb032c26a145db3a950e8d1567d
SHA512

911c79ab5c8d0e39aa09565a982ed6102840d8dc5cd9ad68b84d6769dce820a28de796d39d9c2adc73eae2bad9a22c8afb0ad5ee4276f4d15de60df5fd5682e1
SSDEEP

1536:DrfI5Jkg9gwDL0odtWaTxS1jO5g8Jfi3ZCxqHGJbfP9dqXeReyBeaeFe7efneKka:DrfI5Jkgi043ZYkf0XfLxmJ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

3472 msedge.exe
3472 msedge.exe
228 msedge.exe
228 msedge.exe
4724 msedge.exe
4724 msedge.exe
4724 msedge.exe
4724 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

228 msedge.exe
228 msedge.exe

pid	process
3472	msedge.exe
3472	msedge.exe
228	msedge.exe
228	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 228 wrote to memory of 4904	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4904	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 4912	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 3472	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 3472	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 1324	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 1324	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 1324	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 1324	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 1324	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 1324	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 1324	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 1324	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 1324	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 1324	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 1324	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 1324	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 1324	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 1324	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 1324	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 1324	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 1324	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 1324	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 1324	228	msedge.exe	msedge.exe
PID 228 wrote to memory of 1324	228	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65e0960d1819ba02275f2d01e993e8f9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff810c446f8,0x7ff810c44708,0x7ff810c44718
2⤵
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,13709768596499131526,4452715048557204360,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
2⤵
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,13709768596499131526,4452715048557204360,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,13709768596499131526,4452715048557204360,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
2⤵
PID:1324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13709768596499131526,4452715048557204360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
2⤵
PID:2436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,13709768596499131526,4452715048557204360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
2⤵
PID:3720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,13709768596499131526,4452715048557204360,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:648

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Filesize
23KB

MD5
3d70e46110d2f3fdb7e6eeceeb24529c

SHA1
55c2306f9b52e019d08fa64be58734f0da72c168

SHA256
e1b18d65bf8ec24d6abf8f461a87609d2a5b2783342cc2067d49c20da17ee248

SHA512
bdc8bd6417ac73502816b89932525da7c7a5b25bff1e03260abcd6f705f576e0061ecd4744850091c53ee46a30dfd359d0b28d395b40d209f15f0df2a10cb972

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
557B

MD5
8ceaa822ef515dc1a9ae030aba5b4772

SHA1
c411deef9582a2f4da35632643417ce297c6b514

SHA256
b4249a0905c991c55b27dee12da81f83390d27b962c0fcfbeface0b97bb26502

SHA512
28542117dc5e70dea183dbf557072ebbdee4e1e2c46e0591815ab9f23f1d8b60070017cf9aec44e08db15f69b551f26f71545b1c6a0eb7cd3a8039fc0e5fbda3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
e0b464ba8e7813b467b308498172092b

SHA1
74b277587cab87005b6cd93a98919fbd27e9a2f8

SHA256
ab2cd7109f146bbd88faa2d48b48ada07ab3f28de33340ec41bc21e83a0d869f

SHA512
686280016bfd1144e4a1c66a21bb35c2e937b538a23f53f3adc08bd94bd2e2e95a61bc152f2d4f49aba153b886cfd7d3ca81200eadc6973d9a90b599ae02d23d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
d88fe83f7688551e47f089016f536bc5

SHA1
28c22d0b7abae6fda61d1e32c4f3332bdf091324

SHA256
f953014f6b9bcdbd9b589e335747250f7090dbc604025712d555859df2aaa2ec

SHA512
4d88f0bde94a7da2ed1d3f723eee337974326658054e3e1b3755a94005485c8062fa9d2f78946c5ffe92df05915dd93764448b1e31ff52bb8d81a73cceadae2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
633f3d6f76805636874404a690d81981

SHA1
b8626bd1396acddda7b1be91a53c4f667d1c4943

SHA256
f1731feac3a3042c64a017fd2ce65993b1270ee0cf4bd9bd75bc3741e0becef2

SHA512
380ed1aae469b13d2daab53b3bd8a28db8b075d8f2ecc790c1a300b02758c6f384acbca015ea5fadd43cf790c603ed43dbc3ac910cdcefe5f936abec5f1a01ff

Download Submit
\??\pipe\LOCAL\crashpad_228_OJZATYMFPZLAQVBP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads