fdb5dab1ae05cf66ed7f493de63f1f09c368165769fd9a242260cdfcd1b752c9

General

Target

6959a56521e7bec2e59b3f9fb03d6e12_JaffaCakes118.html
Size

139KB
MD5

6959a56521e7bec2e59b3f9fb03d6e12
SHA1

b181c48bf032f9e6733a88f623673fdd7c7b7252
SHA256

fdb5dab1ae05cf66ed7f493de63f1f09c368165769fd9a242260cdfcd1b752c9
SHA512

cf18f682bc532ef97700e83cc5558b268e5503f9a48e0f589337366c8f33ad348ed58ccb8b58d8b562718c6def3280debca6d8cb217cdbe7d7866cfee856a1cf
SSDEEP

1536:S9PEmAx/zltIyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:S9uHIyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

2964 msedge.exe
2964 msedge.exe
3956 msedge.exe
3956 msedge.exe
4956 msedge.exe
4956 msedge.exe
4956 msedge.exe
4956 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

3956 msedge.exe
3956 msedge.exe

pid	process
2964	msedge.exe
2964	msedge.exe
3956	msedge.exe
3956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3956 wrote to memory of 4504	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4504	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 4116	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 2964	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 2964	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 216	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 216	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 216	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 216	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 216	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 216	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 216	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 216	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 216	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 216	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 216	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 216	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 216	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 216	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 216	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 216	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 216	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 216	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 216	3956	msedge.exe	msedge.exe
PID 3956 wrote to memory of 216	3956	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6959a56521e7bec2e59b3f9fb03d6e12_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb576846f8,0x7ffb57684708,0x7ffb57684718
2⤵
PID:4504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,18386231775214868803,8937244118726121399,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:2
2⤵
PID:4116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,18386231775214868803,8937244118726121399,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,18386231775214868803,8937244118726121399,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
2⤵
PID:216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18386231775214868803,8937244118726121399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
2⤵
PID:2208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,18386231775214868803,8937244118726121399,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
2⤵
PID:4964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,18386231775214868803,8937244118726121399,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1668

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
2debda4c1812ccfbe8876224c2d1f7f5

SHA1
03bba971cb1486aff03eee2c417174371ea8d695

SHA256
8bb9c9b745f9a5db40d9f7d798ba3d12438d72ae99a9d48b0f32b8751b83da61

SHA512
f88f19403cdcb5b6cb2f6e06d1d8da80c367606e5fe2fff280639eae344c57c6277fa20da183b28eb32ee2143ba29655abdfc88fa1138db404712175c7c98801

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
b613e27fd4e3618c024318e11540f0c5

SHA1
80ef4f9a580a7286a3b60064e94a858bb0722716

SHA256
6fb53d15df7390c6c69b6cbfaf5873d69e86e39397686746c091599dba303032

SHA512
f192fec241541ae62d021bf3dbf47216de716db9be745b11cb9dc3b621fc0f70b3c95280b02ddb2821a18912d35019a7c7732651fcb480b2d4d172191315b963

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
e87c929e74bed27c251d571a6f2eb9cf

SHA1
d1138f4f486188ad682e0dd82dd42823ba0c6ef0

SHA256
5b1cdf0724be533a472ec336f0f0c1837b0329053f08d8e16694dca30c189c1a

SHA512
7202248a928eeef9eae1414a7efa0bab951a261eceb5f8ba980f9e8b5eebe0a33b51a30d16ae34f6d7920c1e2ce168836b2cf9c1b48422d72ca6cd79cb74ad13

Download Submit
\??\pipe\LOCAL\crashpad_3956_ZBNHZCQXCFYGAIKS
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads