Malware Analysis Report

2025-06-16 07:20

Sample ID 240602-b1e4wsfa62
Target 8c7ae7dfb0c1ac2b06769d5bcc517d5c_JaffaCakes118
SHA256 dd71fe2ed14a623e04d445f038ead901d68a33c332c1f9af163da6355c02f711
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

dd71fe2ed14a623e04d445f038ead901d68a33c332c1f9af163da6355c02f711

Threat Level: No (potentially) malicious behavior was detected

The file 8c7ae7dfb0c1ac2b06769d5bcc517d5c_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-02 01:36

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-02 01:36

Reported

2024-06-02 01:38

Platform

win7-20240508-en

Max time kernel

137s

Max time network

140s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8c7ae7dfb0c1ac2b06769d5bcc517d5c_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{85BEAFC1-2080-11EF-9DB4-7A4B76010719} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000002fd6c86bb03728f47c5c3a696cda96c31fa3263f7c02861b21dd93ffdcf3507f000000000e80000000020000200000001d5c4b9dac986055bb332a98702a9f41b5f180d92f84e1bf0cc999d77f02cacd20000000028f16b006eca5bf5b00d6056f7ae7db39d824ac9d8a46a6cff1569fb3e1a46b4000000061efc0948c1b4c7b959342d6667823555ba3ba13631a58b855f844ce7b74c07efae4916adbefc8e848e4c63a9b51b2739a797da55a11d0313af5fb7cbdfff851 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c00e675b8db4da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423454051" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000005a465560b5655ae61b0c7a802849541a90a483b25b210ad9f3cf998a272e916f000000000e8000000002000020000000a27ec5ccf1dffac9c74c8768e7a3c1357101ee5535ab34c6670f4255d3e3da05900000008b3788473bc32a11e5e4476a74398b07cafbc14f5b5b96c30f696b658180386574858c66ce321f66ebcd665d0fc52511588e34461ee51986a72f99b0776b456d35f0f5692d835aac8ad1b47003da3b8f9ad28f3cc2956b297efcf3c562bc692656b4a6a153078e5a2c4d174b5a8732431fb13b4994c40357e31d7e8d648aa983b51a29b9dd8c17fbc99a3f14ef718f5440000000a6336eca15ab7ca427a3b7c81eabf2ab8a9688f6e3875d147a9afa0408c9c599e27bca1bc87a7cc0d5d77602e5cdb42633e7e0ddaaa7f8c01eee2ea04d699e48 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8c7ae7dfb0c1ac2b06769d5bcc517d5c_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.gaillardsdavant.fr udp
US 8.8.8.8:53 muttenthaler.at udp
AT 80.64.143.198:80 muttenthaler.at tcp
AT 80.64.143.198:80 muttenthaler.at tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab4FC6.tmp

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar505C.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1877b873961a2f4c80821ff5b2c71048
SHA1 d79df0cd8411c0ec94040ed6d26b8687c45224ad
SHA256 1b6458ba88b6de19153269c45756e9c826a7a79e87c3bbd5739d201bc7f5de6c
SHA512 36c4850c465bbafe59167da4f0e7eab17436aa0d21bd7df17d7ad5b450c189b0127d29dbaddae7241948bdd3a4189f9cc33431ed74da8179a133cea44113ba1b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e4a00bad6cbcc7698ff27055b3ce4b3a
SHA1 4d817745ca0ade285824b97f51bacc7722ed725c
SHA256 de6b6a9e249621b613672f58f89fbd33bc77a97a7d2b45d6d375b84caf025933
SHA512 1e066dbc1ed0d925903e241effd6ca2df68f1184672679d63adc804981f28b0ae58e60c813a51ff473a5cc57f9307725d9a40eb6810e6c1128aa2d228cd0f120

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5681bf442e9df761ffea826255c0e0a1
SHA1 4fc3586ec0e36ec847191082c9dc5d61288dd949
SHA256 5a78809038eb7634d9e471fddd31680a957e0fff2394910145f98bfea0ab380e
SHA512 8b2956c81b112405ce8ae61238177d560259aff124247d84eb7c4264cef2c576ac16788d7281bbce2c67535bb8cefc1967e2c6bc515cfce88b3b296e26d8befb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 53d0628cc33b7ea750a4a24fd571e4b6
SHA1 1a10e8b4b75e944e189d74c879cfd0fcebbc6fe4
SHA256 3101d21aa8bc9c4c0cd6852c47bfcc78cd03ba60ab12df8f3600c6ccaa8d2357
SHA512 3ac75c541ae46cc43650d965fe4b7b684a71f4974c95663cba035355c8cefd0164a3430c82cc428a79e4d15329b6ef00b0fbd86fc0f7f5dfbc1ad847bf1cbcf8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 75aaac8d38c87291a932a5147bd17531
SHA1 0f0aed6682d5a1f172fdaaf63cb52d7b619d5f86
SHA256 40e9551061d78772e68ebd5fc8b772ea9d5a5ba1471869e3bed4d3cb7f9909bc
SHA512 785a256938d48a72ba0aaa45866a5e2b1b23c579abcca281cd1703f1e76c2d486a33ffc7201851a771fbf9bb2336fb4be858766efd74f3c1e1ef9b47a1bda937

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 47e9d3f23b5e1c377c0de1a12243679c
SHA1 011110177683779cbbea497f204504fd9783413e
SHA256 7b6363771a15e92c251264fcaaf68a128b42f29c4a6832479c3a400547f56cb0
SHA512 f6b25a7f6f4879109a926b9a6eb0ff707eb33f5e52d7a03b5a311094be53372553d31b708b37016d7564986e88332634e644c0d5895d840ddf9e319b822c284a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7234632295f1f2e12f3c37c0c5478dc7
SHA1 7e631661239a2ffd2776af3e75ed9eae5b994799
SHA256 96b75e310e639d60059205ad6ba5d87295b3c70972e42149eccaa993a4f9c96a
SHA512 abd89b828f39789e99505b613127034b86dbe2504887c19e5e49a05bb087b79bac9ae726d693bedb99501f390934e99dfe22a1c233b2b01df4091bc6dc00eaf9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 74b4cb0636ef3f5f45c50d2e49d0f554
SHA1 69998e248df9da5eb822fd065c69518d5ff89288
SHA256 3f2ccb780d8c274d3fe40cf040306f29668d4966fe49ccabc2fca7dc49ac9646
SHA512 48b450aa193eeb2db66342f8460d17e2a05e4ed2f03318458eae2fdb20df2c77b0e942d295275c313b4c6ac5746dfd862bf019fe256ba861a98ded9702e21509

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 29200a12768023020c3001e7029c917e
SHA1 8496fc4cf7fffcedce4c24166a18166b094ed2ba
SHA256 34a0ed6f4f6ef20f0425b83d2c7d48b600bd003ee924ff0b000b92cb74693845
SHA512 2163909d45455a96fe5b46402e2c342e794ef051762a6f97bc299006bea77307e29abf6111cb23df576917d1cfffac94e6b8418bb3aa71a82b7ad7ffe3c3e644

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5337035b08eefc8689aa82b5b3501bf9
SHA1 f1ffd1babd9aae0a09e1e67ca1e33849b0e83691
SHA256 db82bebe3ac5fed1d898a40af7b20da82373d7f978334dbf580ff647e98d55ae
SHA512 0043aacd21b880361b711e4b7f7e465a90e0d0d4b80eeda19a7993e7b5a169a3ce4f61e859115bc8a2120db7b397a624f1c29a707ba626dee1238f6310956a5f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ddc7432bcced3b676be4f0fb76087465
SHA1 5664595555cdfe08c358614bf8596c6ae2eba8af
SHA256 3c21a8309eb793669802ec0fca1432a184714522d0d785bb44b06e177c1c1864
SHA512 068d13c2580de34db0c464418a23d7fc2a4f4c20349ff0ba9d72c40a603a9ac6b664e706d1c0c8acb33cfcdc84387c89b17352f2e1373624af084549d53c63e3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8225f80f6bb60865524e432de2fca1a5
SHA1 e02ae22c83aca4c43f93c34ef80031808fc6bccd
SHA256 f7f368be78cf175d17ed95989a0ff46ca651e7a127d218abf6451c92d128b463
SHA512 4ed1c86b271b87309557af33f49237f939fcc65072e6766eb14404beda84232a21309323acbb31f8d3c08249c0a5d469262d30966b382b652eb934831885a122

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9b10124f1fd0ffdcdae978f981b37b1d
SHA1 7df9631ee59b2663b2a50d9fa53dc083b65a0104
SHA256 902b59fcfc7f16ae6a6761f361a1565d561f707a3267a7698e7b7504d70933a7
SHA512 87555afb7c47305a390c0261487152dd2e59c657c1ff7d897fa844d129dbbe79e49f9be8de1e5d26421432f3be85b152376591966ebc257c785a1d92c080d734

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3732bc4258be4a311a8276f6df313dac
SHA1 068e69232b6afb0805099c07d3c43ad6a19787a8
SHA256 73e5747dc91b5731e333a9e8991f41922b206f002b38d44e474204587cbc0410
SHA512 6f7632ed63b7cceb545549b4946d790f9e85de1df5db15618e4266f8b601c0c660921d5c2b7401a739665905613423c48e81df1750444c396b14b313119b8dbd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 832292768de56f4a9f8eeab255368e69
SHA1 37836391e8be76baea98fc30ad09b55f5c93e424
SHA256 9db59dda9794182584253c2075fc6de827b6fb31a7cf33e38de217ac86be5efa
SHA512 b863b98b0c2eaa45cd802c85df55288bc86825a2be20a8c95a2d609ab3057fc33902b9843da6416ba3f4a4cab12491567f8b6f9cd7e6af7e8f6feffb5f0a537f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 98d9bd8a4032fa00931c7239ebb25936
SHA1 5221c52759ac9bd3cc4479188b097858d952971b
SHA256 32583b70d2f1ed77d7b1bd8efb2e5bcb4822b53b2908f4d97f477bd33972f945
SHA512 ae3cca7e56cdcadd5232da9a7f9a38bd638268b20f11afe788d72333c35eb435c9c182d364a6bf5e33c5782d57fabc75ca493d79b21f10559dc3db8659053a31

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d1e1aa6519f506a7822b674a765beb13
SHA1 daf850872b2955d1b592f8380b87c9559c1aa8dd
SHA256 ee62b21106b2cb352db49c78e4d5daf0b914e162fc4099671ac23190d358b142
SHA512 51235d70b686aa688b850c025653cbe5d230e4c167ec446b9f2056d2deaddfd887b91004cf41abeacbe20726c4b90a90aeae762075c7b7ac1b3ddcb8a4252ac1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d3bcc3b6a504e1d7cb92691c3d2a981d
SHA1 c8df0c345aecb8c3dfb432f4a33c376844152666
SHA256 ef71f16a2f20e622449388f442e9b751a12d6793f7abc49937406a76d3c85c45
SHA512 626ef52d5d90a0a10df8b4c24d033354d7703f46b5ce2873e00f679f3d46a9ea010aa533d418e593d636dd59861def5ae194a8d528bb6409ff7fae17b45cb533

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0d31ca7e2a381d48129fafe3c4d54da8
SHA1 89a2b91b8fe4ae8c5a81ebe81ef535cdb0b6762f
SHA256 2080ff8b4a70a8b727f70542e9f8e8f37b1eab601f9f1a66357f1f65881d649d
SHA512 3d32eb50368f7f8d2cf6f5ae65c26dda4100b2f150f1d400645e2e4bc1ab3515f217c0689d1a3f3b499ba0f79ac64226351d97e3962ceb4ae3c3897ed08d55b6

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-02 01:36

Reported

2024-06-02 01:39

Platform

win10v2004-20240226-en

Max time kernel

141s

Max time network

151s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8c7ae7dfb0c1ac2b06769d5bcc517d5c_JaffaCakes118.html

Signatures

N/A

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8c7ae7dfb0c1ac2b06769d5bcc517d5c_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=1312 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4712 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5708 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=4560 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=5860 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5312 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
GB 142.250.187.234:443 tcp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 13.107.6.158:443 business.bing.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 51.11.108.188:443 nav-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 164.189.21.2.in-addr.arpa udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
BE 23.55.97.181:443 www.microsoft.com tcp
GB 51.11.108.188:443 nav-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 www.gaillardsdavant.fr udp
US 8.8.8.8:53 www.gaillardsdavant.fr udp
US 2.17.251.21:443 bzib.nelreports.net tcp
US 8.8.8.8:53 www.gaillardsdavant.fr udp
US 8.8.8.8:53 netdna.bootstrapcdn.com udp
US 104.18.10.207:445 netdna.bootstrapcdn.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 181.97.55.23.in-addr.arpa udp
US 8.8.8.8:53 158.6.107.13.in-addr.arpa udp
US 8.8.8.8:53 netdna.bootstrapcdn.com udp
US 104.18.11.207:445 netdna.bootstrapcdn.com tcp
US 104.18.10.207:139 netdna.bootstrapcdn.com tcp
US 8.8.8.8:53 21.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 www.gaillardsdavant.fr udp
US 8.8.8.8:53 www.gaillardsdavant.fr udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 20.42.73.29:443 nw-umwatson.events.data.microsoft.com tcp
US 8.8.8.8:53 29.73.42.20.in-addr.arpa udp
GB 142.250.187.202:445 fonts.googleapis.com tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
GB 142.250.187.202:139 fonts.googleapis.com tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 www.gaillardsdavant.fr udp
US 8.8.8.8:53 www.gaillardsdavant.fr udp
US 8.8.8.8:53 www.gaillardsdavant.fr udp
N/A 224.0.0.251:5353 udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 9.173.189.20.in-addr.arpa udp

Files

N/A