Analysis Overview
SHA256
684c11a4faa6fab528623027a053b3f3cf5e63220c18c9319318faa284d16f1d
Threat Level: No (potentially) malicious behavior was detected
The file 8c7b477de998de7349cf43dc07a58e22_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Enumerates system info in registry
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-02 01:36
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-02 01:36
Reported
2024-06-02 01:39
Platform
win7-20240221-en
Max time kernel
149s
Max time network
150s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423454079" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9540D721-2080-11EF-83FC-5267BFD3BAD1} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2696 wrote to memory of 2224 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2696 wrote to memory of 2224 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2696 wrote to memory of 2224 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2696 wrote to memory of 2224 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8c7b477de998de7349cf43dc07a58e22_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | prodistec.com.pe | udp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| GB | 142.250.200.14:80 | apis.google.com | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| GB | 142.250.200.14:80 | apis.google.com | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\Cab1872.tmp
| MD5 | ac05d27423a85adc1622c714f2cb6184 |
| SHA1 | b0fe2b1abddb97837ea0195be70ab2ff14d43198 |
| SHA256 | c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d |
| SHA512 | 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\Tar19E0.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ec348fc23c54613c4562cb645512ac51 |
| SHA1 | 0bc54ae89ea83954953240ed398aeb596597b65a |
| SHA256 | 9a15000421ce4cc4a049f8b2955f4a65eede12cfa51350bcee0348e58602af15 |
| SHA512 | 85767f46e8b7a8d09b180aed47a542850412f61dc17e6762694d890a704094938796dc8359f7a67a800649616639d95277ff0efed9423be7796aa4d3ebcbeff3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 909a897e20abe5573c60738c96d45be5 |
| SHA1 | 3e22a56c6b5a41eaeb82e1a0991c1dc08e0942cc |
| SHA256 | e4a4e9e7cdd94d1795734626766e18cd9c01ee39456a6a3834476ea20c062d2a |
| SHA512 | e63f161ed901c083a451b0f3736cce6644b058ffb55246a576136a2051bd261f7b7beb16dad61daa4fa61f83a5ba79042e85a45811f27708b9e73a52fbce0592 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 413f0923fd2bb481a8d8c7459e2bf873 |
| SHA1 | 694b4445404a6214fe6a646cfd8c77a7d307cbb1 |
| SHA256 | a03fac17cd73d32a006079239ff3ee6f73d05122763b65ac31f5eb9a15aa34c0 |
| SHA512 | 1073b0da51daa74996c717a2106014b4644b599b34f8696efffb46be7f049a84ef09fe58c334452823a697f7b97bc1782a28c873838312264a2664066be8ceea |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 98d93852ad0df39a918a8050134394be |
| SHA1 | d6dcdce00426afe1a6d361e55111e6048d233ecd |
| SHA256 | f14f29f613de679e2c78bd7c07651b72815f634e05221aa377604c2a9e78ff97 |
| SHA512 | e3ab7c6e0bc7791687802b09c458c314af7722ead037ed233ee5dd68b743f14c028265c67246a5598c02ebb1764b1a5057fbdb34f96b2fde9bab2b794fec7e95 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 0cae3f5c65d1a43b7952c97f404b5a53 |
| SHA1 | eaf2314fe75f90081ffb218065dcd06c6b772ea6 |
| SHA256 | 220fae7057d5be645beef289ce17f0558711e831a93aa67d93414848cce3f07f |
| SHA512 | f98eeeb95f2c230a24f9cacf90b06e1bf67e960936c841508868d8a53691576e65b9823ca53b105cf662c2226c667b3962bb2dd1e1a61b935727b266725c5f2f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | ad2ec4d524f27db99aa2d8282248bb92 |
| SHA1 | 1fec3999aa7c5409d8c7b57a1e370152bf7b4726 |
| SHA256 | fa75154d7433d1d8134472659dd7d4b3e388197c5a35936d2b71362ab6e3e3c8 |
| SHA512 | 814342a31fa4fd60f0b8343cf9f0e92b991d678ea9faa5c6265a4350ca0b278235ba7964c224a1854db43d74b1a1e03bd7f536268c73b92de1f3b94cc15c5377 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 958f50962bb6a92b4ea215e9ea1f8e6b |
| SHA1 | 585a8c4f8768df1e82fb109c4d83d0c6ca1fc17d |
| SHA256 | 1742e73cb9928d5356478c38cfc3af83151f8b1dbb7a9e45462779050635ad6e |
| SHA512 | c531d9d3f686e23e0067018403036d51e68247642f9a1b6e0f7b46d44964407f22713c350b0e95ec8fcf5d8469ca861a63b738a0381d24eb7d641c1f41acd0b3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 10fdb93f466010c2cd609e7b9bb33c1c |
| SHA1 | 517288902c57fca79766362c68d49a23c6f62e68 |
| SHA256 | eadb8773232a1bef7c5b19d0696bb66a7d34ff17135884d9580453354119924c |
| SHA512 | a725429426e834b3360a8dd4c8836fcb2cad47a4845800272893f32b16de7d0cdc814f91d5aa6700d24a4b6de72faf0435579bbec0542167c8da4ed4314278a3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 04b6ebc62122787495413e772cdf684f |
| SHA1 | 161be4166460aa836c05d75b8820d913a90be181 |
| SHA256 | b7b7bf2bdf4ea60e27cf50c6a0198d3f54456de046ee38210975ba1721f8fef0 |
| SHA512 | e19abfc96d5f8d4673f6dff0d61ecb851078eba367252517019bb4c99b35345c94932572ba4c32f784da3be86aa1f3eae734f0896def80a80d78bb4f463b57dc |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-02 01:36
Reported
2024-06-02 01:39
Platform
win10v2004-20240426-en
Max time kernel
149s
Max time network
150s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8c7b477de998de7349cf43dc07a58e22_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc10ed46f8,0x7ffc10ed4708,0x7ffc10ed4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,17676961901538977514,12073646934188627247,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,17676961901538977514,12073646934188627247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,17676961901538977514,12073646934188627247,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17676961901538977514,12073646934188627247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17676961901538977514,12073646934188627247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17676961901538977514,12073646934188627247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17676961901538977514,12073646934188627247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,17676961901538977514,12073646934188627247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17676961901538977514,12073646934188627247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17676961901538977514,12073646934188627247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17676961901538977514,12073646934188627247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,17676961901538977514,12073646934188627247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2256 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,17676961901538977514,12073646934188627247,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5208 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | prodistec.com.pe | udp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 71.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| CA | 144.217.103.9:80 | prodistec.com.pe | tcp |
| US | 8.8.8.8:53 | apis.google.com | udp |
| GB | 142.250.200.14:80 | apis.google.com | tcp |
| GB | 142.250.200.14:443 | apis.google.com | tcp |
| GB | 142.250.200.14:443 | apis.google.com | tcp |
| GB | 142.250.200.14:443 | apis.google.com | tcp |
| US | 8.8.8.8:53 | developers.google.com | udp |
| US | 8.8.8.8:53 | accounts.google.com | udp |
| GB | 216.58.201.110:80 | developers.google.com | tcp |
| NL | 142.250.27.84:443 | accounts.google.com | tcp |
| GB | 216.58.201.110:443 | developers.google.com | tcp |
| US | 8.8.8.8:53 | ssl.gstatic.com | udp |
| GB | 142.250.200.14:443 | apis.google.com | udp |
| GB | 172.217.169.3:443 | ssl.gstatic.com | tcp |
| US | 8.8.8.8:53 | 14.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 110.201.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 84.27.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 3.169.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| NL | 142.250.27.84:443 | accounts.google.com | udp |
| US | 8.8.8.8:53 | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | ecdc2754d7d2ae862272153aa9b9ca6e |
| SHA1 | c19bed1c6e1c998b9fa93298639ad7961339147d |
| SHA256 | a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7 |
| SHA512 | cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2 |
\??\pipe\LOCAL\crashpad_1036_SOGRQRSGKCWKBMPW
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 2daa93382bba07cbc40af372d30ec576 |
| SHA1 | c5e709dc3e2e4df2ff841fbde3e30170e7428a94 |
| SHA256 | 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30 |
| SHA512 | 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 9addfac9d5c6b4fb59d80c2458f1343b |
| SHA1 | 105c6afb48b56d939335fee6d9c3fbfae18f22ed |
| SHA256 | 168cfd38a50e3e0a7d3374d53d0c452b1db8420730ab8b5613b0a0770f536ab8 |
| SHA512 | aba8e093bbccfcb015a623f8af3fbf53c8659d3d2dd7d09cbb2ec490f50f3e736d8fcf63067776877c0fc6d2726e17d1f67155caf9b60c0bd95b0bb51998e106 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | ea42e353b83d5bbe9a35c555f50ce8ca |
| SHA1 | deb096d35efd399e4ba9e7b06a013fd5abe9f3af |
| SHA256 | 22f9a5821ec6a7c39ae4231ca6bf0f8a6f9b3078aa15e1bc1353b81f9f28dabd |
| SHA512 | 9a3770f296e52ceb072c94002e0e002743fb282d046c7ae4d5208bdcd251f1eca9728c0a2e0679a01d68167b4b395568a8bfd3403756b4a58c87d3bb67a28f92 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 67e12f4d91d31fe21226e68c4e5499cd |
| SHA1 | 98713af9b204a1dcbb8782778d21b37b91332e32 |
| SHA256 | 8bd2aa35e3ba721e4e91c417850ed6cd611079826defed9ab868de9a24b24e88 |
| SHA512 | 86a7bd277741a107ca20de7e6670dfd5927e6a5283ae20f3641d5bacd7dddea22c8543acfd2792d9b84591ae8f80ea2f9dd7983c3befba15b792ad48d8c9936b |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 6c5f824f69e1626592d62e2cbd76502c |
| SHA1 | 881de9b6dc0eb49d266cfe500e43cc75e6ba1018 |
| SHA256 | e27d5aca8d283df7ec9c34348fac6b3809e297a33f5e5a2d3908bf4283ed0eb5 |
| SHA512 | 7f4663d6b294ec1169e6b025e295161cfbd6cba50fcb409f8682978c85020ad88bd02b1321b222652b8295752f5bb431ef2a44bd16a8aab3e2acbfac32981f2d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
| MD5 | 07a0782d0650d0f85b250cc1e37461bc |
| SHA1 | bd7b29c38a911b04df779a3dbf1036a756c7ad07 |
| SHA256 | 83ed08f54c5ab8edc127018710c7716a5c23af18046b70e6d65e0cf8e34e69f2 |
| SHA512 | f1251380cc9f91f04c0426a587ecf914a126265f17512b570eb2ea53a4c463839a0104e52f7ef00f66d44a2a2ff9f45a47c1da9e928f54430269dfb79095d749 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
| MD5 | e1c71f7c04be834f5587230db2ad24b3 |
| SHA1 | f3bab9cb99d9f343bf7ed3981aaa7450515d2424 |
| SHA256 | 9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899 |
| SHA512 | 205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51 |