9cbcf9040f41c3a42207476f04865ae73e101348f5b2a1145b5820143a70e7e2

General

Target

6bce6f82f193ac0deb7901bb8a6eda58_JaffaCakes118.html
Size

18KB
MD5

6bce6f82f193ac0deb7901bb8a6eda58
SHA1

23930596119de24c74b60f6a6d1f1a392a2a06df
SHA256

9cbcf9040f41c3a42207476f04865ae73e101348f5b2a1145b5820143a70e7e2
SHA512

731fa60ef596a001b8f0dbe07025c0960ca29dd8dd3ecc624756b9845faa2260ae4b3893e5d93fefa7d57b65c817db4fee5225b0d8b48a1d5b71f2d5d1b5f111
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIt4BzUnjBhvR82qDB8:SIMd0I5nO9HJsvvaxDB8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

3112 msedge.exe
3112 msedge.exe
4316 msedge.exe
4316 msedge.exe
2152 msedge.exe
2152 msedge.exe
2152 msedge.exe
2152 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

4316 msedge.exe
4316 msedge.exe

pid	process
3112	msedge.exe
3112	msedge.exe
4316	msedge.exe
4316	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe
2152	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4316 wrote to memory of 5060	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 5060	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4440	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 3112	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 3112	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4152	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4152	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4152	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4152	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4152	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4152	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4152	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4152	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4152	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4152	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4152	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4152	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4152	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4152	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4152	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4152	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4152	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4152	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4152	4316	msedge.exe	msedge.exe
PID 4316 wrote to memory of 4152	4316	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6bce6f82f193ac0deb7901bb8a6eda58_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa439e46f8,0x7ffa439e4708,0x7ffa439e4718
2⤵
PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,7677179471998331820,6197316124339055401,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
2⤵
PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,7677179471998331820,6197316124339055401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,7677179471998331820,6197316124339055401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
2⤵
PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7677179471998331820,6197316124339055401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
2⤵
PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,7677179471998331820,6197316124339055401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
2⤵
PID:4528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,7677179471998331820,6197316124339055401,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\208d555b-2f73-4fdb-b2f8-6856eb2ddd08.tmp
Filesize
6KB

MD5
63a2d42996b6299f3f64153828f34bb2

SHA1
ae4fe8da9a538db6788d5a85dd9a6cbc976b2eff

SHA256
0d3d333aac9518f9023d50f38d0a1675b1cb3bc1cc2ac26da88c67c9188ecc7e

SHA512
cb9eddca4a0c2dd7a788b35500346fc317645b2ba40db42762ed850614a95bd70cebf214839eee9b3b56fee0369932fb5c7df74a04436ea5d1ec789059cf247c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
4c30273c60f98f903990d2b1dc52ec68

SHA1
543ade4159e7883899969c224a8d9ec0f8903c6a

SHA256
0df8645f3b5a109aef57b9884e29eb3dfa20a6574b5276532dc962029838623e

SHA512
f74bbac645494fb10226423767db8edee3a0dcee3c7d86e9f867e3cfe250502927f3c8f93bff28cdb6b1d16d549b0e326a87307c95da1b005fd0c5a311161d82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
3243228db61e6dee25fb6edee0752c5b

SHA1
0bc75d2170b506a55a092a79c97f6bb3d69bb8cc

SHA256
3348864bc8ddd35ac553591b027ef9b5e3cbbbc059e5252216b2b6ee313a3d89

SHA512
1ce56d2f3658fe82676ff723e5ddf88a6ad915746515cb31b7c9f71a6c87e17bf4be19877105bb8a9e3c9f896a616eb8fce68459be3e6240fda1a5cf3fdf9ece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
66c4388c43d061f9f2d0e5679e5e0c36

SHA1
34cd5bcd7918a9bfa7f76baa854b25bf2c1d05f8

SHA256
e1ac432a21ca718bddc7987999f0be188171b1c9db535f809fa97d5edf45c26e

SHA512
c97d28176304ad40a82680a8f9bbc9d1fdaece7a2926dc066c4e9f8a9342c59914dac5ee8c5711a0907ac8fd73299699657ccefdc60f876ba8c839d57c71dbd3

Download Submit
\??\pipe\LOCAL\crashpad_4316_VSZKKCADQHKTFNPB
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads