e3f38cdbb51304bfb46c9fddec99dab37bca1c8aa298b968af0a91b1d29f41aa

General

Target

68502fef8d4b528419d183451d475b4c_JaffaCakes118.html
Size

158KB
MD5

68502fef8d4b528419d183451d475b4c
SHA1

d26842bb5afbca2ba6fe97bbeb2565416b35b3c5
SHA256

e3f38cdbb51304bfb46c9fddec99dab37bca1c8aa298b968af0a91b1d29f41aa
SHA512

990a757585b2e9f6822b6e95ebd6de1ca8f67d19ef3327c96b2b3f5465e80079255cb4f95817c7e2eb73e3f65f1731944e238c6829ac1554419decd608f7ea25
SSDEEP

3072:SRi1AdWoWFyfkMY+BES09JXAnyrZalI+YQ:SRCoWwsMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

3336 msedge.exe
3336 msedge.exe
4892 msedge.exe
4892 msedge.exe
3092 msedge.exe
3092 msedge.exe
3092 msedge.exe
3092 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

4892 msedge.exe
4892 msedge.exe

pid	process
3336	msedge.exe
3336	msedge.exe
4892	msedge.exe
4892	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4892 wrote to memory of 2368	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 2368	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1996	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 3336	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 3336	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1944	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1944	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1944	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1944	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1944	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1944	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1944	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1944	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1944	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1944	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1944	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1944	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1944	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1944	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1944	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1944	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1944	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1944	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1944	4892	msedge.exe	msedge.exe
PID 4892 wrote to memory of 1944	4892	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68502fef8d4b528419d183451d475b4c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7e4646f8,0x7ffe7e464708,0x7ffe7e464718
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,10623377951816145113,14572496265854930972,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,10623377951816145113,14572496265854930972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,10623377951816145113,14572496265854930972,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,10623377951816145113,14572496265854930972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,10623377951816145113,14572496265854930972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,10623377951816145113,14572496265854930972,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9e9afbf3-c784-4a4d-84d6-f1c5b02aa336.tmp

Filesize
6KB

MD5
5c7bca9b98724af7f49077e606e06589

SHA1
c49afddd4ebee53584851e248da527f2a27f0aba

SHA256
827e8734a9a88dd6df31a15a8ba0da853e67e4fecb17391ec04dfb98844c295e

SHA512
1b20cd84646780f688bc1208e4319999b0e9cd901ebabc0d6525f27aafda1317dd806425bfed5ea2d85e39352120d1ee0584c5ce68cc2ad395a3a7e818df8bd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4f9cd2001cff06f11073a9b480d191dd

SHA1
dfaa36567a9da5d76547c41c9dcbaf0d064bfdac

SHA256
2e900f132a9182431e64cb6d133ca8c39f243cf07e780198116495960b14cba1

SHA512
54ed23745443d3822c99328eb3d5f13f1ef6523d83a4e567c384db920a4362abfeaba6258c6d1f0f48bcf1a5689f7c36700ebd24baff7db6d38fb76f6cdb7495

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
68eb1a55d9acf3b56b9158bebaaa75df

SHA1
f57d5eb4189a98d526d3b375c7ade8f83a5e5385

SHA256
1a65979b8027ead65198ddae415037d1fb4af794d349b91b12c2f70600687929

SHA512
4449608c0d8227bcbe6bc1453b9fc0e4a0a63ae715d0414cf9d4298c2b3a4d332a68baf03fb314b02028f5af455091bb3c989dcbd0ffcc36715e1a24b53e3a2b

Download Submit
\??\pipe\LOCAL\crashpad_4892_BAPESRLUEOLSBHIB

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads