Analysis Overview
SHA256
28f6eddd3efa28f71b8d0d86bf08932f087c331b6f053b5661ee58a3625752bd
Threat Level: No (potentially) malicious behavior was detected
The file 910d2e3605b3dbeb91f476f91e8c81d8_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious behavior: EnumeratesProcesses
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-03 08:05
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-03 08:05
Reported
2024-06-03 08:07
Platform
win7-20240508-en
Max time kernel
133s
Max time network
143s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000005199e192e70befba9753e870c9f7a5c6953a9c3bcf8fc3e20e915f7ae5ef29cf000000000e8000000002000020000000634ad9b7c305d37105b316c4e15ad7a68588d4245cd8396b6100bdaf1f06a09b2000000089604c3a56434e9874963d8b39a80fea83d1f3f8e6757c8aa33cb1aa7b3fa3c3400000005d8be64a45a974fda3f1adde512358e9ff7d4c1d72a1175b29e75549625188be187a66696fbb9900505c8c096fcf6fb223c6c1dc5dc76823b917f7cf0fb290ca | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40d0d0d28cb5da01 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC8E0DD1-217F-11EF-8C92-6A2211F10352} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423563775" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000005397c7e3dc9d9eb395721b2b12e845617b2e4f57cfc9fbbb4820db8c6274c06c000000000e8000000002000020000000ba852c7ef201c3c1e40cee23861f4252b09d48e8c698b57f06d081ab32aa40cc900000008077e1cef6152f67a05f29d33a5d828811d61022cfdc73ef1890b9f01411a31640f4e2197dcbd7b4f9893268710f1a3689a46fb7d5161b12ead5b554eefd7573569e1f7de0a791ca6a6afbb75f3e7ce2251df09cc541efbc9ed2edb950350e0831d8ffb580fd92e7759d6a73e307f3c4e809a1e38648c9b3219dc7b0b673c0fc84c8ad8217e34c24f4dd5bd98877f397400000007f09eeeccc063bd3a6ae776cfeba0fab348434baee437c78dc1db3812b7991303d2343d5ca01295fd4f1d9540c011fe061ebc594d60f6e957e6c0ba01d139d20 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1368 wrote to memory of 3040 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1368 wrote to memory of 3040 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1368 wrote to memory of 3040 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1368 wrote to memory of 3040 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\910d2e3605b3dbeb91f476f91e8c81d8_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | www.ofaimme.com | udp |
| US | 8.8.8.8:53 | ofaimme.com | udp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\Cab45D8.tmp
| MD5 | 29f65ba8e88c063813cc50a4ea544e93 |
| SHA1 | 05a7040d5c127e68c25d81cc51271ffb8bef3568 |
| SHA256 | 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184 |
| SHA512 | e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa |
C:\Users\Admin\AppData\Local\Temp\Cab4649.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\Tar465D.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 7a350d1b25b6d1811bbaf933731f4547 |
| SHA1 | c4115c106c5afbcff7c4634e0cf7180472bb6647 |
| SHA256 | 3aaf01c25321fc9331d4fceca1c52e34e152957638f7caa34e6479dada4caac0 |
| SHA512 | ceadb8669633f04f699827a6967f6b4cc99687e97ed0d9c3095c537605900d62dca639a419c3b93c6eeeafaacb8f2e32e31a6b2b0fde3b2ff219d828f6297341 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 17cf104787f16f72c397fef09890980f |
| SHA1 | 603b8cbeaf7650f7f78b8f2cb619d7fd7ff38a72 |
| SHA256 | 23d9986df5bd07a2624dafc5ce1a3953cf8f113fb6a1e1c0a328ed4441cb9da8 |
| SHA512 | e87e6527e8283d2c3e7e9a7d6fdaa4a29733c6427663a4ae9b8f669a7b5a2eadb019d8bef6d2ed4721df17ddee6f689c252aed7655290df4883416629ec46d49 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 3a475f8aef484c13299f69c21db52072 |
| SHA1 | 4e1416b9155bb39a0df53fac4f408be1b008e3b2 |
| SHA256 | 6439c906e6c343bcfdf1fd78a6affc977fa3a317ef5980fece9125a9c3fe5d64 |
| SHA512 | c36114b63f15f2abdb2865b3f0a639217c84721f4e817d4453434288181e4849d4eb6f0ffa528f586ae50f1f1f55814dc152a0538d9d8f8286a0e1cac5691f83 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e159326443f30b9cbbd626979b2614ab |
| SHA1 | b10df8c7f183a9dee6c430137b5513e5b8d628d0 |
| SHA256 | 318470770f9c0d1d2527c91bd6244d167590f386a46dd41a583aa0fd9bc3bc87 |
| SHA512 | b36527fcee774e2340e038fe8bf29e1b20b16e2110a8e061892b246c29e59a6aaa2b5c76e59d25e6c409e3c997391859a1b9cec7c01f9ed1b5f03d617db70a59 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 1465b3dd01fe7bb5704aa0c5ce5bd5f2 |
| SHA1 | 8316bbea2244f9be5a61a171b9753c78df46fd1c |
| SHA256 | a8578102f172af13f0d78a2126c98bdbd55068de8d4680d952e1b9f2d90005fd |
| SHA512 | 9677823a26aaabc56f16a5775a0380ac5554e08c4b74b80fa90b17b5da35a185f05e3315dba527155ec248601d3ccee4c163df91469b9c3131b0d357a3c1deac |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 7deb7cc2b860b8060861db01a5522b82 |
| SHA1 | ce1cc853c04e4854c657ac17e0b82c8d4495b954 |
| SHA256 | d6929a7a582e42cc700d51ce0cb1cba2288d61885460572ad751ef74cf504034 |
| SHA512 | 6f09b9249671665d764301466f5a90f66a9cfbe2cc83f5c2ebb5ccda1f23ac750116254db2d90a9f030813177f5674ea05a216226a6ba54698f76a641cddb8e3 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a51c3978b66dca2226c79b384f6d3158 |
| SHA1 | f3fc13140bfc44f1d2a13283125f061bd46ab974 |
| SHA256 | 0a94a9335ae09d7dd79a5f6b51c37c3a406e561766943279b0519f854aeec748 |
| SHA512 | 8e6e477ec002520062828a682d7dcbb551fa4d507087b1b08a91beac4b34ee4dba4e340c26357e49ebb73b3494e9a399c330f4e2d22c5e724e5c14c45b2a748c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 2eefda9fde30a4022c356e5d39bfe06d |
| SHA1 | a83c0e4964b87ce901e2178321a1b97ec9e7588a |
| SHA256 | f6f39cc1d437d20d2c6c69fa482b9fef4577d4d73f731f3004676ca7e97fd95b |
| SHA512 | d02943f8805f5e40755c7711dabc42bd12b830e92cf644b4c106cf1797331b0689fa2a4f316195752a1cbdff753a5b2e658c7e90557d2006f3e0d849e1b6a18e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 85d188b10fd1712216c5907aff242b2b |
| SHA1 | 82a565bc1c740e76a39effbc20b83c598500aa70 |
| SHA256 | ef3ff9e818377b673fa8399c9a72ebd30683e64f0db9845ddd2673d8d4880d01 |
| SHA512 | fac167b04f4c5683512e40a3b4f7e6c633512e78c0057632d8ff09979fea9e372c678df31c0d0a36ee566e238fe38b26b166d20ae857b784a239e6dcb105ddd7 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f990ccf5f11416cd465e25cfaf5f0fcd |
| SHA1 | 03befed35088c1075ed2621026999f457f6b90b1 |
| SHA256 | 37c8532abd3c75b8d043af2eb25a56d8891e768caf327b18aac9873127f9e056 |
| SHA512 | 9a2d6e1534c0588cc6696b631fad664e3495bb6bf345c5a577951f02d1d589da315f7a51319d7338b0b134c79ce3894158f2fdfd69ff27d5a202ab1b4d248c42 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 8227359f1815cb0898fe01fea5efdb2d |
| SHA1 | 886b9a2b6e66d9f654f599136c253d79451d44ca |
| SHA256 | b0096d3580643f8fa0933b538f81b61fe25839820d1b7e25ada36c2a9f7e41f7 |
| SHA512 | 134f1b9872d7fe8942d0f00a01b6f390c8ad0c3894500721ef490fbe5420449bcb9ac651946171ab90d954efcb59309ee4a60962c1e456a25208491fcf73e82b |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-03 08:05
Reported
2024-06-03 08:07
Platform
win10v2004-20240426-en
Max time kernel
148s
Max time network
146s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\910d2e3605b3dbeb91f476f91e8c81d8_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaef7f46f8,0x7ffaef7f4708,0x7ffaef7f4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,632624328116375927,14426883114151285531,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,632624328116375927,14426883114151285531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,632624328116375927,14426883114151285531,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,632624328116375927,14426883114151285531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,632624328116375927,14426883114151285531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,632624328116375927,14426883114151285531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,632624328116375927,14426883114151285531,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,632624328116375927,14426883114151285531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,632624328116375927,14426883114151285531,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,632624328116375927,14426883114151285531,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,632624328116375927,14426883114151285531,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,632624328116375927,14426883114151285531,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5404 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| GB | 142.250.187.202:445 | fonts.googleapis.com | tcp |
| US | 8.8.8.8:53 | www.ofaimme.com | udp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 144.107.17.2.in-addr.arpa | udp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 8.8.8.8:53 | ofaimme.com | udp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.213.193.141.in-addr.arpa | udp |
| US | 141.193.213.10:80 | ofaimme.com | tcp |
| GB | 142.250.187.202:139 | fonts.googleapis.com | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | www.ofaimme.com | udp |
| US | 141.193.213.10:445 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.11:445 | www.ofaimme.com | tcp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | connect.facebook.net | udp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| GB | 163.70.151.21:445 | connect.facebook.net | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 141.193.213.10:80 | www.ofaimme.com | tcp |
| US | 8.8.8.8:53 | connect.facebook.net | udp |
| GB | 163.70.151.21:139 | connect.facebook.net | tcp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| GB | 216.58.213.14:445 | www.google-analytics.com | tcp |
| GB | 216.58.213.14:139 | www.google-analytics.com | tcp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 141.193.213.10:445 | www.ofaimme.com | tcp |
| US | 141.193.213.11:445 | www.ofaimme.com | tcp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | f53207a5ca2ef5c7e976cbb3cb26d870 |
| SHA1 | 49a8cc44f53da77bb3dfb36fc7676ed54675db43 |
| SHA256 | 19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23 |
| SHA512 | be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499 |
\??\pipe\LOCAL\crashpad_2868_ZVGPTGYRMFGBNHJZ
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | ae54e9db2e89f2c54da8cc0bfcbd26bd |
| SHA1 | a88af6c673609ecbc51a1a60dfbc8577830d2b5d |
| SHA256 | 5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af |
| SHA512 | e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | de1132c5b02fa66e7ac7e0b86fb8b423 |
| SHA1 | 1dda3c6c9e5c5a78e0aa5c21cd9b0e02393205f7 |
| SHA256 | 96cfbcd4e532acf7320222373ae370f2adfed3f6894542a4c25cf457cdea2d89 |
| SHA512 | e60b69513546ab571648400e5916510587ed7cd3db1839baeaa2ba1717da74f9721b150675d31f06b9b637ca94f784c25af42b8b2fb9b69577614f3f1e02a728 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | 6343d26332e1503e0e6fa89c7e608a7b |
| SHA1 | 0589133eae42083bc59e231932500b3782c6cc4a |
| SHA256 | ee66d206a5308974fd33dce527c21228fbd01eac74efb4137ce17441227ad1fc |
| SHA512 | 47846c0b2c6785ab28571f76396421af664e4c2cb601f0cacc2e7320070f09977e58af3f17839c9ba9b413097b777b8e118bc2ec8e67493a77b15390546bb6a7 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\348e27d8-a221-4d7a-ab19-c7f4793be46e.tmp
| MD5 | d23b680fc70ff90aaf28d4e5632e3b70 |
| SHA1 | 1bddc470b980f974c1258a5bb5fe37a64ac411e8 |
| SHA256 | c0d77907178595220ac94672baa68effaa0900aafee3ab08dc5563d7fee19a18 |
| SHA512 | 42b1b85dac565813dc5fd68d6784ef8c69c4f044d159e6b0f93da513d309accdb98679765d8bcc53be3c241ec6b99eaf983472a1d9c5848cb600da19454d2fa6 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 6253e61c3d9bc76edbceaf4369226085 |
| SHA1 | d0d0ed8c3b3da908439bb90801f058e3d65df630 |
| SHA256 | 186d93ca6f1af9a0864556863abb1662abce77e3c0d8115c6912f0f48d9120bf |
| SHA512 | 519a8d51c2b43de365896dc997cdba3d9d5bcaed6b5dace51947582f737d3472f2d32f8dfeb83ed4cff0f1832a8f553545b81c7af68c265b7c5897e2208b872c |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |