Malware Analysis Report

2025-08-05 19:12

Sample ID 240329-sg6wyaba9w
Target 25372a60ddd7b387d32fb1b27c025b1c_JaffaCakes118
SHA256 d0c98067a28188e95ddde1f23b2d4122259fe2e1f969aab2ebcc177f17bf5b83
Tags
ramnit banker spyware stealer trojan upx worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d0c98067a28188e95ddde1f23b2d4122259fe2e1f969aab2ebcc177f17bf5b83

Threat Level: Known bad

The file 25372a60ddd7b387d32fb1b27c025b1c_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

ramnit banker spyware stealer trojan upx worm

Ramnit

Loads dropped DLL

Executes dropped EXE

UPX packed file

Drops file in Program Files directory

Drops file in Windows directory

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-29 15:06

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-29 15:06

Reported

2024-03-29 15:09

Platform

win7-20240215-en

Max time kernel

148s

Max time network

127s

Command Line

wininit.exe

Signatures

Ramnit

trojan spyware stealer worm banker ramnit

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft\px2108.tmp C:\Users\Admin\AppData\Local\Temp\svchostSrv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Users\Admin\AppData\Local\Temp\svchostSrv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\px20BA.tmp C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Downloaded Program Files\SET1E2B.tmp C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
File created C:\Windows\Downloaded Program Files\SET1E2B.tmp C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
File opened for modification C:\Windows\Downloaded Program Files\swflash64.inf C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
File opened for modification C:\Windows\INF\setupapi.app.log C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F8C910D1-EDDD-11EE-B33C-C2439ED6A8FF} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000039e85582003590c1d6f2245577d079aeabb44499ff6283e472c771d337bf5f83000000000e8000000002000020000000f0425c1b9d8bad03d9756b9bb4aad3ff56a55e12ff050790a0bb61e907b63dd590000000c2b8f8d13f47920717caa89c5d59de11710a1b9d016fccd404b11170c012f2bfb7485bbbd8366da28477c3bf8d0f76c7ab42454355638f1e74fde086c51b24fc6c295c313d5a7a98b2fb48d7fa3adc46591fe4abcb5a6d1218936d7b9eec6b97960f41d70c62cb04acf3b4ba5eca5b22936bad11ba9489feb0ccbb4a190ca159f82cc9a370c8ce0f11be36c59e6c9af240000000a88547c5a74a8d819fffaa7602802a6668d68d80129a0aedc6f7ad003133d9ccce707d841fac09c909396fc865c1e0b9fd4ce3ee6e1e11ec280af8d5e205e3a3 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000004b125277fbdc4cbc4c1d809a18ff74e81aed42e073fd01d223df31cea4019f47000000000e80000000020000200000000c888b7f2ff48d638fd49a472f23d3fcbe5468fe765595555dc5f6b403e841fc2000000074017fb60d7e2579a5a530cc4719de58ad217a2428f8b9be6c711fd98e80c06c40000000c4e029250fc3bf35f7a2078078616d8f3db9a20a716b74d0cfc23089e7bc1bc5a8846d2b3a69ce85e26f0733286bfbf163197c13f1fdf3662671be5d45a2c1ba C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 705f06beea81da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417886679" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2416 wrote to memory of 2376 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2416 wrote to memory of 2376 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2416 wrote to memory of 2376 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2416 wrote to memory of 2376 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2376 wrote to memory of 2936 N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe
PID 2376 wrote to memory of 2936 N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe
PID 2376 wrote to memory of 2936 N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe
PID 2376 wrote to memory of 2936 N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe
PID 2376 wrote to memory of 2936 N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe
PID 2376 wrote to memory of 2936 N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe
PID 2376 wrote to memory of 2936 N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe
PID 2936 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2936 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2936 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2936 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2416 wrote to memory of 1632 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2416 wrote to memory of 1632 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2416 wrote to memory of 1632 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2416 wrote to memory of 1632 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2376 wrote to memory of 1752 N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2376 wrote to memory of 1752 N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2376 wrote to memory of 1752 N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2376 wrote to memory of 1752 N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 1752 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchostSrv.exe
PID 1752 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchostSrv.exe
PID 1752 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchostSrv.exe
PID 1752 wrote to memory of 2052 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\svchostSrv.exe
PID 1752 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\wininit.exe
PID 1752 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\wininit.exe
PID 1752 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\wininit.exe
PID 1752 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\wininit.exe
PID 1752 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\wininit.exe
PID 1752 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\wininit.exe
PID 1752 wrote to memory of 388 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\wininit.exe
PID 1752 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\csrss.exe
PID 1752 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\csrss.exe
PID 1752 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\csrss.exe
PID 1752 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\csrss.exe
PID 1752 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\csrss.exe
PID 1752 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\csrss.exe
PID 1752 wrote to memory of 400 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\csrss.exe
PID 1752 wrote to memory of 436 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\winlogon.exe
PID 1752 wrote to memory of 436 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\winlogon.exe
PID 1752 wrote to memory of 436 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\winlogon.exe
PID 1752 wrote to memory of 436 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\winlogon.exe
PID 1752 wrote to memory of 436 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\winlogon.exe
PID 1752 wrote to memory of 436 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\winlogon.exe
PID 1752 wrote to memory of 436 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\winlogon.exe
PID 1752 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\services.exe
PID 1752 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\services.exe
PID 1752 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\services.exe
PID 1752 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\services.exe
PID 1752 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\services.exe
PID 1752 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\services.exe
PID 1752 wrote to memory of 484 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\services.exe
PID 1752 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\lsass.exe
PID 1752 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\lsass.exe
PID 1752 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\lsass.exe
PID 1752 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\lsass.exe
PID 1752 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\lsass.exe
PID 1752 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\lsass.exe
PID 1752 wrote to memory of 492 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\lsass.exe
PID 1752 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\lsm.exe
PID 1752 wrote to memory of 500 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Windows\system32\lsm.exe

Processes

C:\Windows\system32\wininit.exe

wininit.exe

C:\Windows\system32\csrss.exe

%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\services.exe

C:\Windows\system32\services.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\sppsvc.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\25372a60ddd7b387d32fb1b27c025b1c_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe

C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://get3.adobe.com/flashplayer/update/activex

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:209931 /prefetch:2

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\svchostSrv.exe

C:\Users\Admin\AppData\Local\Temp\svchostSrv.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 download.macromedia.com udp
GB 104.84.90.194:80 download.macromedia.com tcp
GB 104.84.90.194:80 download.macromedia.com tcp
US 8.8.8.8:53 fpdownload2.macromedia.com udp
GB 88.221.135.209:80 fpdownload2.macromedia.com tcp
GB 88.221.135.209:80 fpdownload2.macromedia.com tcp
US 8.8.8.8:53 get3.adobe.com udp
GB 95.100.104.4:443 get3.adobe.com tcp
GB 95.100.104.4:443 get3.adobe.com tcp
GB 95.100.104.4:443 get3.adobe.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab18D0.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\Tar197F.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\swflash[1].cab

MD5 b3e138191eeca0adcc05cb90bb4c76ff
SHA1 2d83b50b5992540e2150dfcaddd10f7c67633d2c
SHA256 eea074db3f86fed73a36d9e6c734af8080a4d2364e817eecd5cb37cb9ec9dc0b
SHA512 82b4c76201697d7d25f2e4f454aa0dd8d548cdfd3ebfa0dd91845536f74f470e57d66a73750c56409510d787ee2483839f799fef5d5a77972cd4435a157a21a4

C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\swflash64.inf

MD5 60c0b6143a14467a24e31e887954763f
SHA1 77644b4640740ac85fbb201dbc14e5dccdad33ed
SHA256 97ac49c33b06efc45061441a392a55f04548ee47dc48aa8a916de8d13dabec58
SHA512 7032669715c068de67d85d5d00f201ee84bb6edac895559b2a248509024d6ce07c0494835c8ee802dbdbe1bc0b1fb7f4a07417ef864c04ebfaa556663dfd7c7f

\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe

MD5 47f240e7f969bc507334f79b42b3b718
SHA1 8ec5c3294b3854a32636529d73a5f070d5bcf627
SHA256 c8c8cff5dc0a3f205e59f0bbfe30b6ade490c10b9ecc7043f264ec67ef9b6a11
SHA512 10999161970b874db326becd51d5917f17fece7021e27b2c2dfbee42cb4e992c4d5dbeac41093a345ad098c884f6937aa941ec76fb0c9587e9470405ecb67161

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8661a7bbfce9f0891e17f015d7d26320
SHA1 3525835a18f632da78a15da424eb1e6cc163a545
SHA256 15ccc6436fcff2ff8ca8b038bfeee6e4dc91227efc60d7be12406dd953999757
SHA512 3e894ca227e1b5d62682b371429bc734f9bd88d452795eeac6b66a6e90360d4ca59fd860d894372f67f1de0da41bc387317074d2c44301ed0a01f0bc6bf62f91

C:\Users\Admin\AppData\Local\Temp\Tar1E7A.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9cf03e702c532eaa9d06775ad641f972
SHA1 252f8be44605701a717db33c2d99e662f7fc7e03
SHA256 7762e61b53dce9c28c126860904ec4b82e27ab944cfbe9c318e26978401c22c8
SHA512 834e108fe5d630f9f42f80f11a547e8b1d2bf661a6ab3e1c3e0494a919a0823a13392b5b6c2d482511ff083c10944ca48ce489dbcb52c4bc319c664886f6ef4a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 96d682251497c26d65839461767e9899
SHA1 86fedf60d9ce77368698e6fed1a83200365fd169
SHA256 280b921d02fa101b55d6961fd61ce0c5398b2479102613eb53a21111bed1a76b
SHA512 7f536a75ac98feaa8ad2f596a871e02b85f30db5ccd9a1ddde525ba63033c3fcd036cd793405e8b5e5b7958a8fb2e05135fcff1c3396376ab319a9ce2fa08da6

\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 085e036d523f1dee1037d07190cc0fca
SHA1 64473c83e6d6fddd55d90bfaa2f212306d3dffcd
SHA256 3dc6730bafe1af190a9cf2e2830d9d767e79f5c6c5c09502d6fe17030844e255
SHA512 cc1d987a8ab304dd27423192bff19c9d2aa21a14a9ad15646dd1bfa9a439f94c5f444f5f7d53353f6f7f43b9f95a89dedab09af9cc7a35215c6de0fe3fadb8d7

memory/1752-191-0x0000000000400000-0x000000000044B000-memory.dmp

memory/1752-206-0x0000000077BAF000-0x0000000077BB0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchostSrv.exe

MD5 18df0fff08f1c3290f98d9c2eee9d959
SHA1 96ad52a9d9f23d5edd5788c49da1bf1e2f0519dd
SHA256 d2c96c5bd5959e58998aebd8a05f21f88601f598a8b1b838dfe24a33c41538c9
SHA512 2652623faa0b8e14cb43129c376d559e3c63190981c40b207336228dcf83dd215673ecddb9b574b46d6da73ebe7027f1a845fc85995a060d8cb3b6a8f64414a7

memory/1752-208-0x0000000077BB0000-0x0000000077BB1000-memory.dmp

memory/1752-209-0x0000000000280000-0x000000000028F000-memory.dmp

memory/1752-210-0x0000000000400000-0x000000000044B000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 948fb7c3a6f2970b1895aa4fbf39b4b1
SHA1 ce459b53514b0b70e9073b3712a7698d9cdf9fff
SHA256 267a5efff9da2bb3992d769faf954bf3e98f17c1775604260d3755aeff6aa08d
SHA512 043c3b58efec9393e1739fff5e6b3d689e838255b954420397719b6559fa78036794c2a4c1c43f7a8f39c05028e5509a642f8b6a179c362eb0dd01817a4fec98

memory/2052-211-0x0000000000400000-0x0000000000435000-memory.dmp

memory/1752-220-0x0000000000230000-0x0000000000265000-memory.dmp

memory/2052-235-0x000000007EFA0000-0x000000007EFAC000-memory.dmp

memory/2052-234-0x0000000000400000-0x0000000000435000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 abef6047eef5ac00436c5bc6f1d20f45
SHA1 4c1c41ee600d5cc570beb2df59aa2fe0e8fce61c
SHA256 e8312afaa87bffdeb0a9b45e4148ce26f8b45845616fb135afcccf4dee4352e7
SHA512 fb63fb257300c78a5d2b0880c1e51210ae4eaeb389d217680aeaaecfd389cd2c831028aa437317599b4694df91e10f5bf9b1e7fd1a8f460656d091dee908555e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 afc4496c45740c7ff1deffe05b39f58e
SHA1 070ee19dfa90db9e550ecf2202972b050bcfc343
SHA256 e369e6db884f8455a25119ec6be1e88e62e390b3c0f92b619582e700331d3254
SHA512 3dc86f11346dedee07ea469cc3394468328f26412ac0a4ac51c1305ae184e07fc4c073effcfaa85ee9e40421fc1bbddf7555b19a85d94db86d928af4ecafed6d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 806b637c6df97439f515fe9cb580e365
SHA1 6715622188f15f640f5ba7a141b5f57b23ade594
SHA256 95cdf170eb521a3606c49a0f3318a99f5fcd0f922c22b93b1061688878d2dcf5
SHA512 5b1e56be010791add568573216260fea64d0f1885217d5a67702916c5af226a6349c033d7157cfa82b7b5a0ecd041b0a6857a5b056d130267c02c3665977a803

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2f2a6cba055b445cc38ec53799bd9b11
SHA1 05dd9981b63e62e907cc7fc9f736675eba1232e8
SHA256 0c0c4b7f2353223fddeefc82e382ef0f5b6e72257e9565cf79b6cbd8455f0819
SHA512 5f34469b08ab660d6dd6fe4a6b435632cf84c84c1c02d30c8a6d43809fb791ac0301abc3381fa3e0a845d64fef1fd142b62095f472654e5bd6d8a8b43a68346a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 626d9dd0ae44d96cb92175fb73e45785
SHA1 af6db347101d48aed4d2ea12e6cf3a1da42073fb
SHA256 3e7a58b8acc3e8abd23937aeccabf3c008f1d2cba43388ce82b68768dbf4ab31
SHA512 d22c6aba11c014a98d371dbf6790b6170888e27cef35c4f1a76a717637785105badf4d66c8f73d4f1547ed0b84925e08aa78a4d866c5a0765e79266ec7f3089a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2279beb87b9f3896dd1e7587ddbe7aff
SHA1 bd6b40972f7929c56df8254e6463e9ecf763cf92
SHA256 6102957631a7419c07887444bdbe9c4c3d1eb0691990bbd6e85cead72f282fd6
SHA512 c0d2f216d9ce2e993f3813b9e69cf1526f616602080384ea795754d580a72a431b9143045608717e32226f0e8ec6b4075ba3091a0b7ede8c06aaaf5c58356d85

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c3fd539db0e7768bb3f90b57f206ee9c
SHA1 20e75deadde2b68b4356684b5f6c44ff07f5b4c4
SHA256 7059c316e5a0903f8c88bfb02315c06f7b1399541f88c8ee5d054f899165531e
SHA512 d933cc663737604a1b823e326728ec5b3b07d3ff126fd7c4eaed25fd6d2005e52a222b31491c5b3a0d0809214c247444cdf641681049e0afc84be099b4cc395c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2e4099b27ddb31e18918ef7081116568
SHA1 5a86b7b75353fedef610f145799ad771b0256e7f
SHA256 032ce20fb4c2facff9abf27d9a77b37d01a6bba19919cc4d66b15ca92bca6927
SHA512 ecad60a69ba2d1a5271417942445e79664a386decd9b49079469963d7db3cedc238f837090060f57d6063ed830f568a50d912bcd3398c633dc2fdf663a7e2f22

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 611227b46e54d8ede9bdd3693130cc49
SHA1 2b5e5c4fd00acc4ece4eada31f8bcc6fcb2d0175
SHA256 f85eb905c0034f2b7da2698162079da3450882d7e18a06aeb2df3e80501932b4
SHA512 e5c0dd829db97941fba09ad3be5b99662f50988b4befc15f92d714749931110b372ddab3724a2d0f4e784a895ab152e8315eef10c871b17ba7c5cc4a4d84f6a4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7af13b95fc9360f4fd38b68eda671cd5
SHA1 6fede89e59f0d7790e82e41a6f49cd1f667481a8
SHA256 6ceb450c1adc85360254024546feb2201d3188a840b319114a930ca8f035c889
SHA512 d59718e2ffd5d6df0a66cc48a87047d8bb889c5c44a02bb822b765cf14351ba0067a829fcaf72e10a93139f0fefbe27da7bd376cd7d893ed467f621a86448e91

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2e2f9ee5666c851ab0ca6caaad4f7cc1
SHA1 64ae321849239377699770c8c32fa9ec8c9c6337
SHA256 26853d2640b8520c81f115c763c4d129516103f156b38f6aac862ede73fbd5fd
SHA512 d15f2b100244d5db094a11d3881a1445e3aed536fe0507b44c3ee8bb79dbac550bd40c807c08044eeb9eaafc2bd4757104b8d4aee021c2f80435d326c610d394

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4d75da3b4d7653b0ad2fea3f5128a63e
SHA1 c3d92409f4348cb85edab6956e1a8fa6318efb41
SHA256 0f52587902e0c79a69b52b2df31e0dded04eea27655b05436909bd6dfb620491
SHA512 0d3a11d23025dc2fcf1373d8353e3c2f622ae6d227a0179d51a7324000b043a116458264ad6f12bf4630f303a6161c48b3269958458c89279ca9bc4ae487d8f8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a7bba82879836c2df4e99c529c3a904f
SHA1 3bfcffed0ee434ffd166bd687c302f80a31d284c
SHA256 0e016060dbc85804808b8d36959857fd5b75d1ca5461bdc65a917b023bf20043
SHA512 dd89255a1304a8af78c0935e4c3adeb1ed519a96e8560a6c2c1d2e1dc4f0d2d080f59298ff22275bbb6179dab5a8228a7271a349e09b937a4b4768b3ffdea16e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bd21a4af4f20888fc14ad594fe9d44f3
SHA1 a3361004e989b651591ca6ded3947a52e98276ef
SHA256 1b2b9848d3504763a8869ad68beda42fc08cb0854b11a50882b1be91cd960fd7
SHA512 d3036e06c5d1cba65ed390a88ebe3b424d008753b8678e5f4a7a08b51012404d68373d67ad5107cfb2feee225f14433964f059f815588ed45e9a532e4e4b4ff9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9fbc2f806c236de1015c0b8b5de74ad9
SHA1 ae727e143101aaae928303939f5d77077057a428
SHA256 807bd0d9eced4158b77c3c1e19c29f605c397814290ebc1a1b6d085235ef2e46
SHA512 42cb8ca45e690e37a48d54c3cfb26f90d2a945521d19f7a26273fcc32d7263759643b2a75340bfc7251dac9e3e06beee370beaa36626ff39346ab8216933e681

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a76891e6b58bdb35125d6b9fc5e172f6
SHA1 3203ea9e90373070442ffed4e8f4e023f3e7a5ed
SHA256 cebbe5cf52e2d89171ede4ce2d67a481472aaa91edaa426a4e5bd30890c582b2
SHA512 2d179031428f06d613f92c42baad6a612038e108948e73194a7ce71eac953cd442cf42b63e5c9cdf73c15585a4cc9b4972bff8e58ccd8e91957032bf825d5b26

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 85ae9a9fd9b2c26482dc108fab641db8
SHA1 b8826f952b1a7db269a7858ecf2b651be96350e1
SHA256 b3df68f15626f8ec4bcc8823f2035092d57228ed0ca432fec038488b60c262e8
SHA512 e4e092e9c54ebcbb269697651143b506e8e69d1da7b85880bbfba52003949deff1dd44115ea7c986da3ebd1075f62d5fa21dbee8d2e444c15fe7409aaf673e7c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c5e4cb0cfd80e5103205ac00e1019f36
SHA1 0d0220dc96a60e8c61cfbdc5720278737baca849
SHA256 279d0490121243fc804f7c0a13b6667553b2e18afab0cea8b6cd3c467763c002
SHA512 be6ac097b53bd87473b7d12f17c0e35569783991c58955aa80c75ee77e036909333702fc49bcff653e7241bdc0ee31fa021cb9a7490a7f8a6e12ca4df6d967d0

memory/2052-1000-0x000000007EFA0000-0x000000007EFAC000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 92de6383a016944463821252363c602f
SHA1 813755933f6224887d73ea047a3996bd4f279dd0
SHA256 424c801dd050cd1a88c5384e7e5377b0a66843119d79327060ee0c5364972df2
SHA512 4d25d4e3bbe43ab43d2475ae219b4333ab97e8636207f205145208889432499ad88b767347cd582df2d7c0921f56dd10fdc6edfde6584eaea8fe4cad21bdfd27

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ecb591132fe6418918762d426a7fbdb8
SHA1 e85381f2f4bb7483f9ae3ce4f9498c95c4cef98d
SHA256 05ce8906aef25cf8e255aab6ba52c66e9c093a427c4a29964ba1d174c86f3025
SHA512 602e18d3816d483c730817e57c63aa10fb45ea44829ee5db277f7aeafb2cbc18438515a84d3c37bd56e2730dee7f2b416215860f7b1070ea05e880a0dd969c06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 4009eae4d3416abc592a149e6bf92719
SHA1 d8a91e9ec8d7680b24dcf3332aeb914af35ea96d
SHA256 863b7af1e6c3eeec238d7ee7ecf491a7c62ee7d1452f3caab7d69714b2579585
SHA512 cf32711c471ea60b32d793daa8e150756db3ac2fbca410b8378b3023d92b2cf450efba6146734e7583cc4f4098b6d04f95d2aa7c749dbdbad5e1eb2f209d8611

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a2887f3ef86daa2c86ae68a0c4de3edf
SHA1 c7cfaeb4a09aca9036f9f77da0fd6cca1b12c61e
SHA256 801aa4c950388983ce179b7976d778cc9c7d04e61e3bac7d6bba33292b1fe749
SHA512 60cb13b29445761635a5cf983ed248cc9d7bb67a05668fc5ab1459286e5cf6f8b957a30a72fb01e2b35eb0e54da0fc84b77cc42426232992174759cd137ff5e7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0482cda73a4fa71ab5af238340866b78
SHA1 60f6698099e2d769decbf6a4466c383980a70bcd
SHA256 f2272eb6281e2c9a6e16fb9b4963182521e4e60934d7102f3eadf7e87e243e1b
SHA512 4fdab8958deda8f88e3db95818f72e3451ff2ebca02615713d16082426fab802c61463ff9813ead4905df0aa9a03947f416645f7d3d1c11cb85b554cdf5d0d2a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 863d78300865b69f6d09f49217175548
SHA1 f7a8e445e8c08fba8fe8bbfec79ee23b9d749d0b
SHA256 45b13e196513affb985854c21e474b343b820002a6c03fae62d2af2359f03727
SHA512 3aa14f0b1b00e78cf116d9c2ba0d9eb6c1b6d3911852aeb3524179ff8697059213f9af9c8140c26c9c54c6dc6fb665cfc5c700f57b96acd289ac2234fc85418e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 556f3555be8592798a49ad9f9d2c4158
SHA1 3799b2497150bd5a18b770f7a9d76ddce42c5517
SHA256 7366b390cf561c4c74c08e2c0fdac0e1afd322b6fb50a83e364f208db0beaa1c
SHA512 7dbffe2ea2d0b732749b33f6666bd82b9465d2fcc55be53841c33187dde51588758c204247888fcdc1c2d99c9bb6ebb10761e81b44843763f46224af55de90a8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 ab49931ee2e5951ec94f6bb22bf48d1a
SHA1 44c427403c4c6541fbbb509f722a0569b70444f6
SHA256 ef5c4cfabed977c2ad67decc07829678d7df8a8d194a23420f007d7baa4d05f7
SHA512 d322d80d11dba99d9e5255606d6639c97f31caaafd98888e60ad975ecd2846be882ba07f83d2ed8b4df76a07ae96898691caae38c846e65ddbbd10e652b16cbd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 522bdb28f6f18ee90eab00d8c580335f
SHA1 8fcf3380007a992f7cc507f156185a6e56c17ce4
SHA256 376e5a4f34ee3b8d2cefe1467a4399585f9a09ed7960bef1ce4015e8225624b4
SHA512 3d343f722c94a0202ccb1b60d537196c94e3e676750b5e1f7dcbe16e6608a4a6abfd90e7fbd285892f188e124a334800723421414670c5d751e40be800202613

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 422479a4617e01633d5d373982247d95
SHA1 46f86fe3d39212ad94e0322dc1e99af6151ee612
SHA256 d71d61e4db6a9c8d97be04923782d66ce26f75f57c19a4a4cf5e2c1773501ce7
SHA512 8bc97b4f971061b546fafd7eb395adc7a5d12c0bdd375bee1efa0ea865f59e04653fc40daf557c8952dd8ed71e3c44c205760ea98eeaabda46c28edfa4dbf2f7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d9eba2505a1e8963cadcf7f78486d4c8
SHA1 83cc4f9cbbb3f2f972b31c72058aa1f9959307c8
SHA256 8cdcc4f648b3fd257bf55ea510023678b4a87a8b839769bd7eac9961d4b0515c
SHA512 6573689ea1894d9930a9658df068a047f912dad42076f225a33beb5b7ff24e916c9ce02886b9817dafb388c825b72fe34fc75c928d24e02dcb875a4770e54dab

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b32ccde1584572a6511baf2d1eccb78e
SHA1 93c076b6b024de01176aad39eaf2fb1c2c704255
SHA256 9aa5920d123529281b0df1ab21464677899c621121dd7babdf6f7500157da140
SHA512 fc83d48363ce2a7d0c8cf003bb8c04fe4212033a89f99dde4f4c81476ba3e9ec705f45ed230a699260d1a59f4f972217347e543dceb1d7160a61e6af9d8b96ce

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-29 15:06

Reported

2024-03-29 15:09

Platform

win10v2004-20240226-en

Max time kernel

129s

Max time network

142s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\25372a60ddd7b387d32fb1b27c025b1c_JaffaCakes118.html

Signatures

N/A

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\25372a60ddd7b387d32fb1b27c025b1c_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=5384 --field-trial-handle=2588,i,4353937220825226770,7138584070663735671,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4860 --field-trial-handle=2588,i,4353937220825226770,7138584070663735671,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5348 --field-trial-handle=2588,i,4353937220825226770,7138584070663735671,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=3516 --field-trial-handle=2588,i,4353937220825226770,7138584070663735671,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
GB 172.165.69.228:443 nav-edge.smartscreen.microsoft.com tcp
US 13.107.6.158:443 business.bing.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
GB 104.78.177.227:443 www.microsoft.com tcp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
GB 88.221.134.17:443 bzib.nelreports.net tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 227.177.78.104.in-addr.arpa udp
US 8.8.8.8:53 17.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 155.136.73.23.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 20.189.173.22:443 nw-umwatson.events.data.microsoft.com tcp
US 8.8.8.8:53 22.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 13.107.246.64:443 tcp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
GB 2.18.66.65:443 www.bing.com tcp
US 8.8.8.8:53 65.66.18.2.in-addr.arpa udp
US 8.8.8.8:53 41.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
GB 2.18.66.163:443 www.bing.com tcp
US 8.8.8.8:53 163.66.18.2.in-addr.arpa udp

Files

N/A