9823777b744244502ac7b40c6b4783652ddb3bbfa23460013a6ef92bbd50f02d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2024 15:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_249c9e35c30c2dc151725e24180c5f2e.html
Size

19KB
MD5

249c9e35c30c2dc151725e24180c5f2e
SHA1

8b2f3cfa542aaaf94e34ff013346f0069b9d988d
SHA256

9823777b744244502ac7b40c6b4783652ddb3bbfa23460013a6ef92bbd50f02d
SHA512

39e93cc7986e7214aa5d814f246e3fca34a9f245eb7c4e979c2258ae490b582a303168fe489934e77dfd3e4023dfe728fde0558834815e0ac2ff60663a5a718a
SSDEEP

384:zBqtZRsVuEc+6bkuOENbWCul0LgIssbQbDwiTkBFV1aG/a1B7rl99Ye/ZGr1h:ItZRsV2+6bkPENb/JZYDN4n+Gy1Jl3Y/

Score

5^/10

paypal discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand PAYPAL.
phishing paypal
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2636	msedge.exe
2636	msedge.exe
3208	msedge.exe
3208	msedge.exe
1620	identity_helper.exe
1620	identity_helper.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe
392	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 3388	3208	msedge.exe	82
PID 3208 wrote to memory of 3388	3208	msedge.exe	82
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 4244	3208	msedge.exe	83
PID 3208 wrote to memory of 2636	3208	msedge.exe	84
PID 3208 wrote to memory of 2636	3208	msedge.exe	84
PID 3208 wrote to memory of 1992	3208	msedge.exe	85
PID 3208 wrote to memory of 1992	3208	msedge.exe	85
PID 3208 wrote to memory of 1992	3208	msedge.exe	85
PID 3208 wrote to memory of 1992	3208	msedge.exe	85
PID 3208 wrote to memory of 1992	3208	msedge.exe	85
PID 3208 wrote to memory of 1992	3208	msedge.exe	85
PID 3208 wrote to memory of 1992	3208	msedge.exe	85
PID 3208 wrote to memory of 1992	3208	msedge.exe	85
PID 3208 wrote to memory of 1992	3208	msedge.exe	85
PID 3208 wrote to memory of 1992	3208	msedge.exe	85
PID 3208 wrote to memory of 1992	3208	msedge.exe	85
PID 3208 wrote to memory of 1992	3208	msedge.exe	85
PID 3208 wrote to memory of 1992	3208	msedge.exe	85
PID 3208 wrote to memory of 1992	3208	msedge.exe	85
PID 3208 wrote to memory of 1992	3208	msedge.exe	85
PID 3208 wrote to memory of 1992	3208	msedge.exe	85
PID 3208 wrote to memory of 1992	3208	msedge.exe	85
PID 3208 wrote to memory of 1992	3208	msedge.exe	85
PID 3208 wrote to memory of 1992	3208	msedge.exe	85
PID 3208 wrote to memory of 1992	3208	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_249c9e35c30c2dc151725e24180c5f2e.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9264246f8,0x7ff926424708,0x7ff926424718
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,863481231191056241,15938333671464628927,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,863481231191056241,15938333671464628927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,863481231191056241,15938333671464628927,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,863481231191056241,15938333671464628927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,863481231191056241,15938333671464628927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,863481231191056241,15938333671464628927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,863481231191056241,15938333671464628927,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,863481231191056241,15938333671464628927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,863481231191056241,15938333671464628927,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,863481231191056241,15938333671464628927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,863481231191056241,15938333671464628927,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,863481231191056241,15938333671464628927,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,863481231191056241,15938333671464628927,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4092 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
602B

MD5
09f30c45442b02a03196c8833a989218

SHA1
7d1872e47b8d16f63b9acd5e0a256ffd75249d6b

SHA256
27bc8ca01bda28484be0cf1628c3e1fee819de324fa5c77359a90d0c4bee07c3

SHA512
4b81030ad8a3ac1368c8c5f14d180c9cbae125f21ca78252c53a633c35e0fbc6cb9e2212a53e85db6ee5b659bec95271a7c598ffeea809511c276f1d39d67369

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
061a35b9d54d68f4d88ea13dbbb04dac

SHA1
1ae26c8fd8c5f7663a8127dfdb4aa4f715c6bb1b

SHA256
1afb206861b403061308bf796c2a493467e2c84efc97803a0dbaba806652b287

SHA512
57869a5af50e57fdb4f7db9a1496b02a2029c3336e411f949597b01257c3f7688ef616a3b730fc9f90ae5445146b343a598d9931e8fd2361069a5b24ebd377db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cb7526e3f7766600c1fd76a6ed3a8e49

SHA1
c661a3e52ab507bef08b7b3088355b9f8fc04172

SHA256
c712849f232fde603212c00711549121f503a38a908589bec00ee878643d41d8

SHA512
dab0ba66e4b2910541d537308756844d160d08d95d1039fae0e3ee10d2ca03c174839c4a726ab4e8dae341e700a46f513ab967f51444f353bd88d4ec46d20f74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6be5ff6cb1960464b9f47f787b4e0cfd

SHA1
6fa271f7b46f715fdf235df652aa6a302f1e348e

SHA256
dd6a7632297ac45e2636ffec95b8346e74e4ddd72af5d7b63482065cf604cbe4

SHA512
f314b654aa22f77acb32c7770b4a09b26594e3af2926dc38d9afe46c7f56d40a9ffe1fad71f84d6f49c6a8b1162e2b08784800222db5a2ba62b777598e41a1a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
236bfe04fdd02142095aee90cd771b68

SHA1
139cf0394741c66cecf90d7f61dffc3181450710

SHA256
3083af6fe33a071d1ba13d3e76516c27cd8ee51c3da5f922f7daa05d1eadccf5

SHA512
739e3a0b2f027ab9846364a49c08dc080bcad27dcac45ce4b31318f5253cb549f2b05d3aea98c035469931a6c50c74db5108c796bd03491ce02fa29a99f49ef7

Download Submit