9a66d999cfea4ff10084efac03e8f700b0077e4156be175a52167e6509df53e1

General

Target

69144710453c87a57b006502fb6904f5_JaffaCakes118.html
Size

68KB
MD5

69144710453c87a57b006502fb6904f5
SHA1

38f314dd7add917a0a120f57fc4657a51ee57785
SHA256

9a66d999cfea4ff10084efac03e8f700b0077e4156be175a52167e6509df53e1
SHA512

be86d4c33613ac3b025429d754eeeb031293cc79c41b69bc225d19b5eaa956da5301c6452ffbc76f2c10d21d845ae9aa5515da2b7ca6aa6299d37b87538ec5d7
SSDEEP

1536:UfA8dUhkdc93onzkv6NYXIjwNI5JrcMAaMGrL8oSm:Ufbckqo46dMboSm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

3860 msedge.exe
3860 msedge.exe
2372 msedge.exe
2372 msedge.exe
2528 msedge.exe
2528 msedge.exe
2528 msedge.exe
2528 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

msedge.exe

pid process

2372 msedge.exe
2372 msedge.exe
2372 msedge.exe
2372 msedge.exe
2372 msedge.exe

pid	process
3860	msedge.exe
3860	msedge.exe
2372	msedge.exe
2372	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe
2528	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2372 wrote to memory of 3640	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 3640	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 4492	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 3860	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 3860	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 3852	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 3852	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 3852	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 3852	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 3852	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 3852	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 3852	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 3852	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 3852	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 3852	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 3852	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 3852	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 3852	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 3852	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 3852	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 3852	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 3852	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 3852	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 3852	2372	msedge.exe	msedge.exe
PID 2372 wrote to memory of 3852	2372	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\69144710453c87a57b006502fb6904f5_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf08346f8,0x7ffaf0834708,0x7ffaf0834718
2⤵
PID:3640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,15919978626173500470,11488286637625663179,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
2⤵
PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,15919978626173500470,11488286637625663179,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,15919978626173500470,11488286637625663179,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
2⤵
PID:3852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15919978626173500470,11488286637625663179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
2⤵
PID:1184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15919978626173500470,11488286637625663179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:1536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15919978626173500470,11488286637625663179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
2⤵
PID:1784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15919978626173500470,11488286637625663179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2980 /prefetch:1
2⤵
PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15919978626173500470,11488286637625663179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
2⤵
PID:2112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,15919978626173500470,11488286637625663179,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3136 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
fbac9592efad039d5393cae2465bdb4c

SHA1
c10000b3079220a63cff8ccf72bb2af5faca1b7f

SHA256
75ad42cf8d9c21aa260aa2b87f5bb114e2d207a4e89b6bac6fefd111388786b8

SHA512
452107ffd55424925fbef0dd0d100d6b98374612662803bd8c783f02020d3b951f1afb23ac4446de4d1e4a0347641fee826284aec569381c136c877d7eb2a42a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
841fe3096713e256856009e15afdd9d1

SHA1
262186b7d85a7665a8971dda036692ba13a788d3

SHA256
d475f605ce325f2738ddf5e1e48665bc5144384004d2aee7dde431509285a84c

SHA512
0b4c97d61d3fefd3c5d84c90c9fc7065c0833820a2a1163d775e4fbe7f78602ba44c2f0e9b916acd2f2653facb98b320a9b2ef113e456b80a97c4730ab8411c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7309e6a7560abaa413d0d10767086a8f

SHA1
9b45ce1f6acc36e26f402207cbbf91295f1c8d88

SHA256
b452851a4177e9ea901515e0a5e2dc389ee02e4e9d034db9f9ea791c112ac64a

SHA512
44d7c8d4a7838a7a0982cece7210868a43a02152b63efe8ec9f4e6fb8f2ca0eb991710a13d9a955c733cadccbe3df005d3921784ed24176fb18f059f86c3fd62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
510445cac9dcf8895567ccd827b30404

SHA1
52b58d0f903a71de7983148b20c9bafd439e7fe9

SHA256
652fa7e762e00a103aa565a6c134939b3d3080a0c6092597102e9345d8f1ee7b

SHA512
1b0298baaed3d0d4f3315194425bbbf104d6bf57bab73d357f6e33dae7cc1b5ffb25df6bb627fd5bb8179b91a1110ea1344333ee8f80a6d5bf749aeedc04aa0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
453b546e977ce59f1feefe02585d87c4

SHA1
b1c6b6439f8885d40e465866f0a89bddfd415ace

SHA256
aed0cb71ddc5fa99c67a4cb14bac9206bc622805f2b8dd046747d23d5635e5db

SHA512
76eae4ef74585fad7525dec035f63f118c7a7e8d46facc415cc2fcd113ce63595b14c7e36ecb4c468b0041a3e28bed69df6f7e424a82ad13d55400845005c75b

Download Submit
\??\pipe\LOCAL\crashpad_2372_FORIJTZVIMSBWKSH

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads