10ffcf163487fc37a4ac49c591f479ecdbca8571315548b17ee192cd15957415

General

Target

6bcbd69673e2ae2d0ec1ffff00c44871_JaffaCakes118.html
Size

32KB
MD5

6bcbd69673e2ae2d0ec1ffff00c44871
SHA1

70ab150abcfe53da3ff9b87216b6acd6654e593f
SHA256

10ffcf163487fc37a4ac49c591f479ecdbca8571315548b17ee192cd15957415
SHA512

8fcbd62a1327d169446e7c6ae09b33b2c09fe03aa11b91eb2dab48eae3429b1bfe55d52be12f39d03a0b2fbe3744f0c39c845b31b3162c7ee70790e47e6098a5
SSDEEP

768:bOgaodlq6POcKDWVMm0Q5ARAdzCLx2Sf6Yo1OBC:bOgacxAwMbAdzeDo1OBC

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

2280 msedge.exe
2280 msedge.exe
2132 msedge.exe
2132 msedge.exe
3568 msedge.exe
3568 msedge.exe
3568 msedge.exe
3568 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

msedge.exe

pid process

2132 msedge.exe
2132 msedge.exe
2132 msedge.exe

pid	process
2280	msedge.exe
2280	msedge.exe
2132	msedge.exe
2132	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2132 wrote to memory of 2212	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2212	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 1704	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2280	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 2280	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 912	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 912	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 912	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 912	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 912	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 912	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 912	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 912	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 912	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 912	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 912	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 912	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 912	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 912	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 912	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 912	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 912	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 912	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 912	2132	msedge.exe	msedge.exe
PID 2132 wrote to memory of 912	2132	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6bcbd69673e2ae2d0ec1ffff00c44871_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffedb2d46f8,0x7ffedb2d4708,0x7ffedb2d4718
2⤵
PID:2212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,14634459300555954774,14822184063694707857,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
2⤵
PID:1704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,14634459300555954774,14822184063694707857,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1896 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,14634459300555954774,14822184063694707857,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
2⤵
PID:912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14634459300555954774,14822184063694707857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
2⤵
PID:3996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14634459300555954774,14822184063694707857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
2⤵
PID:3968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14634459300555954774,14822184063694707857,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:1
2⤵
PID:1336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,14634459300555954774,14822184063694707857,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5996 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
72B

MD5
57f38e49db03be084298cb275bc2e54f

SHA1
8af788713e8313e01866430f43c5e028f797e9d6

SHA256
db7264ce460844bcc3c35bc91616d641b7b29f88e448f2bd12a83c44ed92da50

SHA512
f578f706e07bf4327faa52aa67eb1d244c347cf330a2113b7fc6991927aed2f3885614d8f5a4e969fd5d046f5b6650ed8505acbbfd0c684dcff64eab68e20669

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
d4d5e5158d5da97b5e924305ee792dfe

SHA1
a37683ba41769982ec992fd3ecab116bf7018bf1

SHA256
2859a2e05bbbf8f2b35f7f48672f7264475aa136918bff34e781ce2e6336dac5

SHA512
cecf8c436bf8ea488a49981683c31c7018336c0a4f3d212482d90500eb2d8efd9c9c06f26359022b4aff89a2c12446c399636e4b2639fc23808755d62818310a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
ba68664d8ce44badf31b2d9b5aee23c2

SHA1
1a18f3a0f906305344a167c4a1f75e4b235040bb

SHA256
07b44ce231036399e7203f2f2d79444476b8ba07ed13b33ad3fa654a5aa80664

SHA512
5aa594c2aae48fb31067aee6260c1e4b83306eac0dbe3b338fa19e2e2d6d3d2ac3a9a7dcc431de1b01f50efb6b654f019d0f09508a9e94389fc88f440ba35e53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
c8232657fadb5ffb969d4a146a7053c6

SHA1
c3befc5f21391f8ec09a44ec320c312659feaab2

SHA256
155978206ee4dad6da639dfb106af0f4edc5f85cfd51f9954b2de8193653d8f2

SHA512
e63a6c15dc42cf0b16aad2c1b5aa2437dc07a441c383bfa5c9cff12574eace483c81b3b6dcd59d005f1274ac0406ba20e144f3e4ca9d40f0b2e32476c0b16bd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
d2b836d359d6fa856cf08f7816cd5d98

SHA1
af46d561bd3ce6a27fc6cd49bf95e145de05a579

SHA256
8fdd3d5a599cbc2f4ed11bb96eca278b1b0d07d148becbb42e319997b0860790

SHA512
251e891da81d5972f76ce767a6ff1649515588ac8898ca9fb53d4da70af74ef8f840e1a6d32e29afa15ef1e7b142949a15c054b0137ea8d1d37651993302806c

Download Submit
\??\pipe\LOCAL\crashpad_2132_PIQHEIRNLMOECAUG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads