ed02cad84e841d249e21364b67db66d408c3fb7aab503c2d0de1ddce427094fb

General

Target

695116623fa176a39b162678b4c3be24_JaffaCakes118.html
Size

156KB
MD5

695116623fa176a39b162678b4c3be24
SHA1

88d9c7ffbdb7b6e9429e7d243ec26613853f6148
SHA256

ed02cad84e841d249e21364b67db66d408c3fb7aab503c2d0de1ddce427094fb
SHA512

15d7a873ee1cb5b41b2f060cc5d18df5bc8a97e69e2a34d4656080137cfc138f298a0fe02fe232e9d0e9f28a1c336bb850a3b1684eeb8439a97ad33575e4d314
SSDEEP

3072:aFzSF3V2UP13G4k5QhLpOatVdqBL5/fNbYaaLStRGcxWUu/v66sbsGon4G59t9Vq:OW53G4k5QhL8atVefNbYaaLStRHxWUu0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

640 msedge.exe
640 msedge.exe
4204 msedge.exe
4204 msedge.exe
1676 msedge.exe
1676 msedge.exe
1676 msedge.exe
1676 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

msedge.exe

pid process

4204 msedge.exe
4204 msedge.exe
4204 msedge.exe

pid	process
640	msedge.exe
640	msedge.exe
4204	msedge.exe
4204	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4204 wrote to memory of 4452	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 4452	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2984	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 640	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 640	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2932	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2932	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2932	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2932	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2932	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2932	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2932	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2932	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2932	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2932	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2932	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2932	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2932	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2932	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2932	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2932	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2932	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2932	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2932	4204	msedge.exe	msedge.exe
PID 4204 wrote to memory of 2932	4204	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\695116623fa176a39b162678b4c3be24_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee9a746f8,0x7ffee9a74708,0x7ffee9a74718
2⤵
PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,17414116994654018462,1765374949883483337,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
2⤵
PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,17414116994654018462,1765374949883483337,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,17414116994654018462,1765374949883483337,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
2⤵
PID:2932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17414116994654018462,1765374949883483337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:4040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17414116994654018462,1765374949883483337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
2⤵
PID:2320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17414116994654018462,1765374949883483337,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
2⤵
PID:856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,17414116994654018462,1765374949883483337,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
9711b20b3121647945ab3b0212523438

SHA1
859c3bd48ee953ec8a64bbbb4bc3578a95f95d74

SHA256
04afe1fdffd807568adaefd081d17b405d5e7db262fdcb956be0d9b563598367

SHA512
138d4e03d5a6e60580ecfd1813a2ed93924ca33ab744d5937465535dd5865832cc53e143eea392121bd40ed2508ec9ed6b2cdce303915850b6d178ae65f4a65d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
fae645c844085d913bf7cafabe7a92b8

SHA1
73e572e9841ea0885e2d944a45cc8b5ad5ed698b

SHA256
f2b39aede78ef35d9b1e497190077187ad892d7d58f1a26540568343dc2db723

SHA512
56866c08d0b9d0f242625e9e3de8f9553779cc7192fb75095388b023072e9e3caa380181cfd975cf0c121da8febc6ded7529060c4d6f1d2b390b2f472275cb66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
93551a6daa9182beb54376ead9f5ba3b

SHA1
419e8b090a630e840b2ca7ffb031eedb6ab92b37

SHA256
f1547542dc47cbff8af7380ed8c07c2578a98b17cd9546ce1c9cb9c1da8f5868

SHA512
f74fa4808b726fbea206a50f813de58b5a7f683b97892ce8beba7e4dc0d67ace6775b927913c0855a7081b081f4ab129393068d8d5e608a7daa486fa07b02396

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7dd59fea37d1e1fae34cfc15d6c327f0

SHA1
9c71fea44818c6b1267d50114e5c33fd5bad1962

SHA256
58741e8e77e77d7f887f4ad65cd46442c71a83bdec34d37e8ebe568addccda20

SHA512
972eefb00450d0319904b75ae72d730d41b0cb3bac7f6391978ee66180c18ac541787a94bc81885db34a5287e3160d22f82fef3517f0ce8385354834911631fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dd16c9e4617baa18cc0b3655dac202df

SHA1
3efd7f42249f47c84de38f041e0d305fc8941731

SHA256
d1996161be53d41c824a84c24a1dc3daadad36b7569338b74aae9c35a02da048

SHA512
e510849aba84a35dbc1fe366ecead0d3665f9d12aecc734acb6305e1038985ef914d8b8fcb418e8c60af3921647c5a792171a6d72ace8f13aebaa952e506e605

Download Submit
\??\pipe\LOCAL\crashpad_4204_PALBPLZGKCQBLAZG

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads