39c427ecf83e1f4e1e4e1194c3111e70db18fe4a9f59b1665366f87e2827a7b4

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1f04e81d73a383aa3f2925efa4e877fb_JaffaCakes118.html
Size 11KB
Sample241008-cmfnyaxglb
SHA256 39c427ecf83e1f4e1e4e1194c3111e70db18fe4a9f59b1665366f87e2827a7b4
MD5 1f04e81d73a383aa3f2925efa4e877fb
SHA1 8c8c4f81c79cec33ee9baed4c27c5a0f4354b485
SHA512 c6906a8d8ca048a11e77fefc73727999e18e75da31b49fba2c56ae73062227a290a7915e032c20a870c5b74939674d8ae98303cb16718ac36716ea827ca37c3a
SSDEEP 192:OgmooM4gsJjFqZrhhlOS5hszGJW5op4yz/yN6m6ELGzaHTcewL+Q3C1IX/2WlRM8:OkmZ+h+S5hszGJW5oT/yNmbzXq8
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

paypal discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand PAYPAL.
phishing paypal
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe
4428	msedge.exe
4428	msedge.exe
4620	identity_helper.exe
4620	identity_helper.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 2956	4428	msedge.exe	82
PID 4428 wrote to memory of 2956	4428	msedge.exe	82
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 3308	4428	msedge.exe	84
PID 4428 wrote to memory of 4324	4428	msedge.exe	85
PID 4428 wrote to memory of 4324	4428	msedge.exe	85
PID 4428 wrote to memory of 3764	4428	msedge.exe	86
PID 4428 wrote to memory of 3764	4428	msedge.exe	86
PID 4428 wrote to memory of 3764	4428	msedge.exe	86
PID 4428 wrote to memory of 3764	4428	msedge.exe	86
PID 4428 wrote to memory of 3764	4428	msedge.exe	86
PID 4428 wrote to memory of 3764	4428	msedge.exe	86
PID 4428 wrote to memory of 3764	4428	msedge.exe	86
PID 4428 wrote to memory of 3764	4428	msedge.exe	86
PID 4428 wrote to memory of 3764	4428	msedge.exe	86
PID 4428 wrote to memory of 3764	4428	msedge.exe	86
PID 4428 wrote to memory of 3764	4428	msedge.exe	86
PID 4428 wrote to memory of 3764	4428	msedge.exe	86
PID 4428 wrote to memory of 3764	4428	msedge.exe	86
PID 4428 wrote to memory of 3764	4428	msedge.exe	86
PID 4428 wrote to memory of 3764	4428	msedge.exe	86
PID 4428 wrote to memory of 3764	4428	msedge.exe	86
PID 4428 wrote to memory of 3764	4428	msedge.exe	86
PID 4428 wrote to memory of 3764	4428	msedge.exe	86
PID 4428 wrote to memory of 3764	4428	msedge.exe	86
PID 4428 wrote to memory of 3764	4428	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1f04e81d73a383aa3f2925efa4e877fb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa62146f8,0x7fffa6214708,0x7fffa6214718
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,12555662000446645445,15889036867080443680,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,12555662000446645445,15889036867080443680,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,12555662000446645445,15889036867080443680,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12555662000446645445,15889036867080443680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12555662000446645445,15889036867080443680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,12555662000446645445,15889036867080443680,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,12555662000446645445,15889036867080443680,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12555662000446645445,15889036867080443680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12555662000446645445,15889036867080443680,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12555662000446645445,15889036867080443680,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12555662000446645445,15889036867080443680,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,12555662000446645445,15889036867080443680,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32
MD5 6960857d16aadfa79d36df8ebbf0e423
SHA1 e1db43bd478274366621a8c6497e270d46c6ed4f
SHA512 6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841
MD5 f426165d1e5f7df1b7a3758c306cd4ae
SHA1 59ef728fbbb5c4197600f61daec48556fec651c1
SHA512 8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 419B
SHA256 423129e3521586978f28a5cc591d59ef345555e4adc0afd0502fa3ea9328032a
MD5 b4b25e97559e501a38156f5d7dbb0732
SHA1 54749b03c68bbed87fdeebc8e69627fbd2ab65b3
SHA512 aab4d28c0171671d0dfc3cca7a10cfdd035cd711cc9be0ed374aa9c7155686789535552bef080a9061c13659e9b92b619b316dea8f399b83838196e8af61a1f2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 12089db4c88da9dc5c0bd252920b339e69c3f88ea44821997baf1422664be02f
MD5 c960a53f48978f9265a35460ff3fe6ed
SHA1 373baf5997d6d8be1f6a02a36d339ad9ebb408da
SHA512 b51c5de4a572c8c38fe22a139394206db4eae3262f8cc9fc5420d5b73d650c5a408538d4299cba1f3f75af4c67a2e14609b808e2a34f8b4f0bc27efdf0f5da7f
SSDEEP 96:nfkZeR1UId1SnwpvWMoiVmdeHdwvUWQyV+VDCziEwb:nfkIRR3aGWMXcro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fdba4da6c35c2aedc04e2ea09b1f4205ddc58bba7578744b7d6885b01a6ebf8d
MD5 06be838e73bb12a7cdeae8432132d89e
SHA1 afbee118e35b22f442cc874e8a6b109423eac9c1
SHA512 3fe3460d454ec8896fef639c64293dc68f899d4f082e62acfe70b0921877e8d7d3e62e7e3f5f776b408ce442824487841b484e7fb8748e240a7b287d2b8eec1b
SSDEEP 96:nfkHeR1UIl1SnwpvWMoiVmdeHdwvUWQyV+VD7AiEwb:nfk+RRPaGWMXcrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 25291c72f39a08dea5d776050b77d21f603f75f22ea7b649006eda19924154a7
MD5 5aab957ee370bb6a55ec449c0d7ee7e0
SHA1 cbc6cf94fafaecdc383a41f428b20acb77647599
SHA512 e8601fb7ee8acde7d08e0424bd478a3326c1d3244242d152b28c9f7de1ca7ad97dbbcfd7f0009c8f5a5b96bbefa10a22ba3500d2c3bda35f24000c055089939b
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupH2Ie2RU6gRHlT6+B1EFJru:A9iIxuERzA83h09RZxYJkbbE3ru
MD5 SHA1 SHA512 SSDEEP

Submit Download