6df867e7e205ea4431bc2904cbe23079c3d4f8e01fa9124b4d2906fb73f13833

General

Target

691e3aadb41ca1658146f33129034b86_JaffaCakes118.html
Size

19KB
MD5

691e3aadb41ca1658146f33129034b86
SHA1

92dcac7b293c002b5d175a033a1e943464d9e87e
SHA256

6df867e7e205ea4431bc2904cbe23079c3d4f8e01fa9124b4d2906fb73f13833
SHA512

cd39f7104b405286c6370d42830758909d7ef5df9e90c23866e2bcbd2833d49d745fa3f1e3c91a08ca6d5fafbc8c3e5e9244bbd9603749bc8e5647bea669006c
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAI74RzUnjBhD182qDB8:SIMd0I5nvHFsvDOxDB8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

3952 msedge.exe
3952 msedge.exe
2740 msedge.exe
2740 msedge.exe
3012 msedge.exe
3012 msedge.exe
3012 msedge.exe
3012 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

2740 msedge.exe
2740 msedge.exe

pid	process
3952	msedge.exe
3952	msedge.exe
2740	msedge.exe
2740	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe
3012	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2740 wrote to memory of 3864	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3864	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3764	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3952	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3952	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1408	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1408	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1408	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1408	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1408	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1408	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1408	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1408	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1408	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1408	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1408	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1408	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1408	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1408	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1408	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1408	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1408	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1408	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1408	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1408	2740	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\691e3aadb41ca1658146f33129034b86_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff8bed246f8,0x7ff8bed24708,0x7ff8bed24718
2⤵
PID:3864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,3650235547813626764,2163098773367091193,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
2⤵
PID:3764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,3650235547813626764,2163098773367091193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,3650235547813626764,2163098773367091193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
2⤵
PID:1408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3650235547813626764,2163098773367091193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
2⤵
PID:2192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3650235547813626764,2163098773367091193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
2⤵
PID:4352

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,3650235547813626764,2163098773367091193,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
38ac9bda04af2e5563f97d10a52402b0

SHA1
d37378f731795cd39cf354e29b99713c7e1af4c7

SHA256
3dcc35b958701029cbf3a876b39641159f3559dd005d2cf21e534e56f986d652

SHA512
65c7cddf581452f7e227a880b91932786237f96b201d7f8f1cf8dd50bc5636cc37d6ee2dda980d94dfd2249ed8c66bfaabe410683618e92f2904fa6834765e32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
34a4bfd592608a80f98b7b02b6def393

SHA1
1d920f4b4ef978c9b5ce292eb5198987e8e0719a

SHA256
6a1d91a11543f780632ae1b12a88765a494b9fdfbf8ae71f5511915c68fcec82

SHA512
97be897969c8e0bc3edcc116795e3cc2a9662e7182f032131de2434e29dec57322fa7382e5347d64d96eb43f426635a780decb7c3b9fc270aad02a628527c316

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c7f8704432c0908c65689ed090d8c0cd

SHA1
4e0dc12111bd062cf8adb73f6c3c344130d844d2

SHA256
d787073ae68b62252f7781b864b112a66e64b7ad2e36cab6dff1d885a240d019

SHA512
33da2c1c42ee1be3e394e581c2cb377de037954ecfcdf8441ee89d01f9b808ca7591e767ac2b76f1a654bdf2d0645ab084b20131d0f128fd6b924764fd3a7456

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
665ca0f953c17fd151495fe188439a65

SHA1
bd5ab7d84266823f0c897e1181ab37829f67a7cd

SHA256
617db652d5e101225102d26565f9ba4530e3f2cd16d016f2b4d5f15eac0366b7

SHA512
7798ae0614f4cab3ff3ddbe1bac0928c42e50fdd6542810b9c57e4c5fe92e2d8d6ca7a9f9c9ed8c1f6e1aeb0d037a1f361b23b413455f83b561ed653aa2ebdb0

Download Submit
\??\pipe\LOCAL\crashpad_2740_CQYAWVGUMRSFANOW

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads