83bae8dc1c938c3423c6b8ace82d274585433ba8a3e00a74123bdbdad4689572

General

Target

69448f87f3d9706a62ec6bb42d7426b1_JaffaCakes118.html
Size

141KB
MD5

69448f87f3d9706a62ec6bb42d7426b1
SHA1

3b3127a4578e29726ee432b184611f4228722f5a
SHA256

83bae8dc1c938c3423c6b8ace82d274585433ba8a3e00a74123bdbdad4689572
SHA512

93e8ed07537b117dd999e016f02205e8f08e324303a2e35f3a76e3d261b2d31ed6dd0c58bd1ce812a7b803d15d3243f123b618caf6b346cc6e713aac97228995
SSDEEP

3072:SzAQ3QYbx7dyfkMY+BES09JXAnyrZalI+YQ:SzAOx7osMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

3084 msedge.exe
3084 msedge.exe
2244 msedge.exe
2244 msedge.exe
1408 msedge.exe
1408 msedge.exe
1408 msedge.exe
1408 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

2244 msedge.exe
2244 msedge.exe

pid	process
3084	msedge.exe
3084	msedge.exe
2244	msedge.exe
2244	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe
2244	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2244 wrote to memory of 1340	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 1340	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2036	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 3084	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 3084	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2652	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2652	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2652	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2652	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2652	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2652	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2652	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2652	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2652	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2652	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2652	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2652	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2652	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2652	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2652	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2652	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2652	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2652	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2652	2244	msedge.exe	msedge.exe
PID 2244 wrote to memory of 2652	2244	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\69448f87f3d9706a62ec6bb42d7426b1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5eb246f8,0x7ffd5eb24708,0x7ffd5eb24718
2⤵
PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,14307395351339497707,16825890613056856214,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
2⤵
PID:2036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,14307395351339497707,16825890613056856214,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,14307395351339497707,16825890613056856214,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
2⤵
PID:2652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14307395351339497707,16825890613056856214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:3980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,14307395351339497707,16825890613056856214,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
2⤵
PID:1176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,14307395351339497707,16825890613056856214,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1260 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3644

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
7bc48802b3fb50e05ddbb30c366e0ae5

SHA1
b6b5ff18a94cec738ac8b36e7f3d41bb873efb0a

SHA256
60bdf7bd998e0ba2d3fb11c08ae58f44ddb00bcaa76d3c3233d506286fa6f062

SHA512
f00e830a4caf6b1b4e20fa47535fc03a7827e166643363319a3366170b49ce434a8913882b739fb16d66aff1a96b2f0226d1ebbe380fec27afa1c3bc7885211b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
6352a29536b7a1fccfaaedcc35b6d30e

SHA1
8e8d38f6c8232dcfdad10bd14164a5eeca9b50af

SHA256
15d564892b5012247378e4ee5713ec14f21b78c0cda27c9bc5f769ced300997c

SHA512
d095bfba02b3256273e963cf6eaf6042dcbebefe456363e2a6c252bde68656d57dd8d9db685844f426aa2890168aed2ba2e9b7131fa8b03181137144e6e64401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
e135a6c6dc7b2a40b5c9248514f7b684

SHA1
1507e11439a2c5b63909788d51dda3a900cd5e38

SHA256
de70892a6ccd0906969411e598efcc8573cabdf62be2fcf786c43773fd1bcfd6

SHA512
160d9d423d02dc482e5ac3292c46d9c05b6ee49af7003a186f451c9f2912943ea1e8074217666fbc975ae5a768cab6f110b5df5204e7edb1e47b17358d5a3e5f

Download Submit
\??\pipe\LOCAL\crashpad_2244_DNCUXCPISSRHMJSU
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads