cbf8f21fd01ab8150c37210036102216577307a965cb54cd1d45b41f9f967699

General

Target

6913796303be37376ee4974eaa2f4baf_JaffaCakes118.html
Size

21KB
MD5

6913796303be37376ee4974eaa2f4baf
SHA1

d9ae1e5678ba553042c43788f3e20456191b5c0a
SHA256

cbf8f21fd01ab8150c37210036102216577307a965cb54cd1d45b41f9f967699
SHA512

684421f5e1f3779c711348fca69895f213e39b7a59fc8ce044bc749e515e6e59eabc883c9baf27a0605b9fc6341f86094b3a3adb5a9562c8125d3df8f188ce81
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIe46zUnjBhuA82qDB8:SIMd0I5nvHxsvuDxDB8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

3408 msedge.exe
3408 msedge.exe
4712 msedge.exe
4712 msedge.exe
2296 msedge.exe
2296 msedge.exe
2296 msedge.exe
2296 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

4712 msedge.exe
4712 msedge.exe

pid	process
3408	msedge.exe
3408	msedge.exe
4712	msedge.exe
4712	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe
2296	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4712 wrote to memory of 1120	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 1120	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3200	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3408	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 3408	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 4332	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 4332	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 4332	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 4332	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 4332	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 4332	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 4332	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 4332	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 4332	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 4332	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 4332	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 4332	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 4332	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 4332	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 4332	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 4332	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 4332	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 4332	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 4332	4712	msedge.exe	msedge.exe
PID 4712 wrote to memory of 4332	4712	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6913796303be37376ee4974eaa2f4baf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc451246f8,0x7ffc45124708,0x7ffc45124718
2⤵
PID:1120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13831153095757577745,6017476011339870472,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
2⤵
PID:3200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,13831153095757577745,6017476011339870472,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2512 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,13831153095757577745,6017476011339870472,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
2⤵
PID:4332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13831153095757577745,6017476011339870472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:4400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13831153095757577745,6017476011339870472,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
2⤵
PID:2624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13831153095757577745,6017476011339870472,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0927ec2e29af27f8864ad5407e932a0e

SHA1
606a5f90351337407551ee7141480bf43ef8a926

SHA256
4de08fbef805f3bdc4c6f7f9146441c414251b30e35301ab128a927f975af381

SHA512
4d4154890bd5c8b290e461f52c25c925148b1d2f2469c8d8f24da6c036e7ef7663e2d092471ead3a0ff07144617b33fc25908c6e4bf0e7492cbd11b32808f49a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b2684eda9c2d5e4f2ca5440ffb36935a

SHA1
93cde29f57631f3a82a62b0e034cf0a933a732cb

SHA256
5f89bebc9e25924e12a43ebf0602ae1ec225b81841e773e8f6b2b62bddbffdc3

SHA512
d157f109bc08cc51067b86bfa9c690c9e1e9926ea3435ebdd1debfa8678d0ba87981ba06817c82bc523829adff0fb0df8626bd09746f54bd816f84d644793c56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0e831a78f1519860cc032d7052de64fa

SHA1
09d3e918c239b0a154dd04bb19aac9265cbd6477

SHA256
ea63a06b6482a69af46c154b7da8207a1a15ac4da0d2faee23cbcaa4122011c7

SHA512
ecda6d68659cf9779542f6963ef2561c6d4880474a64cc34251fc5d7e46ec7057b29eef9656ef5533c9a37aa7514f74e1218b5173ccc21edd3cb4ec5172af0af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d5a3906924789b2934675cbf9eea9871

SHA1
5e0cc4a2bde9ea5a946dbd37ae565d79df973948

SHA256
756654ba825a21aa9c050da6f50326ee5797f8275beeaca0a58b18b26be0dd2f

SHA512
6a6d667a39271387fe4fb3364e72a3fb371c1b556a1af72ad0ff93b317a5ef88daff7e0657d9c3065522804ef5c0bfe988ee1e3467d34a5a0e90afb7deecd2de

Download Submit
\??\pipe\LOCAL\crashpad_4712_SNATPQLULYSGVAVM

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads