Analysis Overview
SHA256
c6fe330e8cb071a105f1aa22a79bb3e70e51ae79b3995205f90ba2f31fb52d7b
Threat Level: No (potentially) malicious behavior was detected
The file 84625eb6c817bd40375f559e5447a835_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-05-30 13:57
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-05-30 13:57
Reported
2024-05-30 13:59
Platform
win7-20240221-en
Max time kernel
120s
Max time network
135s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8ea3e7d6759b34c9814e846d1bdc3ce00000000020000000000106600000001000020000000e30ff6070770ba44e1e66e942eefc264dd362850940e433c9d7c0774a29a7931000000000e8000000002000020000000465b43da26fabce46b92c78f164b7bfb37c5c4ecbf0d6e3922a77dcefddb872c200000004825bde6fb74f27ba16e0247450f5fba521b6c4a6a951ead67488e0e1153e2764000000025bed75b634f4b06acd8aca3ba69802ce7281796486451304172b23f8572fd4d975def1e456a6da671ece3722209268a7ac6a44469f5c675fe8af60d1b4cf644 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0943a5a99b2da01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423239302" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{83F9DDE1-1E8C-11EF-A1FB-E299A69EE862} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c8ea3e7d6759b34c9814e846d1bdc3ce00000000020000000000106600000001000020000000e7c86b2c36890e1f5b211fd6a44322a90eb17df728ed7935baff6355be19a169000000000e8000000002000020000000894fe3066146a32d062b069fb18c0e65f4d33e7ca297895e491b55782bcad416900000004df2672f0505f577884774b6277a0f1a4cf1b1caaf85b13ac55875c7ee873939eda51026ab1eb0204c7550949cb234f32fa12cc1edbeedf1ae38152d1c9849d8ff1d4d730c1cb24c7a71d7fb51cf0c484ac13104a768e6828b4044c178c5cac74770354d8012ca64046f840cbe232ded63c8b53e88c2bcdd1a0995630d2ea3b38f2fb82af1f4c44a15567e1b9c6761a3400000007f2899056a3b7c5675bd4507c59c17eb9b3ded36068cc3c46660add1910f8dac70ddec071ecd0877a8356744ccaccb5e30a7ee72fe77fdcd1126f07220b77269 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2868 wrote to memory of 2264 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2868 wrote to memory of 2264 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2868 wrote to memory of 2264 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2868 wrote to memory of 2264 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\84625eb6c817bd40375f559e5447a835_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | bamaco.ir | udp |
| IR | 80.249.115.84:80 | bamaco.ir | tcp |
| IR | 80.249.115.84:80 | bamaco.ir | tcp |
| IR | 80.249.115.84:80 | bamaco.ir | tcp |
| IR | 80.249.115.84:80 | bamaco.ir | tcp |
| IR | 80.249.115.84:80 | bamaco.ir | tcp |
| IR | 80.249.115.84:80 | bamaco.ir | tcp |
| IR | 80.249.115.84:443 | bamaco.ir | tcp |
| IR | 80.249.115.84:443 | bamaco.ir | tcp |
| IR | 80.249.115.84:443 | bamaco.ir | tcp |
| IR | 80.249.115.84:443 | bamaco.ir | tcp |
| IR | 80.249.115.84:443 | bamaco.ir | tcp |
| IR | 80.249.115.84:443 | bamaco.ir | tcp |
| IR | 80.249.115.84:443 | bamaco.ir | tcp |
| IR | 80.249.115.84:80 | bamaco.ir | tcp |
| IR | 80.249.115.84:80 | bamaco.ir | tcp |
| IR | 80.249.115.84:80 | bamaco.ir | tcp |
| IR | 80.249.115.84:80 | bamaco.ir | tcp |
| IR | 80.249.115.84:80 | bamaco.ir | tcp |
| IR | 80.249.115.84:80 | bamaco.ir | tcp |
| IR | 80.249.115.84:80 | bamaco.ir | tcp |
| IR | 80.249.115.84:443 | bamaco.ir | tcp |
| IR | 80.249.115.84:443 | bamaco.ir | tcp |
| IR | 80.249.115.84:443 | bamaco.ir | tcp |
| IR | 80.249.115.84:443 | bamaco.ir | tcp |
| IR | 80.249.115.84:443 | bamaco.ir | tcp |
| IR | 80.249.115.84:443 | bamaco.ir | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\style1[1].htm
| MD5 | 4f8e702cc244ec5d4de32740c0ecbd97 |
| SHA1 | 3adb1f02d5b6054de0046e367c1d687b6cdf7aff |
| SHA256 | 9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a |
| SHA512 | 21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
| MD5 | 822467b728b7a66b081c91795373789a |
| SHA1 | d8f2f02e1eef62485a9feffd59ce837511749865 |
| SHA256 | af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9 |
| SHA512 | bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
| MD5 | 459a70e01111b71ae9f14c8857ede26e |
| SHA1 | 9b317bc2e10b15237884bb06bf88f174cc90ec21 |
| SHA256 | 60296bf9a2e1903775688ff8356b399cfae8f8118600fb0c19c961908c2d2f20 |
| SHA512 | db8cfa281003bcc15cf5a9eaa0cc9546fc888614f44d7b83795c90249cda43a0e20646584bf1ae9160d6170f0e508bf373131e701203be5fe21f6f6ac7d01173 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F45FB247EFA0737CBD9F4A92DD33FEEF
| MD5 | e61ddfdd20fd133688adfc5b65ef7a42 |
| SHA1 | e6457090b19a21124ab56df31d284d025160595e |
| SHA256 | d4a77f9edbf7d728eb666a3bbcd75e5907dec7dcfd83174798f75873f75ff0f2 |
| SHA512 | b09ff015cfaa0efba9c6b760aa72b225144a772c95668a7e2cd3885aa41a0720def9ea31757b2ffc69fda221f877c06b5bb2d40c178039e25a880717017639af |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 9ad378c74f7768756cb3e6d1bf0c5602 |
| SHA1 | 2cfbce9a5b08fae1e6f4c0936eb0da185e719714 |
| SHA256 | 5e0772bf7aec192f4cb3f88fb3cb1af21e1d6019badd35dea003130b7183cbf6 |
| SHA512 | 3f6816cbcba7a05ff0b177179d6c53a3173b7cadc0cd0bc91c76236d40660999ca8c92bc6a9f9e54ed627df9b8314e72b83e7448f069a177bfd5613949fcdcbb |
C:\Users\Admin\AppData\Local\Temp\Tar9CDE.tmp
| MD5 | 9c0c641c06238516f27941aa1166d427 |
| SHA1 | 64cd549fb8cf014fcd9312aa7a5b023847b6c977 |
| SHA256 | 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f |
| SHA512 | 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06 |
C:\Users\Admin\AppData\Local\Temp\Cab9CDD.tmp
| MD5 | ac05d27423a85adc1622c714f2cb6184 |
| SHA1 | b0fe2b1abddb97837ea0195be70ab2ff14d43198 |
| SHA256 | c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d |
| SHA512 | 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\Tar9EB7.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 658da6d97e0178af76b5a27f0d4cf76e |
| SHA1 | 8f450c3b3308c3bdc45e697a616a993f617f166b |
| SHA256 | c9622c489282ec314ba977ad7ea96423f29ec78cbb934824fe76c3c0748384ed |
| SHA512 | 295c723f6fce56784739b0535061335bf3aa7e027a65459e63fae1c95d2ecc0a2d6e68e6d8a9205afb819a8c6b12c4b68fa711b4fa003bbc7e1ae6f74b2ad0d0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 59fdc90345ddecedfbd0cf004df8f89a |
| SHA1 | 4a54b925c31789cdb0d83ff3d64ade1a2ef488ba |
| SHA256 | 1091b82f0aef8cfa541b746d62c9a391897f669b8b1c9ce6db1bd3e99c87d705 |
| SHA512 | 343ea402a71c0a85b8c14704df8e44d24232fec17ce005d4a1e730117ded1a9db65aae75bf1c38ccb4b6d839ffedda9bd509743f9930839b2b393c85c600f8c8 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d0e942ad93c0e2b736d98acdcc13abef |
| SHA1 | a33165f477a895f8a12e7bdd6e629fa883f5e5bd |
| SHA256 | df024d5f1f6e38b6f1ae9179104aa709da1ccbbaa9a2fe085fdc31c0623f89b9 |
| SHA512 | dbf12932d341eb22dee94d6c37e2dae2835452f0238cd709a68ee8cc07beb237fd25082ab3775ba30329afd0ec24ce856137e75257e8e3011927fd8f2c747aa3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8c81be601c0d40070ab116890dcee2c4 |
| SHA1 | d94ee64ce7502c729f4f7e8ca208ee722e3c68b8 |
| SHA256 | bdc75de844c1ec009666bb3cd3ce86e759c30d8c2207231a0334e14a9be4a13b |
| SHA512 | cca3497a80b1045863bac7950e80a02788a7d3b046032861047bc29c8b0ee10f97c671bbb7047c976feaf3712b1f65f7bdc9750a441eefbc47b30e70c817cd93 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | a266bb7dcc38a562631361bbf61dd11b |
| SHA1 | 3b1efd3a66ea28b16697394703a72ca340a05bd5 |
| SHA256 | df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e |
| SHA512 | 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 779970032363e6f4a1818cff0fa1836d |
| SHA1 | b172809edb77a640025ada6f7f3842d8aeca31cb |
| SHA256 | bd564fd316d94084390e862c572dac57c8904cc18f12e271aa1b4cbd2c02d313 |
| SHA512 | 824f5a4f7df89bbfad5b1899c73b6476866e7bd283849d4ee56708a4dbe4c0eef2cd509556d1cb3c88617b45ac49a000b1bf95132080fe15c98913bc32eee183 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
| MD5 | 5e520ff3ad73d806425a190c81c0ebba |
| SHA1 | e56130226509a92d0d01f276b349ef0d1719e806 |
| SHA256 | 8a28465a3ca864e22af3557a8bcc313f0df7a47448d30687bef8688a4cbef5cc |
| SHA512 | 3f4ad69d48222b96010c729484f06b0c71baaea57d87e2b987a4719dc33a202fc5ee861dea36e3daa71dda1f4d118cd3271d33bddab57fac0d9fd7e8d0cd4db0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d4674c5270d5a202031e7cc13f7fcd3a |
| SHA1 | f04b8219bf7ec7c4f9e87917beda93aa05e72d51 |
| SHA256 | 092ad8874451abb3241eaf79d55925129b27e58c437ed35d9d226fca5cf015cb |
| SHA512 | 90aeba5e0e5ed16f648858973a38a5bf482562eb6c9756ccc33442afc0fa97cc66695c3b20efd50cb3d6651cdf7dfb17e590a422d243ada0508951fe6589a96f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ce6372ae641dc70aa5d7b216b2a1ef5b |
| SHA1 | 84f7b536d63213f3f7411a9c2fef691e0877ff31 |
| SHA256 | 57a784d7cd63a3dd0945b3b20ace1f78961dc23aae3c08d3e521aa8ec616bc55 |
| SHA512 | 595c5cc516dd4b61ef2262e44b22f35d5d7dfc6ad3dbead1804260119500ce0eca282ec3ed26289c0bab74201a8af6eab5ba1d164dc69107413d52d5f0537e50 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 355203b377c08fd53b59ed2677fb7bc9 |
| SHA1 | 3df7ad93b0d94ff30963a5fa1733ebc49b305bba |
| SHA256 | 117fbd99a2276d0cedd300069db891af53dac3e8d655f7828b187a3766c9f477 |
| SHA512 | c0f836cac10136d75a9c9a31d6d0c5118e71269d6f06bfaf19ee2a665b0448b328f3114f6703c68d36720563a6c76b472a593eba166e61a0a17e6d75a68f5555 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a2468c5ca37cc9feb8ba90ecd5aede48 |
| SHA1 | 94ccff043669568ba3131354ce8fa5b3c7efd077 |
| SHA256 | 9f38dcaaea23ef947fc7223ae28b7de058c9ca36a052a02d4c5919feb6575498 |
| SHA512 | 5e291a6886697961606994db527abfaf9a2c2f860854b291ed2623ba955b3e2887adbe27df1bbe8ddb983604edd91ca59b542a08ec54c4d2b4af545a776eec92 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | dc433f8f1401cc8389b06bc63be51711 |
| SHA1 | d9501006760de9032add258fda4bdfddcf7cb933 |
| SHA256 | 9a5368ed2025841116fe9f967553d14c67aab4a20bf8c4b36495ece844d6bd42 |
| SHA512 | ba9c8825b1caa8dbc382ddff0f69071a45cd5f577499ec3288ce5d756c13b03f7d8cffc25a2bde5b1e34328eb78d1c0c556b0cccacdf81307f4c77809ded719b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | e4a68ac854ac5242460afd72481b2a44 |
| SHA1 | df3c24f9bfd666761b268073fe06d1cc8d4f82a4 |
| SHA256 | cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f |
| SHA512 | 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
| MD5 | 25360d488c0b01f04fa1054e2ef3115f |
| SHA1 | 27c15ebdb0c099c8fa7321e8a60d1b51498f454d |
| SHA256 | 6fd6d3f4b2962bcf2be72b0a125d024d87ee07664d134bca899319b358f2564b |
| SHA512 | 595385179988982659896f0205de9a9303d4d5e5142d8d9a9dd9f8fc3f8c26727970eb77b20ba1121dc34604c9db521f5685bf5a58c1e706b00c121e31f5cc91 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | cac68c7c311d49a3b190bc389baef165 |
| SHA1 | aeb0c2d57ecb9dd7ed6891adedc12e7e9766cf6c |
| SHA256 | 8301527250e3fe1d00f7ce6e4d51858682fe9acfd6827015ed9d24077fc3c7a8 |
| SHA512 | 759e3a6b747111099e7ba1afb1f7fef9bb3c2dc9508a568c1b0086c4573fbcb36b508e4cfbdf4310d40b9eb1d3e3237945ff19c961218ddc22b42bc97c9612c7 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 44f30dac7bfc5735f786fd436d663649 |
| SHA1 | f52c4f75dc57b0e3b4a9b1cafc3b5c6900ddcc1c |
| SHA256 | e8fe1b1ff6e7f68a9a67d379f480074ebeadbd1583df39ac3353861f2da0cfb8 |
| SHA512 | cf8896981fe853162d049e87281aa26f3f65fc73ea7d8469a7d077e817df6ac3a27d234f8d19abf97bcd2b91865a5b07bcb065bce3665656d2850893f291a83f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f383a3621b48cfbeed94178d04bfd517 |
| SHA1 | 0a7c65555c344e1f4906ed9ad5401efd9057f65a |
| SHA256 | c6d2279af70b6934ca818ab620236e0844fa3df582751436792cb85ff06119c7 |
| SHA512 | f993cb405c381b18577d6a9801a9666ec0925e84aab5c0d643baee6eb8b7b37d8a222d9b87aa9a799f766db4f7e3aa4e648bff85c5e2dc540b9b1d6c57c61792 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-05-30 13:57
Reported
2024-05-30 13:59
Platform
win10v2004-20240508-en
Max time kernel
138s
Max time network
139s
Command Line
Signatures
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\84625eb6c817bd40375f559e5447a835_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4972,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=4208,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=5340,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5392,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5520,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=5940,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --field-trial-handle=5844,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5516,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | api.edgeoffer.microsoft.com | udp |
| US | 8.8.8.8:53 | api.edgeoffer.microsoft.com | udp |
| IE | 94.245.104.56:443 | api.edgeoffer.microsoft.com | tcp |
| US | 8.8.8.8:53 | business.bing.com | udp |
| US | 8.8.8.8:53 | business.bing.com | udp |
| US | 13.107.6.158:443 | business.bing.com | tcp |
| US | 8.8.8.8:53 | bzib.nelreports.net | udp |
| US | 8.8.8.8:53 | bzib.nelreports.net | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | bamaco.ir | udp |
| US | 8.8.8.8:53 | bamaco.ir | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| NL | 2.18.121.23:443 | bzib.nelreports.net | tcp |
| US | 8.8.8.8:53 | bamaco.ir | udp |
| BE | 2.21.17.194:443 | www.microsoft.com | tcp |
| IR | 80.249.115.84:80 | bamaco.ir | tcp |
| IR | 80.249.115.84:80 | bamaco.ir | tcp |
| IR | 80.249.115.84:80 | bamaco.ir | tcp |
| IR | 80.249.115.84:80 | bamaco.ir | tcp |
| IR | 80.249.115.84:80 | bamaco.ir | tcp |
| IR | 80.249.115.84:80 | bamaco.ir | tcp |
| IR | 80.249.115.84:445 | bamaco.ir | tcp |
| US | 8.8.8.8:53 | 56.104.245.94.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 159.113.53.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 74.204.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.121.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 194.17.21.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | bamaco.ir | udp |
| US | 8.8.8.8:53 | bamaco.ir | udp |
| IR | 80.249.115.84:443 | bamaco.ir | tcp |
| IR | 80.249.115.84:443 | bamaco.ir | tcp |
| IR | 80.249.115.84:443 | bamaco.ir | tcp |
| IR | 80.249.115.84:443 | bamaco.ir | tcp |
| IR | 80.249.115.84:443 | bamaco.ir | tcp |
| IR | 80.249.115.84:443 | bamaco.ir | tcp |
| US | 8.8.8.8:53 | www.microsoft.com | udp |
| US | 8.8.8.8:53 | 84.115.249.80.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 99.201.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 203.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | edgestatic.azureedge.net | udp |
| US | 8.8.8.8:53 | edgestatic.azureedge.net | udp |
| US | 8.8.8.8:53 | c.s-microsoft.com | udp |
| US | 8.8.8.8:53 | c.s-microsoft.com | udp |
| US | 13.107.246.64:443 | edgestatic.azureedge.net | tcp |
| US | 13.107.246.64:443 | edgestatic.azureedge.net | tcp |
| US | 13.107.246.64:443 | edgestatic.azureedge.net | tcp |
| US | 8.8.8.8:53 | bamaco.ir | udp |
| US | 8.8.8.8:53 | 22.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | wcpstatic.microsoft.com | udp |
| US | 8.8.8.8:53 | wcpstatic.microsoft.com | udp |
| US | 13.107.246.64:443 | wcpstatic.microsoft.com | tcp |
| US | 13.107.246.64:443 | wcpstatic.microsoft.com | tcp |
| NL | 23.62.61.171:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 171.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| NL | 23.62.61.171:443 | www.bing.com | tcp |
| IR | 80.249.115.84:80 | bamaco.ir | tcp |
| IR | 80.249.115.84:443 | bamaco.ir | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| NL | 23.62.61.121:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 121.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |