e7448d7b7671fc8408dd2c5ffc16efc3091eae7245b499c2d3e076c58de6b9b5

General

Target

8a5d6c7a16a2605af26751d83a11f9e6_JaffaCakes118.html
Size

697KB
MD5

8a5d6c7a16a2605af26751d83a11f9e6
SHA1

7ed0248755bc713d8c5a233140c7a0c614a9e09b
SHA256

e7448d7b7671fc8408dd2c5ffc16efc3091eae7245b499c2d3e076c58de6b9b5
SHA512

3c13fddd1168edf40805a5d43f161070fc667f07600624d928cb5d9a483ad099ab5f405081dd8f80a9f600c837259ad94baefe4ea8b111889de42426f3d06a87
SSDEEP

1536:S1ClvmeOyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy+:S1MmeOyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid process

2216 msedge.exe
2216 msedge.exe
1336 msedge.exe
1336 msedge.exe
3304 msedge.exe
3304 msedge.exe
3304 msedge.exe
3304 msedge.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

Processes:

msedge.exe

pid process

1336 msedge.exe
1336 msedge.exe

pid	process
2216	msedge.exe
2216	msedge.exe
1336	msedge.exe
1336	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe
1336	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1336 wrote to memory of 3900	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 3900	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 1560	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 2216	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 2216	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 4944	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 4944	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 4944	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 4944	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 4944	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 4944	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 4944	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 4944	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 4944	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 4944	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 4944	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 4944	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 4944	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 4944	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 4944	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 4944	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 4944	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 4944	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 4944	1336	msedge.exe	msedge.exe
PID 1336 wrote to memory of 4944	1336	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8a5d6c7a16a2605af26751d83a11f9e6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffceff246f8,0x7ffceff24708,0x7ffceff24718
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,11396545957256685296,10027184873215494411,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,11396545957256685296,10027184873215494411,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,11396545957256685296,10027184873215494411,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11396545957256685296,10027184873215494411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11396545957256685296,10027184873215494411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,11396545957256685296,10027184873215494411,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1292 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d5427d796eb7cd2e32eb1f41b8a0637b

SHA1
da47347a503e1a9bf49c7fa7cdba431b97e05246

SHA256
ec3f81d5113e809d1dc9990dad33c15c03cb5dc1b278d5cb631c3df04a1deff4

SHA512
4edeb3a608be71504d1dcf43338d557c01255988864ccbf0664ac5c574dd142e27d3c8ec8020885491983c77ada40b8709ec280a19d8a942cd4b74036b335ab0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b5ecd423aebf318e671719e206cf56df

SHA1
8eaf1af75ee66f6789c094b5d3951bb2f2251f06

SHA256
097819c49216be79ebec571a00840d60dfdff428311ead89a8d029e1ead44c09

SHA512
188f569126e709e48e6f896ba0055ba8c9d851a40b36742e794ca541819238b0ee034e57397da96153cc134bc11ddc6724188a80c6648f9780c8fd737e37582d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
532eff028bcde58f365590d14ff7bc53

SHA1
89c3e413c5e361cab156e8cb1d736d9ca7337b71

SHA256
8661ba6efa2a4e7991f7281d5a7ee3cc51810f556222b8e72161fe043c5b0378

SHA512
9b798f512f3663a695c74edce2c9fa687b00ab594dde9ac12fd2112df318fa58cc7129ae0e863b5f3a48adcc70d8bdcd8f27ed91cf6fca5523b7c6861f1bd3b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c7d8489157cacc1b9e71f2a63ba02518

SHA1
37afe697174f68065afef759732047a921d9d13f

SHA256
eed060c76cb420420d6de628dcdbbd880acd7603d5944db3434ee9f023e65d64

SHA512
00ff32d6ff74b25ea1206f95b5c68b20e441a62e81cb65ee21cb7da90ac3d584bb4a03b7277710b4db67ab61e999663008507a0733b8c8726fdba9c9253ec924

Download Submit
\??\pipe\LOCAL\crashpad_1336_BSMCZYDZDMIGHHBC

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads