Malware Analysis Report

2025-04-14 00:57

Sample ID 240530-q892kaca47
Target 84625eb6c817bd40375f559e5447a835_JaffaCakes118
SHA256 c6fe330e8cb071a105f1aa22a79bb3e70e51ae79b3995205f90ba2f31fb52d7b
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

c6fe330e8cb071a105f1aa22a79bb3e70e51ae79b3995205f90ba2f31fb52d7b

Threat Level: No (potentially) malicious behavior was detected

The file 84625eb6c817bd40375f559e5447a835_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-30 13:57

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-30 13:57

Reported

2024-05-30 13:59

Platform

win7-20240221-en

Max time kernel

120s

Max time network

135s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\84625eb6c817bd40375f559e5447a835_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8ea3e7d6759b34c9814e846d1bdc3ce00000000020000000000106600000001000020000000e30ff6070770ba44e1e66e942eefc264dd362850940e433c9d7c0774a29a7931000000000e8000000002000020000000465b43da26fabce46b92c78f164b7bfb37c5c4ecbf0d6e3922a77dcefddb872c200000004825bde6fb74f27ba16e0247450f5fba521b6c4a6a951ead67488e0e1153e2764000000025bed75b634f4b06acd8aca3ba69802ce7281796486451304172b23f8572fd4d975def1e456a6da671ece3722209268a7ac6a44469f5c675fe8af60d1b4cf644 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0943a5a99b2da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423239302" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{83F9DDE1-1E8C-11EF-A1FB-E299A69EE862} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8ea3e7d6759b34c9814e846d1bdc3ce00000000020000000000106600000001000020000000e7c86b2c36890e1f5b211fd6a44322a90eb17df728ed7935baff6355be19a169000000000e8000000002000020000000894fe3066146a32d062b069fb18c0e65f4d33e7ca297895e491b55782bcad416900000004df2672f0505f577884774b6277a0f1a4cf1b1caaf85b13ac55875c7ee873939eda51026ab1eb0204c7550949cb234f32fa12cc1edbeedf1ae38152d1c9849d8ff1d4d730c1cb24c7a71d7fb51cf0c484ac13104a768e6828b4044c178c5cac74770354d8012ca64046f840cbe232ded63c8b53e88c2bcdd1a0995630d2ea3b38f2fb82af1f4c44a15567e1b9c6761a3400000007f2899056a3b7c5675bd4507c59c17eb9b3ded36068cc3c46660add1910f8dac70ddec071ecd0877a8356744ccaccb5e30a7ee72fe77fdcd1126f07220b77269 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\84625eb6c817bd40375f559e5447a835_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 bamaco.ir udp
IR 80.249.115.84:80 bamaco.ir tcp
IR 80.249.115.84:80 bamaco.ir tcp
IR 80.249.115.84:80 bamaco.ir tcp
IR 80.249.115.84:80 bamaco.ir tcp
IR 80.249.115.84:80 bamaco.ir tcp
IR 80.249.115.84:80 bamaco.ir tcp
IR 80.249.115.84:443 bamaco.ir tcp
IR 80.249.115.84:443 bamaco.ir tcp
IR 80.249.115.84:443 bamaco.ir tcp
IR 80.249.115.84:443 bamaco.ir tcp
IR 80.249.115.84:443 bamaco.ir tcp
IR 80.249.115.84:443 bamaco.ir tcp
IR 80.249.115.84:443 bamaco.ir tcp
IR 80.249.115.84:80 bamaco.ir tcp
IR 80.249.115.84:80 bamaco.ir tcp
IR 80.249.115.84:80 bamaco.ir tcp
IR 80.249.115.84:80 bamaco.ir tcp
IR 80.249.115.84:80 bamaco.ir tcp
IR 80.249.115.84:80 bamaco.ir tcp
IR 80.249.115.84:80 bamaco.ir tcp
IR 80.249.115.84:443 bamaco.ir tcp
IR 80.249.115.84:443 bamaco.ir tcp
IR 80.249.115.84:443 bamaco.ir tcp
IR 80.249.115.84:443 bamaco.ir tcp
IR 80.249.115.84:443 bamaco.ir tcp
IR 80.249.115.84:443 bamaco.ir tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\style1[1].htm

MD5 4f8e702cc244ec5d4de32740c0ecbd97
SHA1 3adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA256 9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA512 21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

MD5 822467b728b7a66b081c91795373789a
SHA1 d8f2f02e1eef62485a9feffd59ce837511749865
SHA256 af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9
SHA512 bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

MD5 459a70e01111b71ae9f14c8857ede26e
SHA1 9b317bc2e10b15237884bb06bf88f174cc90ec21
SHA256 60296bf9a2e1903775688ff8356b399cfae8f8118600fb0c19c961908c2d2f20
SHA512 db8cfa281003bcc15cf5a9eaa0cc9546fc888614f44d7b83795c90249cda43a0e20646584bf1ae9160d6170f0e508bf373131e701203be5fe21f6f6ac7d01173

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F45FB247EFA0737CBD9F4A92DD33FEEF

MD5 e61ddfdd20fd133688adfc5b65ef7a42
SHA1 e6457090b19a21124ab56df31d284d025160595e
SHA256 d4a77f9edbf7d728eb666a3bbcd75e5907dec7dcfd83174798f75873f75ff0f2
SHA512 b09ff015cfaa0efba9c6b760aa72b225144a772c95668a7e2cd3885aa41a0720def9ea31757b2ffc69fda221f877c06b5bb2d40c178039e25a880717017639af

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9ad378c74f7768756cb3e6d1bf0c5602
SHA1 2cfbce9a5b08fae1e6f4c0936eb0da185e719714
SHA256 5e0772bf7aec192f4cb3f88fb3cb1af21e1d6019badd35dea003130b7183cbf6
SHA512 3f6816cbcba7a05ff0b177179d6c53a3173b7cadc0cd0bc91c76236d40660999ca8c92bc6a9f9e54ed627df9b8314e72b83e7448f069a177bfd5613949fcdcbb

C:\Users\Admin\AppData\Local\Temp\Tar9CDE.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\Local\Temp\Cab9CDD.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar9EB7.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 658da6d97e0178af76b5a27f0d4cf76e
SHA1 8f450c3b3308c3bdc45e697a616a993f617f166b
SHA256 c9622c489282ec314ba977ad7ea96423f29ec78cbb934824fe76c3c0748384ed
SHA512 295c723f6fce56784739b0535061335bf3aa7e027a65459e63fae1c95d2ecc0a2d6e68e6d8a9205afb819a8c6b12c4b68fa711b4fa003bbc7e1ae6f74b2ad0d0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 59fdc90345ddecedfbd0cf004df8f89a
SHA1 4a54b925c31789cdb0d83ff3d64ade1a2ef488ba
SHA256 1091b82f0aef8cfa541b746d62c9a391897f669b8b1c9ce6db1bd3e99c87d705
SHA512 343ea402a71c0a85b8c14704df8e44d24232fec17ce005d4a1e730117ded1a9db65aae75bf1c38ccb4b6d839ffedda9bd509743f9930839b2b393c85c600f8c8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d0e942ad93c0e2b736d98acdcc13abef
SHA1 a33165f477a895f8a12e7bdd6e629fa883f5e5bd
SHA256 df024d5f1f6e38b6f1ae9179104aa709da1ccbbaa9a2fe085fdc31c0623f89b9
SHA512 dbf12932d341eb22dee94d6c37e2dae2835452f0238cd709a68ee8cc07beb237fd25082ab3775ba30329afd0ec24ce856137e75257e8e3011927fd8f2c747aa3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8c81be601c0d40070ab116890dcee2c4
SHA1 d94ee64ce7502c729f4f7e8ca208ee722e3c68b8
SHA256 bdc75de844c1ec009666bb3cd3ce86e759c30d8c2207231a0334e14a9be4a13b
SHA512 cca3497a80b1045863bac7950e80a02788a7d3b046032861047bc29c8b0ee10f97c671bbb7047c976feaf3712b1f65f7bdc9750a441eefbc47b30e70c817cd93

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 779970032363e6f4a1818cff0fa1836d
SHA1 b172809edb77a640025ada6f7f3842d8aeca31cb
SHA256 bd564fd316d94084390e862c572dac57c8904cc18f12e271aa1b4cbd2c02d313
SHA512 824f5a4f7df89bbfad5b1899c73b6476866e7bd283849d4ee56708a4dbe4c0eef2cd509556d1cb3c88617b45ac49a000b1bf95132080fe15c98913bc32eee183

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 5e520ff3ad73d806425a190c81c0ebba
SHA1 e56130226509a92d0d01f276b349ef0d1719e806
SHA256 8a28465a3ca864e22af3557a8bcc313f0df7a47448d30687bef8688a4cbef5cc
SHA512 3f4ad69d48222b96010c729484f06b0c71baaea57d87e2b987a4719dc33a202fc5ee861dea36e3daa71dda1f4d118cd3271d33bddab57fac0d9fd7e8d0cd4db0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d4674c5270d5a202031e7cc13f7fcd3a
SHA1 f04b8219bf7ec7c4f9e87917beda93aa05e72d51
SHA256 092ad8874451abb3241eaf79d55925129b27e58c437ed35d9d226fca5cf015cb
SHA512 90aeba5e0e5ed16f648858973a38a5bf482562eb6c9756ccc33442afc0fa97cc66695c3b20efd50cb3d6651cdf7dfb17e590a422d243ada0508951fe6589a96f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ce6372ae641dc70aa5d7b216b2a1ef5b
SHA1 84f7b536d63213f3f7411a9c2fef691e0877ff31
SHA256 57a784d7cd63a3dd0945b3b20ace1f78961dc23aae3c08d3e521aa8ec616bc55
SHA512 595c5cc516dd4b61ef2262e44b22f35d5d7dfc6ad3dbead1804260119500ce0eca282ec3ed26289c0bab74201a8af6eab5ba1d164dc69107413d52d5f0537e50

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 355203b377c08fd53b59ed2677fb7bc9
SHA1 3df7ad93b0d94ff30963a5fa1733ebc49b305bba
SHA256 117fbd99a2276d0cedd300069db891af53dac3e8d655f7828b187a3766c9f477
SHA512 c0f836cac10136d75a9c9a31d6d0c5118e71269d6f06bfaf19ee2a665b0448b328f3114f6703c68d36720563a6c76b472a593eba166e61a0a17e6d75a68f5555

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a2468c5ca37cc9feb8ba90ecd5aede48
SHA1 94ccff043669568ba3131354ce8fa5b3c7efd077
SHA256 9f38dcaaea23ef947fc7223ae28b7de058c9ca36a052a02d4c5919feb6575498
SHA512 5e291a6886697961606994db527abfaf9a2c2f860854b291ed2623ba955b3e2887adbe27df1bbe8ddb983604edd91ca59b542a08ec54c4d2b4af545a776eec92

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dc433f8f1401cc8389b06bc63be51711
SHA1 d9501006760de9032add258fda4bdfddcf7cb933
SHA256 9a5368ed2025841116fe9f967553d14c67aab4a20bf8c4b36495ece844d6bd42
SHA512 ba9c8825b1caa8dbc382ddff0f69071a45cd5f577499ec3288ce5d756c13b03f7d8cffc25a2bde5b1e34328eb78d1c0c556b0cccacdf81307f4c77809ded719b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 25360d488c0b01f04fa1054e2ef3115f
SHA1 27c15ebdb0c099c8fa7321e8a60d1b51498f454d
SHA256 6fd6d3f4b2962bcf2be72b0a125d024d87ee07664d134bca899319b358f2564b
SHA512 595385179988982659896f0205de9a9303d4d5e5142d8d9a9dd9f8fc3f8c26727970eb77b20ba1121dc34604c9db521f5685bf5a58c1e706b00c121e31f5cc91

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cac68c7c311d49a3b190bc389baef165
SHA1 aeb0c2d57ecb9dd7ed6891adedc12e7e9766cf6c
SHA256 8301527250e3fe1d00f7ce6e4d51858682fe9acfd6827015ed9d24077fc3c7a8
SHA512 759e3a6b747111099e7ba1afb1f7fef9bb3c2dc9508a568c1b0086c4573fbcb36b508e4cfbdf4310d40b9eb1d3e3237945ff19c961218ddc22b42bc97c9612c7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 44f30dac7bfc5735f786fd436d663649
SHA1 f52c4f75dc57b0e3b4a9b1cafc3b5c6900ddcc1c
SHA256 e8fe1b1ff6e7f68a9a67d379f480074ebeadbd1583df39ac3353861f2da0cfb8
SHA512 cf8896981fe853162d049e87281aa26f3f65fc73ea7d8469a7d077e817df6ac3a27d234f8d19abf97bcd2b91865a5b07bcb065bce3665656d2850893f291a83f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f383a3621b48cfbeed94178d04bfd517
SHA1 0a7c65555c344e1f4906ed9ad5401efd9057f65a
SHA256 c6d2279af70b6934ca818ab620236e0844fa3df582751436792cb85ff06119c7
SHA512 f993cb405c381b18577d6a9801a9666ec0925e84aab5c0d643baee6eb8b7b37d8a222d9b87aa9a799f766db4f7e3aa4e648bff85c5e2dc540b9b1d6c57c61792

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-30 13:57

Reported

2024-05-30 13:59

Platform

win10v2004-20240508-en

Max time kernel

138s

Max time network

139s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\84625eb6c817bd40375f559e5447a835_JaffaCakes118.html

Signatures

N/A

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\84625eb6c817bd40375f559e5447a835_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4972,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=4208,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=5340,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5392,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5520,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=5940,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --field-trial-handle=5844,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5516,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
IE 94.245.104.56:443 api.edgeoffer.microsoft.com tcp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 13.107.6.158:443 business.bing.com tcp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 bamaco.ir udp
US 8.8.8.8:53 bamaco.ir udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
NL 2.18.121.23:443 bzib.nelreports.net tcp
US 8.8.8.8:53 bamaco.ir udp
BE 2.21.17.194:443 www.microsoft.com tcp
IR 80.249.115.84:80 bamaco.ir tcp
IR 80.249.115.84:80 bamaco.ir tcp
IR 80.249.115.84:80 bamaco.ir tcp
IR 80.249.115.84:80 bamaco.ir tcp
IR 80.249.115.84:80 bamaco.ir tcp
IR 80.249.115.84:80 bamaco.ir tcp
IR 80.249.115.84:445 bamaco.ir tcp
US 8.8.8.8:53 56.104.245.94.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 74.204.58.216.in-addr.arpa udp
US 8.8.8.8:53 23.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 194.17.21.2.in-addr.arpa udp
US 8.8.8.8:53 bamaco.ir udp
US 8.8.8.8:53 bamaco.ir udp
IR 80.249.115.84:443 bamaco.ir tcp
IR 80.249.115.84:443 bamaco.ir tcp
IR 80.249.115.84:443 bamaco.ir tcp
IR 80.249.115.84:443 bamaco.ir tcp
IR 80.249.115.84:443 bamaco.ir tcp
IR 80.249.115.84:443 bamaco.ir tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 84.115.249.80.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 8.8.8.8:53 bamaco.ir udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
NL 23.62.61.171:443 www.bing.com tcp
US 8.8.8.8:53 171.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
NL 23.62.61.171:443 www.bing.com tcp
IR 80.249.115.84:80 bamaco.ir tcp
IR 80.249.115.84:443 bamaco.ir tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
NL 23.62.61.121:443 www.bing.com tcp
US 8.8.8.8:53 121.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

N/A