Malware Analysis Report

2025-01-17 23:55

Sample ID 240603-qkpeysfg3t
Target 91edc851bd176c5ee07ccee7fef8df17_JaffaCakes118
SHA256 daf5b38b90a944aa71e8d15b6b52176acb96842b1a57f653970da9d881f8de38
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

daf5b38b90a944aa71e8d15b6b52176acb96842b1a57f653970da9d881f8de38

Threat Level: No (potentially) malicious behavior was detected

The file 91edc851bd176c5ee07ccee7fef8df17_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-03 13:19

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 13:19

Reported

2024-06-03 13:21

Platform

win7-20240419-en

Max time kernel

133s

Max time network

127s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\91edc851bd176c5ee07ccee7fef8df17_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000048cba07b9810a3d15ff30c127b6907cd79f66833776f401bf4dfc75c85f23013000000000e80000000020000200000000faaaed4c1acea3bfe16cb8a8af0b89a2d74e8a0fd1e263dbd9a10a4f342331d9000000079c0d8e9e3e410b17a72ea105a94a33353d43ce9a8b42f3d1b00c19fa016f3300abea58b65b5e6ac6193ba65532239e725140a9a0a2b18c895174020fde999bc1af82118c1fef033a4ebd37fcb8c8652206f6dcc20debdb0131ceeeefefdeefead9f150096eea66065bffca3e316944be2dc4f264f717ff0585c767ac18d6aad5f1f3d7b16849e70a5e504861cb07ee44000000047b9e74bf893fa7960a5a3e292486a98236eadcfa31bf7a038b0aa189c714c4c21d9ca674e80477f152821c5572c8838060c1888da7687e8b0c6aa390281f8c3 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423582633" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000033def689f4e480b51cc99d099d9ba4c7ea04cbe0290467eb431d1867435b992c000000000e800000000200002000000075e9dd271c0eff0abdab8dbf9ac5d5409abd7518032d63326e5026ac17cb58ed20000000c8c3f29c593bc91957e49be2ea72c7f2844a5121be845fcc74b38822c8b710c44000000086bbdba057bfebf4a96b91276460b593450f1a4c4bf67464d28be05755184e0c4d6493b2f23d4c8ddf99b896a6554906686785a476386b1116ae368e196c377c C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0c6e7bbb8b5da01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E6923B11-21AB-11EF-A0CE-F6A29408B575} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\91edc851bd176c5ee07ccee7fef8df17_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2124 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 coinhive.com udp
US 8.8.8.8:53 capacitacionpnl.com.ar udp
US 8.8.8.8:53 s0.wp.com udp
US 8.8.8.8:53 secure.gravatar.com udp
US 8.8.8.8:53 stats.wp.com udp
US 172.67.165.117:443 coinhive.com tcp
US 192.0.76.3:443 stats.wp.com tcp
US 172.67.165.117:443 coinhive.com tcp
US 192.0.76.3:443 stats.wp.com tcp
US 192.0.73.2:443 secure.gravatar.com tcp
US 192.0.73.2:443 secure.gravatar.com tcp
US 192.0.77.32:443 s0.wp.com tcp
US 192.0.77.32:443 s0.wp.com tcp
US 8.8.8.8:53 udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab1E5C.tmp

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar1E5F.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e644699d7d8270cf048c687c4aafe5ba
SHA1 b680c264b5afff41101efd7b867ac6719a846f45
SHA256 d60817a5597da8c16b90367444896cf1dcb84323d86caa1f0ad276c70224fa3c
SHA512 bfc5f5db6a7b6ef94b259a58fb3c110dce67e32ce79af55025c1cf93f1bae245a8bc6ebba2fb644ba97af1c7e13f991e02beae3fa7427521211ad81ec3dbff03

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar1F38.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6b4c81932de4d6572d4330d6b083e8aa
SHA1 7790dea7bfc28ed4c0b52bc11c02092e78261b34
SHA256 abc55516a14b58c306e1a7fa9d3597bbe7f5ece751a21883e7849025caa220fa
SHA512 23078a64b101611b446fdeda76a0ba4b2c3bd64bc50214d0a75ff522a830459eb4e9dd91a5b7603b963c4ea54b10a9e32f3ae93f5fbbef5afbf587436d4249b8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3ecab63f0184b7eef48cebcf1210a498
SHA1 42af5a1015d315e11b63ee8bc775b260a5da7282
SHA256 c3cb2ec1dd2026be36c347fed0e76fb9dd42949168be44b4426fa8c403dce539
SHA512 b8175a62491905ea456ceaa7fa2b7f97de97904f7eab8d2cebc6c08a74dd378fef49d251da6836499104f2d8cc4b4bf41bee7be4f5881e7c9cdb797156cedb11

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

MD5 9a33cbfe2a4ac69cc968045d4c043184
SHA1 6880c9315aa70ce767b036be73083d02ec20e96a
SHA256 45a1044c87c1e602dc38d15b1734d15551df3c29c9213d11a1df3f26629659f9
SHA512 2d980a1e978f3434200cc4b89ed785746e26c922a3ca887ecd54b263de2d2d2880291408d9701aad9a1d90de2d7dcb094ec85a3c26a287a651ef9419d5a0c735

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

MD5 76d4d147245ce8da3cf3a4aff0bc5611
SHA1 edf7b96b65cbe3e3ba82799502871c790d9ebb78
SHA256 46d3ed9486f6c000d1e52b27979054fdbd340efe906522441306ea0c189276b6
SHA512 631a6e44a0b135335bfd4cba07fdebd7bd688379f4012b0d3219f36680d1b735572e69601c631d9a1137aa615a4afd3bb91087d04bde887bd1a1130fe46c5dd2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

MD5 61c060748daca8556274bfabc587f30e
SHA1 05b5c3bd691071c2071f7864a15ba98f60cfacfc
SHA256 d3a4273f83db93b4afe9c06918806d71e6268a4b8b41cee65e047cfaa1af548f
SHA512 5a8566c72fa10bf6380096f57f5b3c638e347d4b40adb8706a50f84095d0047c39e72f1fe413f05c819cee4f84b6208d9702e2cbdc2f52e22321bb204edfc4ec

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90

MD5 653596edb732f3cdd3c8d5b69713dfe6
SHA1 b530a99d7151029187ad3c031d27fbeb42acea83
SHA256 51948be20c601bb7b64a034cae5c94b1ba3bd92864f6e7503fecedb18947dcdb
SHA512 8a5d84c62e33881244ee560c0a274165565408a0d3504dfc8f8160da9087a733f0cbc440ee5bc31c10920c3be2baad01d51b87bada8b154ac4cb9a193fe3675d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c55b49260d78e93635ffc816e994d70e
SHA1 0f7e414a04838da2ee691f13b1fb1a96791ffc8c
SHA256 74d08009bb6d069216ab94dd3c7d048e50b2f01c18320c7c095e7a3f9ff15a9f
SHA512 029fc3bd0b0865dfb51849b2feace5e342d6f9d4020fe14dfd215f623024dcd9c0574825372086ce7fa4961a46d34f717d77221745b92cc122a2528ea8fb2fa7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d7f7bb99ef4e471930051c0a20064b9e
SHA1 1ccac3010c880a46992fa07b6689d471a6dc8a8c
SHA256 fdf6a282722df683b6bd9b77377f6e02ddbe685eef44043539947b50cc408eeb
SHA512 fcec8eca41c865eab23961102381a25d351bddd51368b928cd5ad07fce60cdb66429f39b445cdef06793fa7fcbf6875f3ce475ea1015d9ec80c9a970550d772a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 db32ff70b0b13f7b124b58c238fac7a6
SHA1 5825df4ea4ce890d061951c4e63a7491e419ad5e
SHA256 372ce119197d4629305463d9676223a3cbda424c89fbaa1ddc2ee09da63104da
SHA512 4a15486fae31dc0eebeaaa78ce607f3e964f595478c12f163ab439f45f5f6e29432e05b365b27f1282f2d73f64bba78ca95fe2de60a28f7546010ffc15d61c6a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ab083dfe0e89f796b28daef9955fa7d6
SHA1 db06e3649aba794b4de2543701376f2006c4b2ec
SHA256 d5b257cfc6446b58408770f5d18159ba6babbb6ff3f52336b222b8f019e9b413
SHA512 16310e5af50da5e8ca9a07c16f8dba515f89677ab1d824a80cd48f7fd8836a560dad3df50b802fadefcb5518a669da6d3d2299f5ac1090e5017bac610cc1473a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d557bcaeffb6392a13446b3f33d5012a
SHA1 bab28c79cc0b40abe83b2d2905b25e055cb9fe55
SHA256 42196a2017cd6dba7c53663ea1b1f3cffc151e9ff8e368b0170f4f3775d5b2c9
SHA512 3d8953b525c492c5c3555a924fdf078d2366a2e8421f11ea877b9a0c87dc402602a8fddadad01a30322dc6e08f260dbe170ac059917d008cc67dfbfec1277221

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bcad446bd954e831c1365653ab83d497
SHA1 44fe07ed979bb70cb35f6758a488643eeb13338d
SHA256 0cf2b8a2cb33ee21651e6be9267fcc7d30ddbfe886ff951cc32e1907da541d49
SHA512 8c32b7e71ec4935590f3b926d9a10ee2a409bb4467c2a64228051d650bb8b54aa615077f6ad2c257ef6c85ec7d85356ea53065dab95532484f7984e3d1780187

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f379fdf32c8ea18354bd05994956b7e1
SHA1 33a3b05a244f56f666b78b5940b89027300fc2ab
SHA256 fc40733b8a9cc7341c0308c96270726c8176b74e3d80260770b82dd623dabd94
SHA512 c5b8db465363246cec26223370bd4709032bfa94bf72c19c0ddc87b0814f936cb984ac960f00bad9167fd126b182f8745525527367709e419d3dc71e714a7976

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 218212429d00462d51b048a5267008b7
SHA1 185ee4eb09fb4b9a46c63417dd3f1da1bb95e41c
SHA256 eb87c48351eb37c5be2611eeff17e0e2402d0e6058bf6c3154ddf5dba6bffce7
SHA512 0143159f441676283bb62da8943367e54a1123ca16611137f15da25c90e48b79efc7d600f02f297c73fe76575f50b27af7657c7996b053ec87a5486ee7ee884a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7f066b985d1b14cfe0df493441ed89b8
SHA1 5918b3dc7ad38624ee46ba7ecb49db0e511e975d
SHA256 d5826e569ad574400602dd0fb3f056ab8f69fa3756307cf5a6e499c3df73422b
SHA512 a09b9340987cdbc66bc6483f7795f386f5418120596802da16119d922815166ac6674abeb5eb40541b133b51566701d0557d78bde1298d5213748626cc2efcba

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e2015d03e3bbae3ed76293d7bd9ef6fe
SHA1 088aacfec1363255cc33b88d1bb92d4f1bfab4eb
SHA256 0a1a36950ba40c90e0e1199cabb8e5a4cc5ea850a7eb109fca30a2195aebbc80
SHA512 9d3175fe7b88b9d8706cc8f96666f71cdcc16328286b0ddad69fb073de95d4da5c56738365c496bf913ad841181b941929bb1b95e2cee83a5a842306da95cf93

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ecffb0dd117b1e92496b880c0d5042a5
SHA1 626fe1739be5de9feb6527b8a194c59c8dd73d4d
SHA256 624bc75206f417325e34bde2549672c1512352098455e996dd2a3ccb1e19f68a
SHA512 de0e45c42bc521a44f29f642e91f3f3fa5e913eec5b43bb93a5ebe4789d91faafeac646a9baeeabfb3803940e48df08a73e807c958a59c2d88dae8ec57244179

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 e3ac8628a4e52f4e4fa428576174faba
SHA1 ce4cc65250172ed2e6ecabdb27522e22cd2e53ec
SHA256 7bce05e2783728674692048e247887614c850b3ffad07af660644143ee7bc278
SHA512 071c1ca3561c014bd123935d55fe74f9ec4df1465b05370d7a417ee1ca6a1a7524f6e6400915885e8934d16f6e9e2a0aef2c334ec46765e6c25649850864021a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 803fcc824ac9042a35e45874e9bead22
SHA1 6375c55003d67c58f5110dbe4b885b56afdba091
SHA256 85d10d14ea12eaae0e74cbc603ed708cce928b5c537d2414ca578d5437271730
SHA512 257a5160a8c7941be9622bf2a29caf89fdb676e260cc5b2ed7599421a1db6f2403a52c60fcae8cc4b6c9efc7c851110e6af01eb29cb3480d5304595145e9d8a6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bc3c07f4eeb7c97db818e147b6709d21
SHA1 2c06c8cf66afa9fb17debd410e63e7541108af26
SHA256 af1d8ffa0befa50ab821b1a1b3260314fdc32dd79b4db570edfb14290c2af1cc
SHA512 ae5f2439e98224152260cc38120b501541b08e2f3e3bc9bad1450c7b50acac2f35b0247020946ac55d160eb2c8c1906eef89d142e3bbccdf622cbc8f5d4d0eab

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ceaf017d079a7e76e85fec9a5a45ee3e
SHA1 08a3e7097db0ef6ed84a7b36bc000aaba998957b
SHA256 ac56e92be90fed7b70f59075cdfb1fec8f1edf9f7241d71172550d027d389df3
SHA512 69dd5d7fa2dbddb67b4711e93c59e5dc9cac2f3a20f5dec3e1a4f0843406c2fb5c96760edadfe839a11ec5ebe1805c64acba59818995ca73c393700799c149e7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 78f9d9fe1aaf6a4916b017fa20dbc95e
SHA1 4be8b3060f252ea3a37dca7d5f1fc2b3a1fc63e1
SHA256 92506a5f0711e66d7411aa9b0588cab48e286f8bc00aa88eba92347394dafb6b
SHA512 8c809b8b8c5acdf73b6f11251dcba8ee4268fd7f710270c124394487b283740e5676cc97bca3abff1942e8bd1608137c282b0e128d4332da4d54ef144074cde0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3ebc93bb690289e419f81bce6893fe8b
SHA1 7673599f2c95827d53bb5ef4d22ca3ac4077b5e7
SHA256 92a92d62ed4957e57c3500a11262cb7878474688482eb0c47623a3f1e53b323c
SHA512 ddfc8e392be5026b38c68931f63d29aba8581eabb9c0def50e0ad6cf8b4a3db59400542892f33ed38883a45bd147f351d23c014316744052b95a934d2525a16c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 770df3317ada26783832b7767ece8aad
SHA1 80a0a9956cf18024c9804840e34c25df7cc45a5c
SHA256 9de3dfed1230f2f9d1c6e2f7be24ff7f7da3de6c773316e6f7ce69c49ec51677
SHA512 fce8f0602d0bbb27d71ccf260e979c593cb500d1012c0b072ee5b5983b9dedb6ec87c2c0f901c096c37578af497f984ece45dc79ee15b9ecee7b9fb1bee931fe

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9cec7bd5ebed794467aa9f53c8d46f14
SHA1 a65793b546827625336bada6b4ff8d6fa6f2188e
SHA256 d520d7e24d55fc714981dadb55b497fbf8dd04a1897b9efafda6314c97923bf3
SHA512 95d6e841895e9a140ed2923d55786a74e773102727739e44f8420fcf76205d69fda9d60f23b33af30ea51c72d071bfdf3e25f70f14f7c571707e8a1a4a7b406b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 97ea0e837ed42ee39a63348982cb4b66
SHA1 c0139bceac453d47e1891426d57ade6ecf8e5fd5
SHA256 938d65214b8aaa68c3bd8af6000682e76b2a1b3155c92352f49ce2593bf98912
SHA512 38dbd308fefcb8eda949e1419f5ad85aca8f17952be54f4d62c00bd4c3c3d4ac8bb3bbd0a025da4c8af3de66bab44bedd0f034a7d964778d3ab6525a89cccfff

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a9e49977a97d686f06037982165b41a3
SHA1 33032baf0e98b017913e1ab637bd48c0fa61b1be
SHA256 c9757ba979792752f0ea8ab4ec5147569601bbe8ebf13eb3d77bb36ceb4af6b1
SHA512 3dc8ee3c574c7e95e2b51b5db464d6dc2242c4adaf9924910ae23de8c7b1b922eb964a9abb13c6bcf320051c31933e723d8c152e2215b603b3225040fa995788

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ce350ceb91f5799c4910e8263cbb6917
SHA1 c632806fb8f9c2a0cf0b393d11ddd88c6dacc498
SHA256 ca9cb197d6118b6095bbbfb6cc8b2601d381f8727d55b6c1f43d5a98a626ff1d
SHA512 f43ecf24bfe1d531336ad61a67583f7b343d624ea0797dafe646d556bdec5217662f353e43bfbb60d17d4c6dcdc83520f22d9a8736063dbaba309917afb6c6f8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c7cf129f9543119805f5d0367266e346
SHA1 987b72700bb3f6985d1d51572cac2d4bf298038f
SHA256 5b2e5c529b10c4e34bcfe938b05bc4a2b1cf00d68664f52fe9ab25c8fa4aff2d
SHA512 d20ec51b6e0a9cadb1ca132b0b3cc4bed674753f59d4408c7973a9f131c9dde378bc70725f632848d891ce6193a438f5002bfea635ad4880ef7c63fe2c65645b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ea18872a922cd5cbcb57240b1da395d6
SHA1 9de6b92383c5711ba37113ba71c8e7c2f5752979
SHA256 582140835bab22fc0131bdcfcfdd4409fa569b505eabcb3455e76d91151425f2
SHA512 6c64c731ca2ba7e1b7fa180ecbc95527c3da690c1060315533b9156cf50448cb95878c1276a22d747466f2ab8a0605a78e6070d9542cfc31d80f0be4f6c83386

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6d3d7a0281fda4a633c103d4f90781c5
SHA1 609dc5b3c3dc7f9d7adcfc22884f8f0aaffa606b
SHA256 50b9f04b3eb1d308bd7937261fadefa8945061b7a48dfedd3aa692cb6139af55
SHA512 32f1c5a2506797c2461d3fc9d4df95a3a2137fa7ff22001e6ee574f4a56c36732d87d0f907736af6e82edda20ddac5d4266c625a5d08cd6db9f417b080ffd67a

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-03 13:19

Reported

2024-06-03 13:22

Platform

win10v2004-20240226-en

Max time kernel

132s

Max time network

148s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91edc851bd176c5ee07ccee7fef8df17_JaffaCakes118.html

Signatures

N/A

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91edc851bd176c5ee07ccee7fef8df17_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=4008 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=5132 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4560 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=4848 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=4284 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
GB 13.87.96.169:443 nav-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 13.107.6.158:443 business.bing.com tcp
US 8.8.8.8:53 164.189.21.2.in-addr.arpa udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 2.17.251.21:443 bzib.nelreports.net tcp
BE 2.21.17.194:443 www.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 capacitacionpnl.com.ar udp
US 8.8.8.8:53 21.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 169.96.87.13.in-addr.arpa udp
US 8.8.8.8:53 194.17.21.2.in-addr.arpa udp
GB 142.250.187.202:445 fonts.googleapis.com tcp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 13.107.253.64:443 edgestatic.azureedge.net tcp
US 13.107.253.64:443 edgestatic.azureedge.net tcp
US 13.107.253.64:443 edgestatic.azureedge.net tcp
US 8.8.8.8:53 capacitacionpnl.com.ar udp
US 8.8.8.8:53 capacitacionpnl.com.ar udp
US 8.8.8.8:53 capacitacionpnl.com.ar udp
US 8.8.8.8:53 capacitacionpnl.com.ar udp
US 8.8.8.8:53 capacitacionpnl.com.ar udp
GB 142.250.187.202:139 fonts.googleapis.com tcp
US 8.8.8.8:53 capacitacionpnl.com.ar udp
US 8.8.8.8:53 capacitacionpnl.com.ar udp
US 8.8.8.8:53 capacitacionpnl.com.ar udp
US 8.8.8.8:53 capacitacionpnl.com.ar udp
US 8.8.8.8:53 s0.wp.com udp
US 8.8.8.8:53 s0.wp.com udp
US 192.0.77.32:443 s0.wp.com tcp
US 8.8.8.8:53 secure.gravatar.com udp
US 8.8.8.8:53 secure.gravatar.com udp
US 192.0.73.2:443 secure.gravatar.com tcp
US 8.8.8.8:53 capacitacionpnl.com.ar udp
US 8.8.8.8:53 capacitacionpnl.com.ar udp
US 8.8.8.8:53 capacitacionpnl.com.ar udp
US 8.8.8.8:53 capacitacionpnl.com.ar udp
US 8.8.8.8:53 capacitacionpnl.com.ar udp
US 8.8.8.8:53 capacitacionpnl.com.ar udp
US 8.8.8.8:53 capacitacionpnl.com.ar udp
US 8.8.8.8:53 capacitacionpnl.com.ar udp
US 8.8.8.8:53 capacitacionpnl.com.ar udp
US 8.8.8.8:53 capacitacionpnl.com.ar udp
US 8.8.8.8:53 stats.wp.com udp
US 8.8.8.8:53 stats.wp.com udp
US 192.0.76.3:443 stats.wp.com tcp
US 8.8.8.8:53 64.253.107.13.in-addr.arpa udp
US 8.8.8.8:53 32.77.0.192.in-addr.arpa udp
US 8.8.8.8:53 2.73.0.192.in-addr.arpa udp
US 8.8.8.8:53 3.76.0.192.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
GB 216.58.201.106:443 tcp
US 8.8.8.8:53 nw-umwatson.events.data.microsoft.com udp
US 52.168.117.173:443 nw-umwatson.events.data.microsoft.com tcp
US 8.8.8.8:53 173.117.168.52.in-addr.arpa udp
US 8.8.8.8:53 a.mailmunch.co udp
GB 18.165.160.23:445 a.mailmunch.co tcp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 13.107.253.64:443 edgestatic.azureedge.net tcp
US 13.107.253.64:443 edgestatic.azureedge.net tcp
US 13.107.253.64:443 edgestatic.azureedge.net tcp
US 13.107.253.64:443 edgestatic.azureedge.net tcp
US 13.107.253.64:443 edgestatic.azureedge.net tcp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
GB 18.165.160.88:445 a.mailmunch.co tcp
GB 18.165.160.120:445 a.mailmunch.co tcp
GB 18.165.160.43:445 a.mailmunch.co tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 a.mailmunch.co udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 pixel.wp.com udp
US 192.0.76.3:445 pixel.wp.com tcp
NL 23.62.61.129:443 www.bing.com tcp
US 8.8.8.8:53 129.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 pixel.wp.com udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
NL 23.62.61.171:443 www.bing.com tcp
US 8.8.8.8:53 171.61.62.23.in-addr.arpa udp

Files

N/A