8b270f1a4ed48c05359b1ad082554200de1018787c3f24a56cd8f3641b5e398e

General

Target

68528cffaa244a857cd3605c01bfb3a8_JaffaCakes118.html
Size

143KB
MD5

68528cffaa244a857cd3605c01bfb3a8
SHA1

e6ba9723a15d8e80324fc5db9025a6502561af52
SHA256

8b270f1a4ed48c05359b1ad082554200de1018787c3f24a56cd8f3641b5e398e
SHA512

26da8fa4066425ee96278b175de5dee41c9d36244ee27c0d2de852e0a52ac09f297fc61dcf5b44dcaadbab1bff1211ce98b50e124887c0e4f4e85ea8e2bd3733
SSDEEP

3072:SFtPgWWx7dyfkMY+BES09JXAnyrZalI+YQ:SFtPPWx7osMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

1164 msedge.exe
1164 msedge.exe
4016 msedge.exe
4016 msedge.exe
2356 msedge.exe
2356 msedge.exe
2356 msedge.exe
2356 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

4016 msedge.exe
4016 msedge.exe

pid	process
1164	msedge.exe
1164	msedge.exe
4016	msedge.exe
4016	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe
4016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4016 wrote to memory of 4624	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 4624	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 2652	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 1164	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 1164	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 4516	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 4516	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 4516	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 4516	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 4516	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 4516	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 4516	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 4516	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 4516	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 4516	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 4516	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 4516	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 4516	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 4516	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 4516	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 4516	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 4516	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 4516	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 4516	4016	msedge.exe	msedge.exe
PID 4016 wrote to memory of 4516	4016	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68528cffaa244a857cd3605c01bfb3a8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd521f46f8,0x7ffd521f4708,0x7ffd521f4718
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,3957078351664103338,15917574537002149366,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,3957078351664103338,15917574537002149366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,3957078351664103338,15917574537002149366,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3957078351664103338,15917574537002149366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3957078351664103338,15917574537002149366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,3957078351664103338,15917574537002149366,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\29267686-7081-470d-89fb-e33e2beb4334.tmp

Filesize
11KB

MD5
0ee4720c8b5e4b4294fd46b77a0f5bd4

SHA1
ade707eadca283ebb04499093c00031407ca2b9f

SHA256
a931088bd581be9e3831409a85111e5744760942726d0a4961104078be76d237

SHA512
686c4ef981a6efcf9b33100adefa5dc294b43ab4e829aceb30ca8174f6c099370506bffc4a7f0fea8dafec824c228a3df8f81642ff3befddfb59b55908080cae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ef517ffb6e9d602342ff42abf8700427

SHA1
675da083c8027f61720019a08ce59195ed2495a3

SHA256
d74fd8f075cf0d1f1b095264f9afe28ea216232a76df896217cda16131e67695

SHA512
2c534691f57ad7733443380d4edc9f54d66ceea79324bd61131359e74fe7a1e460a399cd8f8d881c44cb37452f0d7a45a4c139ab4877f92b1aa694a4eb575611

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fcbb7932ffe198f63c9312b3a7541781

SHA1
6d3bbf610301e4cf83a66c8ec6137aa549b5ad06

SHA256
5f595210272ceb10fac24fce80b4ac2835aaba8ddb3f6552b365d39bec3124af

SHA512
ccc37c74f71b96e596bdfd95e95e151ea9d1ffa28b20b8c12b573df9b9db47e8f6d4bff55222c7ce42a8c6d64ef6fedf07b920888b9a9f34d9ab3121051468b4

Download Submit
\??\pipe\LOCAL\crashpad_4016_GJHUXUEYJJABCQQW

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads