33b184e58f93b2743c1a68fc9c33f80974820b753e8b4bc223e17208dca8cec6

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2024, 17:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a8f95a80cb276dd0659c063e45107b8e_JaffaCakes118.html
Size 4KB
Sample241127-wctmlatlez
SHA256 33b184e58f93b2743c1a68fc9c33f80974820b753e8b4bc223e17208dca8cec6
MD5 a8f95a80cb276dd0659c063e45107b8e
SHA1 a32521c1a709283e5e0c944fe16249664d8e013a
SHA512 703c425944088a2dcb1f8d5a2701d56fdaff2e309222b0c2cb64a65a5629d9f03ae0021461e7955f0da6746e50e6f22f365e9e13fb96a239e7bd6a2c8f55ff53
SSDEEP 48:t8rXELThla+KyvLC/JZavtqdOupiOSqCZ3qQk6kkmkTTi1Nakpn/PC1gZy:cE/IKLC/2tqdOupixqCZ3qM85qT
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

paypal discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand PAYPAL.
phishing paypal
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3508	msedge.exe
3508	msedge.exe
2036	msedge.exe
2036	msedge.exe
4812	identity_helper.exe
4812	identity_helper.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe
2036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 4816	2036	msedge.exe	82
PID 2036 wrote to memory of 4816	2036	msedge.exe	82
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3376	2036	msedge.exe	83
PID 2036 wrote to memory of 3508	2036	msedge.exe	84
PID 2036 wrote to memory of 3508	2036	msedge.exe	84
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85
PID 2036 wrote to memory of 4704	2036	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\a8f95a80cb276dd0659c063e45107b8e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa569546f8,0x7ffa56954708,0x7ffa56954718
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,11861637395355785077,1724483248741577513,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,11861637395355785077,1724483248741577513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,11861637395355785077,1724483248741577513,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11861637395355785077,1724483248741577513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11861637395355785077,1724483248741577513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,11861637395355785077,1724483248741577513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,11861637395355785077,1724483248741577513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11861637395355785077,1724483248741577513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11861637395355785077,1724483248741577513,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11861637395355785077,1724483248741577513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11861637395355785077,1724483248741577513,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,11861637395355785077,1724483248741577513,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5416 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574
MD5 e55832d7cd7e868a2c087c4c73678018
SHA1 ed7a2f6d6437e907218ffba9128802eaf414a0eb
SHA512 897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66
MD5 c2d9eeb3fdd75834f0ac3f9767de8d6f
SHA1 4d16a7e82190f8490a00008bd53d85fb92e379b0
SHA512 d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 189B
SHA256 045646bc1a87f1ce57c87ba8a6ed5332e36f71e667ac712be1df2fef80385f8f
MD5 efd079652ad21c50d69ad30ccf61a40d
SHA1 000bc74057bb6ab42d2a160349e1597edb211bc2
SHA512 35f643af8bb12bb445e3e6ce7577376dc69010ddf8d7e76752d703cb50f091bdeb9947b9718baa6e9e286d69df19a794522e446f29d58dc26dfea571045f51ab
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 16dbc9ab23d455f9881fbc67052cb4ec759c14fde4e3707280bb0624aad7b13e
MD5 ba0538c3daa6735ee21e6f4bd11ec7b2
SHA1 79e38e5480c3d4b70998f3f57adf6d60c03ba301
SHA512 eaddcbebffd77c7c88b975d8b0cc9590a56a042fd70b39978af31196e5f5ad05ccef662a22b06b52c3780cf9a27f11a4d9df783958fc5fcbfcb045e89be73732
SSDEEP 96:nCDk8S31DcPfkwpvWMoiVmdeHyc712UWQyV+VDCziEwb:nokl1cUGWMXIro
MD5 SHA1 SHA512 SSDEEP

Submit Download

b3c014ff-7930-47ad-a19f-30bd0f17232e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b3c014ff-7930-47ad-a19f-30bd0f17232e.tmp
Size 6KB
SHA256 bf688c09d4a6c6482ee3d26c82cde2030e011132f271f297182d09a434e112b6
MD5 b2a717879b497a66dcb5ce5aeb442e5d
SHA1 86823933273b050c3f8835a6b3790ad2417a1116
SHA512 688e93f624bac1e9a79b643084a3aa931ae91abf05b6c7b993f03fe61a4b3d4036d3d5cdc590986fb911a28c2d8a376d83ba9fd4a9d6a0cc12a5727cc7fc4891
SSDEEP 96:nCDkcS31DcPfkwpvWMoiVmdeHyc712UWQyV+VD7AiEwb:nokF1cUGWMXIrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 e32cbb73753b7d9dcbb35cbeba42e34b2aeaf10ba4f8762470e7dfda68eca237
MD5 e50f2550fdd387dc1012387c61b650f3
SHA1 7359de97b586358af29f0f2570e6057e407c27fa
SHA512 446e694a963017b2843a09abd66602ddee1b621d3424b3815de35ef1683f2c8cb8277c28b7d5a1675bb34d9d495c8c5cf814ccc55fba465cfdfa3d26ad8c60f4
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupGee2RUt/p4z8YdF980JQwY:A9iIxuERzA83h09RZxYT8I8Yi0Ysu
MD5 SHA1 SHA512 SSDEEP

Submit Download