Malware Analysis Report

2024-07-28 07:18

Sample ID 240612-vhqmfswdqk
Target a16c7968753447c692c1081f4e08fdc2_JaffaCakes118
SHA256 a14627980e66b5734a5e856033ea3b946d99ae5538e620db989137bdb3e05c5e
Tags
phishing
score
4/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
4/10

SHA256

a14627980e66b5734a5e856033ea3b946d99ae5538e620db989137bdb3e05c5e

Threat Level: Likely benign

The file a16c7968753447c692c1081f4e08fdc2_JaffaCakes118 was found to be: Likely benign.

Malicious Activity Summary

phishing

Detected phishing page

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-12 16:59

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 16:59

Reported

2024-06-12 17:02

Platform

win7-20240611-en

Max time kernel

141s

Max time network

145s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a16c7968753447c692c1081f4e08fdc2_JaffaCakes118.html

Signatures

Detected phishing page

phishing

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424373452" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a8076000000000200000000001066000000010000200000003986870c4282a05280d0b3199bce83ff3e6e266dc699c70deed6129d0fb2cb08000000000e800000000200002000000063ff9225a972cb925f12a3f00f36b48be4672a393df05b1eeaae6a598ef8d65190000000c66d69f91488d917222252b56d87d506b7831fb4d9ce4c94d52524fc61ba88132e399a32e16fe2b1fe856c0d98164589c11c3fe218af8c08c0ee3554edd21487c14f422e7029671e0d312f8d4369da8485b4fb3bdd625cc1737fea151133af6a912c80f7ef3b12ae3841be18cccc5d3ef86133bfcdcaeb8f885093eabfefd8a76026a00997549187a813ddf935b2c442400000009f9def07b0125ff50bb96c1ec94cb03a7109d59ba023039f4b73f77c95e4c4ea5f6542b2ccaf3d16957f7de49537a86c40c8e6c2b2d56151463de68d05dd95d0 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ec80cf279b2564c91633e21940a807600000000020000000000106600000001000020000000ca8ed1e7218ff973bac2464e7f624bf1ed027967ffe3f1d225a44e224d8ebc3f000000000e80000000020000200000009d787b923e07fc42b670efe0d0da2a16d273432cebdbb1e3f55ed38be9c4825820000000e94c83f476988b8138f2e188708d3a787c99bc39cf8053a42a63d65ac5881145400000007143c3ed4c266a6d473b55e12e4b404845a8ee3a17c35747e43df9214855d841ef347302a16dc709230c71b7f1132b6b72ab09a15fe590c168d3f7c65f830d55 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80561d01eabcda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2AC86BA1-28DD-11EF-AAE0-7E2A7D203091} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
N/A N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2052 wrote to memory of 2616 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2052 wrote to memory of 2616 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2052 wrote to memory of 2616 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2052 wrote to memory of 2616 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a16c7968753447c692c1081f4e08fdc2_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2052 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.acaprensa.com udp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 8.8.8.8:53 player.radioforge.com udp
US 179.61.12.110:80 www.acaprensa.com tcp
US 8.8.8.8:53 www.google.com udp
US 188.114.97.2:443 player.radioforge.com tcp
US 188.114.97.2:443 player.radioforge.com tcp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
US 8.8.8.8:53 static.radioforge.com udp
US 188.114.96.2:443 static.radioforge.com tcp
US 188.114.96.2:443 static.radioforge.com tcp
US 188.114.96.2:443 static.radioforge.com tcp
US 188.114.96.2:443 static.radioforge.com tcp
US 188.114.96.2:443 static.radioforge.com tcp
US 188.114.96.2:443 static.radioforge.com tcp
US 8.8.8.8:53 maps.googleapis.com udp
GB 172.217.169.10:443 maps.googleapis.com tcp
GB 172.217.169.10:443 maps.googleapis.com tcp
US 8.8.8.8:53 stats.g.doubleclick.net udp
BE 74.125.71.156:443 stats.g.doubleclick.net tcp
BE 74.125.71.156:443 stats.g.doubleclick.net tcp
US 8.8.8.8:53 www.google.co.uk udp
GB 142.250.200.3:443 www.google.co.uk tcp
GB 142.250.200.3:443 www.google.co.uk tcp
US 8.8.8.8:53 region1.google-analytics.com udp
US 216.239.32.36:443 region1.google-analytics.com tcp
US 216.239.32.36:443 region1.google-analytics.com tcp
US 8.8.8.8:53 www.acaprensa.net udp
US 8.8.8.8:53 www.acaprensa.net udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab9770.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6e772f1def926288d750e32184ea09f1
SHA1 4c7c6ff8543add92aaaafa025c35231c26d6dbb3
SHA256 559828b55e032f644c67ab05b0d847489b31f8ae409244b52d2614cd29b7527a
SHA512 33d534932ba55b2678bef849b55615cb0280ec1d9548f87096ef9b3fc5b80f4040c03d4068abf1ed016d003e2196c1c8bf716239ce6e0400e02db83bc017142a

C:\Users\Admin\AppData\Local\Temp\Tar9783.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b2024b33d2bd177624e84a896c39c1f3
SHA1 71cad1926d6b346c8951b11844037f890d627bbc
SHA256 a9b4f2a6318c45b94d35490c2ed2cb1f5e26b510787f3ab3bae8a7859d3fe3d6
SHA512 147842573940bfed5743121c6b3036ae1e46f1ae0a7a80cb71f2d16d2f46a726c0d771295744346901dbd27944dea4a7e60bbfdc6e88fc2f844bf4912df7da32

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a582874b37caeb83a5864d430ef8bd42
SHA1 8fc539ac076f70480aa364210d98c68e60bace63
SHA256 c77d3837916c70d38a80661fc2b199f7af406622c454af39be08d62e6447fc43
SHA512 0cb2121c5d0dc38cd1d3c979d5aa1db7664eba60d7ce13f47f5545162fe3277fac9076aab451d0a5fdd68a56431df2ef088275e72606ab34339bea2798192db2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5d3e24491456c15fd6c9306abd93cced
SHA1 d319f3ee80c09bb993c2af5854e91f41c96a824f
SHA256 29ae2a780dcf1b690162c3f566918beb4c151dc49e0a37cb1034ea21039714d5
SHA512 f765be8fb092704646a8214df49457105afc207538a4fb2d03129ea1008a903c45e628b812715a5c874c8242a8e179ab45d8fd74807ef8cd14b7b2e7aebf3f6f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 fb68227eb10d11281164c56addb6a685
SHA1 c787ebddcc70fe10e7432cdde92d63152918d24a
SHA256 574df3ff738a617a69f1b89880138144e5a350a0ca3bb4b243639b05b1a2feb7
SHA512 e5533f81f2e89fc2457f576c0e60097c2b1bc5c2e24567575c63499dc8b86bb0693b8efbd41e7ec70f53f298ce033241a36c0797de26c52810aa0e7c2be09ce7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5b121da9acc7cd081fab119bad5d2397
SHA1 e3b7499cab0d86950637e342f5967f2e3ce9b947
SHA256 0b38bcf8b3c30857524848dc7cd10bdaf140d802467ff90207e2c7807fef5298
SHA512 fb28c35679ca25f11fa96250c3929f5ea1d76e1449c649717d2eee10183affabf09aadd570401245d262ec2824e094128676d480382721bd0df1ca85175ad820

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 156e927a63e54fc1238ed06b3386b55a
SHA1 e5254ccabc6bed1c33efc59f5a46b41beec421bf
SHA256 d1647fbe301f78d61f807fce3a684cb6927fa5393582a923bd914f34d24efe2c
SHA512 1302fb8608772ccec4ea93f2a38a75f0c89b5da728a2b03493eb96d939463e962ccda47d7027ef3baa9a0f23a82df3fb2a20ea516eaf9ad5e6ba135827a520db

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b5fe30e2dffb0fce80b296acf5ced0c1
SHA1 a93b69aa03d40b16dca9374eef97e1e00ce35829
SHA256 be63474492340a01321a0cab55321d742090ec2b4b7eaeba2d70d67ed6db09c7
SHA512 9fb03090d3ffe71c250264166b2bcd43be0048f812f274641e65f0dfab8f96e3000d3dbc7e226a887d543c8f88997a968f9418e18e28ea74a7bb7812a5ecb5a8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 014a93ac167d13e1d4419ccf38723fe3
SHA1 9aafe763eaaf6c2eb92b9a6ba1dc23cfc4417de2
SHA256 3ee22cfbb0d27f0d619c6afaf4cb7f0e98cbacd69f934bc645808d3439b3006f
SHA512 8310a61d875ab3edff689ae2b061d3686f1c136ce08cf718e08cf9f3618ee735cc80262ea968650ca5b37ae12f4313ce6fbe9272395a22a89cf84bad9766a41e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e5385cf0d47ec5a17efe80e444464a83
SHA1 5e01b638d9916722d97b913f67918a3d2987dc69
SHA256 d7bcd6196be2360d83ce7c40ff891450a6f5fb7fc563dcc172e7812c1e2469fc
SHA512 6eacf7c4551cc4157d5ea9341c69f391c47096011f38c1db3173c7c8e56f40856aab059fd03cd209173034eac8104e1fcf43f662aef3e7fff5183d39f7ea647e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 56d4e532194468f74087dda502678600
SHA1 643c612b8efedb5c534f6933c81f2c0c9becba60
SHA256 a8ef2e2ee4ae77b73dacfb7d2c7dabab0f096dac0bde769ec11d411561890b8f
SHA512 94886606270d85d0eaebbe2b338671f782973ae2c71beb55bdb1436b035925ada1237db8333e2f4f4a0ab25d5e4a065d2d19f9daf1904864531763dde65cab90

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9a728b2f2ba7d11bef0172a459a3c724
SHA1 5f6fb7e3395bd933bda8a2b6836f087bc94b0458
SHA256 1a5dd2585208180fa4fd7752a23b68e75b68967c144e107ea83e435972ffe1d2
SHA512 75c17c948f10df8f2f96170acfdc9148505f67adffc26e98d0544fabbcee591437713f18746202a4404dbb3b3e022cb5bc554a1bac5965b4e6a65ad3b5462d28

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7dd8d52e754b9caa7348c69a8cc2283d
SHA1 5ea6e5b1ea3fe103ea3409fcb3d4e574b971bc7d
SHA256 f5c41e79885cabd40e63efcfcb8962f9f320523a1125e63186f4d6a62125bac0
SHA512 bcbbdf9f08bc5f95919086d1f0ab4c3b78cd7655d4b71ca75bcdc29a565502bca737a7420c4a32ef892f34f8fe3cb8b923f6cbb860b4ab52ecc14f117e16bc9c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8ff76e6045bdbb73b60434ebd2823553
SHA1 252e419f43c2b4171c71ec72ea3b48864365e07e
SHA256 05bfd3dce6be6baf9eca9cd5004386997dd7b5c385ab771edcc771ccdd61df1f
SHA512 154afee50c3c6b3bde83ba6fa0ca4179c6e49a234d420580ee840ba1a91660eeebca63520009c7d112128ca0476cc20420c9bc32846085e0a912c44e7ef6fa68

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d2918c420f773253b1a8d803d4b940c0
SHA1 e120bce5ab8cc7d838dd67ada9cb211a0a3cab31
SHA256 c3f6fdd71ba09dae2e73cf098fb7d373620763dfdbf4bb3bb4858352ffbe7906
SHA512 4e4df260e5004dbe46cdb5749b0bff6c3dc180e4bd60ee0901d4edd81b1207491281198625add41228786d9d4bd44629102105163bdeb76e7dbb2daa6885ca82

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 514da875335e4c15cedc8ad3e6fbede8
SHA1 eb49edc32c88f698dd39f81ff8a6bc5d77c667b7
SHA256 9c0437dd2f7be46bfcbf28f29f6e5cbc89131b3b628214ab63f22d51c5ca0bab
SHA512 45d9c76534c9cf59b0ba27caf7b2e0942912c447a667b417c557e06b8e5043adc2989a0ba92ae93cee72f8f4606155472c775fff7c6caca4fa151088e3f6d21c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 420d67c3656a67d803ff045d45ce8ae3
SHA1 9c0654588706811e0f2a3d0e5784cf6df291f538
SHA256 4b75aae4764e593e2a3fed26e18e62a0c36967c2d055ac46e1dc7b92becfb2a6
SHA512 20a3fdb0a15bd0345643174c901a211ffde296598fe0b967b2240fa6cacb326506c306ca84510b5ec7dabee6476a401b957c8620bafc5fa9d7f3cbb9bd6bcafa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d70f0c6a5ed68bdecc5c15b77334397e
SHA1 efa43e71a25ab02841b5b172df51eae73d6d9f6c
SHA256 5e1c253ad4d24d1a7aaa851505ea818618aa82557f22a4ff8099499d53a4673b
SHA512 ad38125bf563e250086f258ed80cb979f2da1732be7b828253a75cb9ab2fd307e05cce505439ece4f88b6c525be9e23b25ad66d14ce1c6a02bffa119f7fd2e94

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6774c0dab6bfcc2d3a69566f1bcde432
SHA1 ab558f212fb5cbc155af8ad556f2baf036e127be
SHA256 f121a70a2173a5cb84524cd22cd99c45bba767b770dbac42bcc15d091baf01db
SHA512 d900f660bfd2e46b359ee83184fcb0ecfd2d3ce60d7cdb01f6588ce6138c07a166e060517a974e5b56babae332166640f6c7b6cc2e07f46a434f34864b07feeb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8082cc83ac568b57434a7aaf5cd41d63
SHA1 f83b64535605e2f156fe471fd8e9c2bf6f11064d
SHA256 4485fac0c10b5d442dd79e789aff52d73959fdf3acd8b2192509f06a79f2fbb4
SHA512 7a02e49880f51c59ef084d68dd337e731e09bf2be41267412ab361c2249ea8ac5c8ed3001f4fc012e9d5997e628a9f34d26de3ceb53ee0f0d2b115ab4bc7ee5d

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-12 16:59

Reported

2024-06-12 17:02

Platform

win10v2004-20240611-en

Max time kernel

138s

Max time network

148s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a16c7968753447c692c1081f4e08fdc2_JaffaCakes118.html

Signatures

N/A

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a16c7968753447c692c1081f4e08fdc2_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --field-trial-handle=764,i,2029050989380753659,15333598055019363793,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --field-trial-handle=760,i,2029050989380753659,15333598055019363793,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5364,i,2029050989380753659,15333598055019363793,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5384,i,2029050989380753659,15333598055019363793,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --field-trial-handle=4776,i,2029050989380753659,15333598055019363793,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --field-trial-handle=6104,i,2029050989380753659,15333598055019363793,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=3968,i,2029050989380753659,15333598055019363793,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 13.107.6.158:443 business.bing.com tcp
US 13.107.6.158:443 business.bing.com tcp
US 8.8.8.8:53 www.acaprensa.com udp
US 8.8.8.8:53 www.acaprensa.com udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 2.17.251.21:443 bzib.nelreports.net tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.237:443 tse1.mm.bing.net tcp
US 204.79.197.237:443 tse1.mm.bing.net tcp
US 204.79.197.237:443 tse1.mm.bing.net tcp
US 204.79.197.237:443 tse1.mm.bing.net tcp
US 204.79.197.237:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 37.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 110.12.61.179.in-addr.arpa udp
GB 216.58.204.74:445 fonts.googleapis.com tcp
US 8.8.8.8:53 21.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
GB 216.58.204.74:139 fonts.googleapis.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
GB 52.123.242.9:443 tcp
BE 2.17.107.121:443 www.bing.com tcp
GB 52.123.242.49:443 tcp
US 8.8.8.8:53 121.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 player.radioforge.com udp
US 8.8.8.8:53 player.radioforge.com udp
US 8.8.8.8:53 player.radioforge.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 www.google.com udp
US 179.61.12.110:80 www.acaprensa.com tcp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
US 104.21.53.2:443 player.radioforge.com udp
US 104.21.53.2:443 player.radioforge.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 179.61.12.110:80 www.acaprensa.com tcp
US 8.8.8.8:53 static.radioforge.com udp
US 8.8.8.8:53 static.radioforge.com udp
US 8.8.8.8:53 maps.gstatic.com udp
US 8.8.8.8:53 maps.gstatic.com udp
US 8.8.8.8:53 maps.googleapis.com udp
US 8.8.8.8:53 maps.googleapis.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
GB 142.250.179.234:443 maps.googleapis.com tcp
GB 172.217.16.227:443 maps.gstatic.com tcp
GB 51.11.108.188:443 nav-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 data-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 data-edge.smartscreen.microsoft.com udp
GB 172.165.61.93:443 data-edge.smartscreen.microsoft.com tcp
GB 172.165.61.93:443 data-edge.smartscreen.microsoft.com tcp
GB 172.165.61.93:443 data-edge.smartscreen.microsoft.com tcp
GB 142.250.179.234:443 maps.googleapis.com udp
GB 142.250.179.234:443 maps.googleapis.com udp
US 179.61.12.110:80 www.acaprensa.com tcp
US 8.8.8.8:53 2.53.21.104.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 234.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 188.108.11.51.in-addr.arpa udp
US 8.8.8.8:53 227.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 93.61.165.172.in-addr.arpa udp
US 8.8.8.8:53 14.213.58.216.in-addr.arpa udp
US 179.61.12.110:80 www.acaprensa.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 www.acaprensa.com udp
US 8.8.8.8:53 www.acaprensa.com udp
US 179.61.12.110:443 www.acaprensa.com tcp
US 8.8.8.8:53 www.acaprensa.net udp
US 8.8.8.8:53 _8000._https.www.acaprensa.net udp
US 8.8.8.8:53 _8000._https.www.acaprensa.net udp
US 8.8.8.8:53 www.acaprensa.net udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 www.acaprensa.net udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 www.acaprensa.net udp
US 8.8.8.8:53 _8000._https.www.acaprensa.net udp
US 8.8.8.8:53 _8000._https.www.acaprensa.net udp
US 8.8.8.8:53 www.acaprensa.net udp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 8.8.8.8:53 a.nel.cloudflare.com udp
US 35.190.80.1:443 a.nel.cloudflare.com tcp
US 35.190.80.1:443 a.nel.cloudflare.com udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 1.80.190.35.in-addr.arpa udp
BE 2.17.107.120:443 www.bing.com tcp
US 8.8.8.8:53 120.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 63.141.182.52.in-addr.arpa udp
US 8.8.8.8:53 241.197.17.2.in-addr.arpa udp
BE 2.17.107.112:443 www.bing.com tcp
US 8.8.8.8:53 112.107.17.2.in-addr.arpa udp

Files

N/A