d94d239b1eac33de8e06d2f780c168ff7b021995e5115a9db27ed3fad22225c2

General

Target

691a3ecf50ade9fa81f2030fb42fa8f3_JaffaCakes118.html
Size

122KB
MD5

691a3ecf50ade9fa81f2030fb42fa8f3
SHA1

5cc85adf3d64717426138db8352869dc33b90a07
SHA256

d94d239b1eac33de8e06d2f780c168ff7b021995e5115a9db27ed3fad22225c2
SHA512

2d5b1c4391fc12c7d9c6a59dcf8cdfc68a2c9bd3fcedc47ae17d1f08b5689779b5ca247b055f2685c40a42b55ca87485c87698fc2948b04f2c1c0f68999a37e9
SSDEEP

1536:p94PH/7nyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOyG:cfTyfkMY+BES09JXAnyrZalI+Yg

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

2748 msedge.exe
2748 msedge.exe
3724 msedge.exe
3724 msedge.exe
4456 msedge.exe
4456 msedge.exe
4456 msedge.exe
4456 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

3724 msedge.exe
3724 msedge.exe

pid	process
2748	msedge.exe
2748	msedge.exe
3724	msedge.exe
3724	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe
4456	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3724 wrote to memory of 5004	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 5004	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 4376	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 2748	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 2748	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 3524	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 3524	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 3524	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 3524	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 3524	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 3524	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 3524	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 3524	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 3524	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 3524	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 3524	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 3524	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 3524	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 3524	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 3524	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 3524	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 3524	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 3524	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 3524	3724	msedge.exe	msedge.exe
PID 3724 wrote to memory of 3524	3724	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\691a3ecf50ade9fa81f2030fb42fa8f3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9eb546f8,0x7ffd9eb54708,0x7ffd9eb54718
2⤵
PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,4215782589657101246,3795754494651186214,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
2⤵
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,4215782589657101246,3795754494651186214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,4215782589657101246,3795754494651186214,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
2⤵
PID:3524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,4215782589657101246,3795754494651186214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
2⤵
PID:3056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,4215782589657101246,3795754494651186214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
2⤵
PID:1796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,4215782589657101246,3795754494651186214,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4888 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9bbb7511-6e60-416b-a4ea-94c762a50132.tmp

Filesize
6KB

MD5
0a87827c584ad18e19a1d68a2d59c02c

SHA1
f4b47a000a7083ac8b8c0b22c583e63b3297a6f3

SHA256
29497002d7a47736fb55742944cc5dd7a30c3a923a229ed5c0a34dbfe3fab817

SHA512
bf9815e2d193bedebccbb16e3dc2e5bd1e29f26b91e380c1aa64ba6312e9a3cbc8ae029fcf421507105fbc6d76de17a3d8f10735628d066552615964b36d25c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0af8382eb7684873243eeadbf50973ba

SHA1
d590a248573b01ac919b05949318bcc304379400

SHA256
d8cacb82f4ad26e2d19a1ca86a8e054ecb4a58854a334b73d48303293a01b39c

SHA512
f5de07fdb256ed081126112971000011a72144ce3b1b6f0239e28d7882209bf53c6496372cb9ce63d85e6ef82218c1bb0f2a9a0ff10e56c37953cdd179c615f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
69368c095457854273b9c83a5ad99300

SHA1
40feb9d553caf6e406d2239782035386d659c36b

SHA256
131d093761315197a58696384f3b03e6b123878a10a503b9e13915396ddaed76

SHA512
b53440002b6b368ab28f2f3ea020a21efe56b7f2d9548d66fe4d6dfcb8b593c6288d80d49fc542bb991d6c93e3a7f1fc01f36475fd7e00fb625d361bfd448942

Download Submit
\??\pipe\LOCAL\crashpad_3724_YYPVNJTGNOKIKVTK

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads