Overview
overview
7Static
static
387689098c3...18.exe
windows7-x64
787689098c3...18.exe
windows10-2004-x64
7Documents ...up.exe
windows7-x64
Documents ...up.exe
windows10-2004-x64
$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$TEMP/A245...57.dll
windows7-x64
3$TEMP/A245...57.dll
windows10-2004-x64
3$TEMP/A245...18.dll
windows7-x64
3$TEMP/A245...18.dll
windows10-2004-x64
3$TEMP/A245...109.7z
windows7-x64
3$TEMP/A245...109.7z
windows10-2004-x64
3install.html
windows7-x64
3install.html
windows10-2004-x64
3js/bramus/...ler.js
windows7-x64
3js/bramus/...ler.js
windows10-2004-x64
3js/prototy...ype.js
windows7-x64
3js/prototy...ype.js
windows10-2004-x64
3lic.html
windows7-x64
3lic.html
windows10-2004-x64
3page - к�...�.html
windows7-x64
3page - к�...�.html
windows10-2004-x64
3page.html
windows7-x64
3page.html
windows10-2004-x64
3page2.html
windows7-x64
3page2.html
windows10-2004-x64
3page3.html
windows7-x64
3page3.html
windows10-2004-x64
3page4.html
windows7-x64
3page4.html
windows10-2004-x64
3page5.html
windows7-x64
3page5.html
windows10-2004-x64
3Analysis
-
max time kernel
145s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10-08-2024 19:44
Static task
static1
Behavioral task
behavioral1
Sample
87689098c31b845fa5dc1eb6b8d47bde_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
87689098c31b845fa5dc1eb6b8d47bde_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Documents and Settings/Admin/Рабочий стол/SkypeSetup.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Documents and Settings/Admin/Рабочий стол/SkypeSetup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$TEMP/A2451303/e1051557.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
$TEMP/A2451303/e1051557.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$TEMP/A2451303/q1066618.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
$TEMP/A2451303/q1066618.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$TEMP/A2451303/x1010109.7z
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
$TEMP/A2451303/x1010109.7z
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
install.html
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
install.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
js/bramus/jsProgressBarHandler.js
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
js/bramus/jsProgressBarHandler.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
js/prototype/prototype.js
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
js/prototype/prototype.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
lic.html
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
lic.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
page - копия.html
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
page - копия.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
page.html
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
page.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
page2.html
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
page2.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
page3.html
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
page3.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
page4.html
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
page4.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
page5.html
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
page5.html
Resource
win10v2004-20240802-en
General
-
Target
page.html
-
Size
2KB
-
MD5
f64f7923bd43c2a7343f057f3a85ca3e
-
SHA1
c62d8851e180dd29edc101b6b0c37bd80112de1f
-
SHA256
f5af2c0e423d24b091a14aa774189f9a710de1f486d405190d668a968f99b66d
-
SHA512
8ac06148996d7da59e3a950e20f83fa17ff0e4ce288d4f742b781deb9ce5ea3fc5dd9d71e58e826d9afa2bd2cc4cd7556a8cbcd31b7840ed2c44377af767a1b3
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4508 msedge.exe 4508 msedge.exe 632 msedge.exe 632 msedge.exe 3856 identity_helper.exe 3856 identity_helper.exe 5068 msedge.exe 5068 msedge.exe 5068 msedge.exe 5068 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 632 wrote to memory of 1984 632 msedge.exe 84 PID 632 wrote to memory of 1984 632 msedge.exe 84 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 1640 632 msedge.exe 85 PID 632 wrote to memory of 4508 632 msedge.exe 86 PID 632 wrote to memory of 4508 632 msedge.exe 86 PID 632 wrote to memory of 3412 632 msedge.exe 87 PID 632 wrote to memory of 3412 632 msedge.exe 87 PID 632 wrote to memory of 3412 632 msedge.exe 87 PID 632 wrote to memory of 3412 632 msedge.exe 87 PID 632 wrote to memory of 3412 632 msedge.exe 87 PID 632 wrote to memory of 3412 632 msedge.exe 87 PID 632 wrote to memory of 3412 632 msedge.exe 87 PID 632 wrote to memory of 3412 632 msedge.exe 87 PID 632 wrote to memory of 3412 632 msedge.exe 87 PID 632 wrote to memory of 3412 632 msedge.exe 87 PID 632 wrote to memory of 3412 632 msedge.exe 87 PID 632 wrote to memory of 3412 632 msedge.exe 87 PID 632 wrote to memory of 3412 632 msedge.exe 87 PID 632 wrote to memory of 3412 632 msedge.exe 87 PID 632 wrote to memory of 3412 632 msedge.exe 87 PID 632 wrote to memory of 3412 632 msedge.exe 87 PID 632 wrote to memory of 3412 632 msedge.exe 87 PID 632 wrote to memory of 3412 632 msedge.exe 87 PID 632 wrote to memory of 3412 632 msedge.exe 87 PID 632 wrote to memory of 3412 632 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\page.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffadbad46f8,0x7ffadbad4708,0x7ffadbad47182⤵PID:1984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12613229099975744722,583550759351549044,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:22⤵PID:1640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,12613229099975744722,583550759351549044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,12613229099975744722,583550759351549044,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2596 /prefetch:82⤵PID:3412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12613229099975744722,583550759351549044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:2064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12613229099975744722,583550759351549044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:4816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12613229099975744722,583550759351549044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:82⤵PID:2092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12613229099975744722,583550759351549044,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12613229099975744722,583550759351549044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:12⤵PID:1512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12613229099975744722,583550759351549044,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:12⤵PID:1716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12613229099975744722,583550759351549044,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:1524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12613229099975744722,583550759351549044,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:12⤵PID:1692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12613229099975744722,583550759351549044,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2548 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5068
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3880
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ab8ce148cb7d44f709fb1c460d03e1b0
SHA144d15744015155f3e74580c93317e12d2cc0f859
SHA256014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff
SHA512f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4
-
Filesize
152B
MD538f59a47b777f2fc52088e96ffb2baaf
SHA1267224482588b41a96d813f6d9e9d924867062db
SHA25613569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b
SHA5124657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b
-
Filesize
6KB
MD5b6762ffa007493b7151fc9882ae0d5b6
SHA18cc60a6e6878db3c26fa48bc7d2bd53ba119d962
SHA25696a8cdf2ab90a498c1ff0124a3d25e8745171bc9a12613423af09aa48a04b58e
SHA512d981c254c956c4df13567f8787140b9d6abb906ad304a14846ed2b5baca8ca13c2346bc644f4edb6f83e33968258b8131daafe367f57296306163a8d8f7f6582
-
Filesize
6KB
MD55fdf23dd859273bfbec49a7e5bf449f4
SHA14d9918377023256b3cd44f8f17e886fdc6a05f68
SHA256ba832a4f094a5c8a0050e82778d66006b0f8516fdcd55d2acfaab4e673b676f0
SHA512da2916a9d588bb4ffc6037d385b70ea114bc4322c34d89534443b5bb8a18a7d38b04808afb0c6f79a90252cd28c7701e8c0c5f9e37be659be049ff27d04011ac
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5d782ff1c283140fb2d6328a4a159b0d2
SHA1f3dbadcccac5a2c38617d0a20678559308eb91db
SHA256a7bea938c9440e5a6063496676b6b1e85d5f581a8f2f9e29ed5fc563b18a71bb
SHA51223cace5da1ed5901e9acbe9431fd46eabd1608ca4bd461788f6ba619dee096c4d2d7c8643e7e7352fe54faf5b5f771d06cba142ac3b8ce91c2192ab30967badc