c62dba2794ba69b6eb5efe0401fdea5e71c8221ada84db44c7c7d85740e67edf

General

Target

7a221a1b6a8f67d67e7225bb1b5532bc_JaffaCakes118.html
Size

226KB
MD5

7a221a1b6a8f67d67e7225bb1b5532bc
SHA1

60bfbf396efd272ac54ea1e8ebb0e523d9a43765
SHA256

c62dba2794ba69b6eb5efe0401fdea5e71c8221ada84db44c7c7d85740e67edf
SHA512

eb73b6734a53821ea257238054925af8d1e6eb895e60c080a2582f8e12b7dcd874e76edcab2cf15f386e378619caf89e6f83be8ea342bae3371224665338430c
SSDEEP

3072:q0JkrGKZIrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJx:qrGfz9VxLY7iAVLTBQJlx

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

3504 msedge.exe
3504 msedge.exe
3976 msedge.exe
3976 msedge.exe
4356 msedge.exe
4356 msedge.exe
4356 msedge.exe
4356 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

3976 msedge.exe
3976 msedge.exe

pid	process
3504	msedge.exe
3504	msedge.exe
3976	msedge.exe
3976	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3976 wrote to memory of 2564	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 2564	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 1528	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 3504	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 3504	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 4304	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 4304	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 4304	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 4304	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 4304	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 4304	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 4304	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 4304	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 4304	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 4304	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 4304	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 4304	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 4304	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 4304	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 4304	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 4304	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 4304	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 4304	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 4304	3976	msedge.exe	msedge.exe
PID 3976 wrote to memory of 4304	3976	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7a221a1b6a8f67d67e7225bb1b5532bc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffaecb46f8,0x7fffaecb4708,0x7fffaecb4718
2⤵
PID:2564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,11102397204237070234,14206436832933309261,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
2⤵
PID:1528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,11102397204237070234,14206436832933309261,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,11102397204237070234,14206436832933309261,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
2⤵
PID:4304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11102397204237070234,14206436832933309261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
2⤵
PID:4120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,11102397204237070234,14206436832933309261,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
2⤵
PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,11102397204237070234,14206436832933309261,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1264 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3c3f0641b2cfac91402c4bb212e5cdbb

SHA1
b324db08ea34684012a8c0e16dcfb4dd71d77d2b

SHA256
d8b79dd9249a5701d2a54f3e09161882c5ece2cd69634bf66fbc3f64b1dc1361

SHA512
e6b6856d7a8881f952adc30f3c1b48ecb03870bffa73cc846c061ee4d6ee626bc91d817daed216ff5139396a77cf2eaab98a96c4b34662ac967d1bf31cadba1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
54f72eb0b2551820fa14b2b25fc677fe

SHA1
9c91dfab6e4a0fed07b68a6e305a89ea405beddb

SHA256
1ef68ec8a58b28c2d17dfab895ce1742e68557cacd2a483f72f439566c506d8c

SHA512
03d65c9a61608a89c93570472bd7f6479f654a6ce6f71269a6a2abfc4af5db06f1400282c091903e7ccbe5a2593fcda799975edf73ecc1c816f4d0717c48c96e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
407f04ee174402d4fd25f2a6baab55f6

SHA1
3c2ab5c8375a8f62a10614a7fbcd6774907251a6

SHA256
989531515549d7b9ea33ba4382c571c7192736c891a7d9f7afe65d9c8f698693

SHA512
2a4ff4db0dbed31f637298a18de48a3a9b0325afcf6d6262e8331de01a91e05e72fdab1c3ca413652d5236c056b86729f31cf947f065458499360655b8e9ff33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0d15e44ebd492a609126ccfaa46145b4

SHA1
4fee15d5f9a577794e6e119184b28dafb0bf4ab6

SHA256
5e66b7ac39e6b1b6b2d06c52b64843c3a912621c2844ce115a768d667a2671d0

SHA512
653b0f98c78ceaeb3f86c4b357b09137fa9bef32782cfedecb1440b4e13e45e6e0ec2b2e682fc726204266f1cfe67b229f6bc138fcaa838cdeecaebf96a89f58

Download Submit
\??\pipe\LOCAL\crashpad_3976_DKCPXPNPDEKQQKSQ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads