23fde9fd791be30d70cb9e22cfd1b10c1a14347c67fd046b2c7830e308e77a2b

General

Target

694a9d57b7103f739786c48d7babb7bd_JaffaCakes118.html
Size

213KB
MD5

694a9d57b7103f739786c48d7babb7bd
SHA1

d8c273eb0451e8c7543ac30f4bd6ae21209a20cc
SHA256

23fde9fd791be30d70cb9e22cfd1b10c1a14347c67fd046b2c7830e308e77a2b
SHA512

c6503174119352ac43877f421a577e524ee6ebc6da3f34acdb44052245e08137f8701940bcc876146dcb2220716c34ffa766aa0c00375a086e20d3e63fc50396
SSDEEP

3072:SGmwAxjh0OLyfkMY+BES09JXAnyrZalI+YQ:SGclusMYod+X3oI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

3104 msedge.exe
3104 msedge.exe
924 msedge.exe
924 msedge.exe
1012 msedge.exe
1012 msedge.exe
1012 msedge.exe
1012 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

924 msedge.exe
924 msedge.exe

pid	process
3104	msedge.exe
3104	msedge.exe
924	msedge.exe
924	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 924 wrote to memory of 1952	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 1952	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 4144	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 3104	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 3104	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 2964	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 2964	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 2964	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 2964	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 2964	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 2964	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 2964	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 2964	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 2964	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 2964	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 2964	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 2964	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 2964	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 2964	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 2964	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 2964	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 2964	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 2964	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 2964	924	msedge.exe	msedge.exe
PID 924 wrote to memory of 2964	924	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\694a9d57b7103f739786c48d7babb7bd_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb576846f8,0x7ffb57684708,0x7ffb57684718
2⤵
PID:1952

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,15561850517952572893,9667662360702320876,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
2⤵
PID:4144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,15561850517952572893,9667662360702320876,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,15561850517952572893,9667662360702320876,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
2⤵
PID:2964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15561850517952572893,9667662360702320876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
2⤵
PID:2324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15561850517952572893,9667662360702320876,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
2⤵
PID:516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,15561850517952572893,9667662360702320876,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3084 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3296

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
d2b37e4d605db043eed29ee66e15e7f5

SHA1
5a31bd1be41e954ea71072dcef8318185d67b716

SHA256
8433f5ec8fca33190d76e7810131c1f19128f11609fd015af3280fcb1438a17c

SHA512
28257228b539bd9f126bfd1f69f3e6d85b65efe6ec169672e2f79e5eda9e1a357c7b63f4de1a39353b6516fe1cb9ee81412bff2d86e479916104b8b1f3dd6557

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
e7894044802bf7e40d3d77b6e11c49b8

SHA1
5d5d857b94c31cbcd2622b99971ce1f91a6c50e6

SHA256
2a394a067c4753ab83881450d8767709893b15cbd0bf7afab93d4b687d5a82ba

SHA512
d8504bf63a3e0165b4ab66b5bbb82055a66037f94a82d2e6086ebd8ff2afbe9ad6bfa5c4f06e2908a12fb4585ac2d6764977e99619b6d47db638357710fb259d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
be3740b389d6542b7133ddb0fddfa536

SHA1
ba5d676d28bf05c97427e81c30d695ec03502994

SHA256
fb1d3af245e4c8a6cf61d241c37f2cd7402e52fd9bee90b05961a9225464b5ca

SHA512
da5ab75598548a6845d9ca71b6e9b035dc0f11e9bcbddfde0c364676603aff3199c6d613ae59e1eba7a9f5fff7088294cc13015688d5d8eaeb79f6bab7de6601

Download Submit
\??\pipe\LOCAL\crashpad_924_NHZCQXCFYGAIKSUO
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads