7d860dd201f5176a7dea9b60f0de21b7728490ad82a6e30b2fe491a55a2d3057

General

Target

69efdef4f88a9bb041ac6904135d2f7cJaffaCakes118.html
Size

185KB
MD5

69efdef4f88a9bb041ac6904135d2f7c
SHA1

ab0d55269b4264566b6a0cb03337eb7bcdd429c0
SHA256

7d860dd201f5176a7dea9b60f0de21b7728490ad82a6e30b2fe491a55a2d3057
SHA512

accb2b5386313fdfbe384540f2ac02fa7a154702da9c946721cddf484730c5e50650da29a702fc49378bafcc7f5225037f0d1de2fe50f378c9dd24c95a93e40e
SSDEEP

3072:SReGQyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFis:SReYsMYod+X3oI+Yn86/U9jFis

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

2236 msedge.exe
2236 msedge.exe
4780 msedge.exe
4780 msedge.exe
4148 msedge.exe
4148 msedge.exe
4148 msedge.exe
4148 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

4780 msedge.exe
4780 msedge.exe

pid	process
2236	msedge.exe
2236	msedge.exe
4780	msedge.exe
4780	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4780 wrote to memory of 4864	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 4864	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 1632	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 2236	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 2236	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 5808	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 5808	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 5808	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 5808	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 5808	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 5808	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 5808	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 5808	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 5808	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 5808	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 5808	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 5808	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 5808	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 5808	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 5808	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 5808	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 5808	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 5808	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 5808	4780	msedge.exe	msedge.exe
PID 4780 wrote to memory of 5808	4780	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\69efdef4f88a9bb041ac6904135d2f7cJaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf32f46f8,0x7ffbf32f4708,0x7ffbf32f4718
2⤵
PID:4864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,9840358807346339978,5265208102747494892,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
2⤵
PID:1632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,9840358807346339978,5265208102747494892,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,9840358807346339978,5265208102747494892,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
2⤵
PID:5808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9840358807346339978,5265208102747494892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
2⤵
PID:3980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,9840358807346339978,5265208102747494892,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
2⤵
PID:3740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,9840358807346339978,5265208102747494892,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2728 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3020

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
3edc2ac3e51f3f92a445756de1e616a4

SHA1
df393dc8386ed27e09ecd154c57a7cdfe025843d

SHA256
d061b99518f55db66fb28c10de3a115d5679bea13219146c391a3a7a7d998186

SHA512
fc431e31b72451b983f6f033cf4f691cd1864b60d611b774ca7f6893f0eb265ebdbb2d33da1a5b0fd066c853a676ff55271d9d356c01cf6180ddee8def5cf53b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
d68343fc20e7215643b3a212a1d549cc

SHA1
9ed6e90775a6d21fac3fede22db846cc013c712b

SHA256
4d93c28b0e20ea55219fcc43707d501e87567ecd0fe68b937629a714f7bcec61

SHA512
aa6827754350a978e8790adc0a94aea2857b3efc2903d0414f630a4de07a07444588f70400fad89a594245a735541a9f091951a90a274723ba491dc1cf60e3c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
1c88aa5cf81293f6f3e8b6d9ccb47b77

SHA1
ed839d552a5eb009ff144ebc82d7fe52f1a11497

SHA256
cce4b8212117614f3e38eea5ae4a80e24ab7957cbe4f5bb671ff09207c8c587d

SHA512
3c2561373c0a6ed6e9276254f6e8432d75b9f3d2f1d8636fc3d37a491718ec8d82583dc68fc9f2bf179d4c18b23e0b8ae604678a15aed03a27af2b2ae0d1825c

Download Submit
\??\pipe\LOCAL\crashpad_4780_UNMPTUNASFOGEXKD
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads