33b184e58f93b2743c1a68fc9c33f80974820b753e8b4bc223e17208dca8cec6

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2024 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8f95a80cb276dd0659c063e45107b8e_JaffaCakes118.html
Size

4KB
MD5

a8f95a80cb276dd0659c063e45107b8e
SHA1

a32521c1a709283e5e0c944fe16249664d8e013a
SHA256

33b184e58f93b2743c1a68fc9c33f80974820b753e8b4bc223e17208dca8cec6
SHA512

703c425944088a2dcb1f8d5a2701d56fdaff2e309222b0c2cb64a65a5629d9f03ae0021461e7955f0da6746e50e6f22f365e9e13fb96a239e7bd6a2c8f55ff53
SSDEEP

48:t8rXELThla+KyvLC/JZavtqdOupiOSqCZ3qQk6kkmkTTi1Nakpn/PC1gZy:cE/IKLC/2tqdOupixqCZ3qM85qT

Score

5^/10

paypal discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand PAYPAL.
phishing paypal
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	Process
3508	msedge.exe
3508	msedge.exe
2036	msedge.exe
2036	msedge.exe
4812	identity_helper.exe
4812	identity_helper.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid	Process
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	Process
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 2036 wrote to memory of 4816	2036	msedge.exe	82
PID 2036 wrote to memory of 4816	2036	msedge.exe	82
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3508	2036	msedge.exe	84
PID 2036 wrote to memory of 3508	2036	msedge.exe	84
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\a8f95a80cb276dd0659c063e45107b8e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa569546f8,0x7ffa56954708,0x7ffa56954718
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,11861637395355785077,1724483248741577513,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,11861637395355785077,1724483248741577513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,11861637395355785077,1724483248741577513,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11861637395355785077,1724483248741577513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11861637395355785077,1724483248741577513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,11861637395355785077,1724483248741577513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,11861637395355785077,1724483248741577513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11861637395355785077,1724483248741577513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11861637395355785077,1724483248741577513,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11861637395355785077,1724483248741577513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11861637395355785077,1724483248741577513,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,11861637395355785077,1724483248741577513,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5416 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
189B

MD5
efd079652ad21c50d69ad30ccf61a40d

SHA1
000bc74057bb6ab42d2a160349e1597edb211bc2

SHA256
045646bc1a87f1ce57c87ba8a6ed5332e36f71e667ac712be1df2fef80385f8f

SHA512
35f643af8bb12bb445e3e6ce7577376dc69010ddf8d7e76752d703cb50f091bdeb9947b9718baa6e9e286d69df19a794522e446f29d58dc26dfea571045f51ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ba0538c3daa6735ee21e6f4bd11ec7b2

SHA1
79e38e5480c3d4b70998f3f57adf6d60c03ba301

SHA256
16dbc9ab23d455f9881fbc67052cb4ec759c14fde4e3707280bb0624aad7b13e

SHA512
eaddcbebffd77c7c88b975d8b0cc9590a56a042fd70b39978af31196e5f5ad05ccef662a22b06b52c3780cf9a27f11a4d9df783958fc5fcbfcb045e89be73732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b3c014ff-7930-47ad-a19f-30bd0f17232e.tmp

Filesize
6KB

MD5
b2a717879b497a66dcb5ce5aeb442e5d

SHA1
86823933273b050c3f8835a6b3790ad2417a1116

SHA256
bf688c09d4a6c6482ee3d26c82cde2030e011132f271f297182d09a434e112b6

SHA512
688e93f624bac1e9a79b643084a3aa931ae91abf05b6c7b993f03fe61a4b3d4036d3d5cdc590986fb911a28c2d8a376d83ba9fd4a9d6a0cc12a5727cc7fc4891

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e50f2550fdd387dc1012387c61b650f3

SHA1
7359de97b586358af29f0f2570e6057e407c27fa

SHA256
e32cbb73753b7d9dcbb35cbeba42e34b2aeaf10ba4f8762470e7dfda68eca237

SHA512
446e694a963017b2843a09abd66602ddee1b621d3424b3815de35ef1683f2c8cb8277c28b7d5a1675bb34d9d495c8c5cf814ccc55fba465cfdfa3d26ad8c60f4

Download Submit
\??\pipe\LOCAL\crashpad_2036_WZHDGCKECMTEZRKX

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit