94f31977e69d7909c9ccd3e6d370b2ea244a595b788a0a8d1459b6b4c4c6a541

General

Target

69653ea0db7aaf59bc86f3b9f9d376de_JaffaCakes118.html
Size

153KB
MD5

69653ea0db7aaf59bc86f3b9f9d376de
SHA1

1074ff65b16879ce0669164d956cfc61cb2dede7
SHA256

94f31977e69d7909c9ccd3e6d370b2ea244a595b788a0a8d1459b6b4c4c6a541
SHA512

2da8178e3b7ce135da51970d3eb59a833e35141218296b4e4095f5bef9c8fc14796afe030bb549dd097733b923ab8a6db18414a86750f8d02c52155a16772521
SSDEEP

3072:gN0ReZwkujz6y6YPnV3htq5izxwaUOl3oOeEpsZ2:gNOL

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

2948 msedge.exe
2948 msedge.exe
3720 msedge.exe
3720 msedge.exe
3272 msedge.exe
3272 msedge.exe
3272 msedge.exe
3272 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

msedge.exe

pid process

3720 msedge.exe
3720 msedge.exe
3720 msedge.exe

pid	process
2948	msedge.exe
2948	msedge.exe
3720	msedge.exe
3720	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe
3720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3720 wrote to memory of 1436	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 1436	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 3668	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 2948	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 2948	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 4600	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 4600	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 4600	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 4600	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 4600	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 4600	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 4600	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 4600	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 4600	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 4600	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 4600	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 4600	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 4600	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 4600	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 4600	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 4600	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 4600	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 4600	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 4600	3720	msedge.exe	msedge.exe
PID 3720 wrote to memory of 4600	3720	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\69653ea0db7aaf59bc86f3b9f9d376de_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8591c46f8,0x7ff8591c4708,0x7ff8591c4718
2⤵
PID:1436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,10210972838556616707,6944610942275162333,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
2⤵
PID:3668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,10210972838556616707,6944610942275162333,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2520 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,10210972838556616707,6944610942275162333,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
2⤵
PID:4600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10210972838556616707,6944610942275162333,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
2⤵
PID:1140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10210972838556616707,6944610942275162333,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
2⤵
PID:4848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10210972838556616707,6944610942275162333,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
2⤵
PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,10210972838556616707,6944610942275162333,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
f5f8aca85e2f5fdb9cd15b81370d9928

SHA1
a78148b58fbb6545a13067831323a624d9917edc

SHA256
1c442c472d1dc323784dbd8d95dc00afa045204e67a9eba031e381d04cf2e7a3

SHA512
5b7b63694eaf84603012c0d32bf18bd8adbd66f8bb3e4a2f9d7cd456a74d64e25314e50fc804c3b0f9a8c5fe7743becd3dc276d147d3ec947f60661dcb029ac5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
42dc55bcfb4abcbe0d63fa8918551fee

SHA1
df8cb13bed4acc68a0979fa5d149f4b119a5b226

SHA256
c56391e711110815037d67e4993479188150aa324210ab697cb9fac1cd01e8c6

SHA512
ad5c3ebc03dce227bb7b19c6a58d81ffea1b16b452258118cadb1102e13fc18215e9f6b052bc0a98bdb08ca77eb8b0892aea53561f9de5c47a3f24cb5c47c8c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b07d4af857048942c87921ddff07f893

SHA1
0d797ff9b0a8b26d47a732401c0dace3a9d1448f

SHA256
10cf4ab35c027a6da59f2987f4245eaee243a936ba8d60bc44045cac21799902

SHA512
ad5d83d157963564fdc828f61e14253814351a8bdfaf12e27728584e831d3568f69cf0305a3c283dacdcccb467f2abd42d069ed765f1499954c915d5ab5b5e24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fd5a0ee1b4f6b39a5b3fc4f70142123d

SHA1
021ca83a986622e2b1c244cfc20c3092798b7b1b

SHA256
525447c0309f873d5ed66f631fe72ca995e7f186f6483a93149c1d9bde0539d5

SHA512
7b85a32cde34a8ed7d2732bd36dedb8bf17375b904bde01c1dcff93bc20723d1bad56b7f0ae38a63a50a8b98b82d0dbcc2973d58783d152fd5b692d098f9e809

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
197dd6a5625693d3bed5a4ca41408b55

SHA1
c59b3f4d5623104235b1afffd00b7acea0919bdb

SHA256
4e2e05d4547eee3bc33936654b0d815bb108f7272b098344dfda83d3cca696cc

SHA512
9088521a5bb4afb210db6cfb62a99018c52ef24ebbbef982b7a12b212cfb039515d70bffcba0ba15ab756106db2c97da6c18e5fd3898ed8fa4f896c34a5f5d74

Download Submit
\??\pipe\LOCAL\crashpad_3720_TIJCOOYGFBKYZITB

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads