Malware Analysis Report

2025-04-14 03:45

Sample ID 240612-xgtc3azbrk
Target a1d46ca5d1dd3a4128aaf74091f63f91_JaffaCakes118
SHA256 effdd1c1c57245f1fe49e94f2f17647bed46667a22748f8536779a8d493ba6ee
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

effdd1c1c57245f1fe49e94f2f17647bed46667a22748f8536779a8d493ba6ee

Threat Level: No (potentially) malicious behavior was detected

The file a1d46ca5d1dd3a4128aaf74091f63f91_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Suspicious use of SetWindowsHookEx

Enumerates system info in registry

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-12 18:49

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-12 18:49

Reported

2024-06-12 18:52

Platform

win7-20231129-en

Max time kernel

138s

Max time network

149s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a1d46ca5d1dd3a4128aaf74091f63f91_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000042e7f597aec3db4d8bd11df56d91b90100000000020000000000106600000001000020000000464e2cff6dbee76f9621132005f3077bdf3d7e3dd8b9a7e3375d0b9be065191a000000000e800000000200002000000085f31d3f0b73af1988a9c681a4c5a0f40f43bade7801776f6916f5695d2578d620000000f22b14602d1510aa7b61cb70fa512d5bd10fbe4eb5dfbe111e9712e3d4e784ed40000000421ed2062ebb6fda9b341c80147564687aa67160142382db63b8c512b7906c0049a51f08b894b53d2323aadb9c4c03f00fa3c2a69cb0d2f0501d44820cbb36e2 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000042e7f597aec3db4d8bd11df56d91b9010000000002000000000010660000000100002000000064d089688659bc09ac0f8a185a36115ab007795fa63bbe37b716bad0d9e51e82000000000e8000000002000020000000e3df09b150c4e5470669d018f4c3c4a1186cc1bbef3c5ed4e7ba21b625c9f9b09000000076b614d1729453cad9735d91f8bf0f61d16b4054f7aa7220ce8ffa55f10b24f33da3da92def564b8130f58cc4110a9405a5da114dd77be3b1eb04077ffa09200a7863befea2da81ca6689a0bd23457c0514291231234add51d1bce6af4c64f8ba55077a01700a7078c351dfeea9d87d5fdc3589a895a2e6d27e9f88a6fc750a6081c6894ab29b1528ad162eaec21298b400000001156d51be8ef3d88be482dd070309a241dca73d50a5a6cbfa7ad4bf278c0528ac097ee88464a787efc61c33bd37635b85ea15f44eb51d045857a41db24f10816 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8FDEE871-28EC-11EF-A140-5ABF6C2465D5} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10e76ca4f9bcda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424380064" C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a1d46ca5d1dd3a4128aaf74091f63f91_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 css.digestcolect.com udp
US 8.8.8.8:53 www.mcsoffroad.it udp
US 8.8.8.8:53 getmyconfigplease.com udp
US 8.8.8.8:53 dest.collectfasttracks.com udp
US 8.8.8.8:53 adjust.admarketlocation.com udp
US 8.8.8.8:53 forwardmytraffic.com udp
US 8.8.8.8:53 saskmade.net udp
US 8.8.8.8:53 hotopponents.site udp
US 8.8.8.8:53 sdb.dancewithme.biz udp
US 8.8.8.8:53 traffictrade.life udp
US 8.8.8.8:53 dl.gotosecond2.com udp
DE 142.132.202.70:443 forwardmytraffic.com tcp
DE 142.132.202.70:443 forwardmytraffic.com tcp
US 75.2.60.5:443 traffictrade.life tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 75.2.60.5:443 traffictrade.life tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 172.98.192.37:443 adjust.admarketlocation.com tcp
US 172.67.151.247:443 saskmade.net tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 172.98.192.37:443 adjust.admarketlocation.com tcp
US 172.67.151.247:443 saskmade.net tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 15.197.192.55:443 dest.collectfasttracks.com tcp
US 15.197.192.55:443 dest.collectfasttracks.com tcp
DE 142.132.202.70:443 forwardmytraffic.com tcp
DE 142.132.202.70:443 forwardmytraffic.com tcp
US 15.197.192.55:443 dest.collectfasttracks.com tcp
US 15.197.192.55:443 dest.collectfasttracks.com tcp
US 8.8.8.8:53 pki.goog udp
US 8.8.8.8:53 pki.goog udp
DE 142.132.202.70:443 forwardmytraffic.com tcp
DE 142.132.202.70:443 forwardmytraffic.com tcp
US 216.239.32.29:80 pki.goog tcp
US 216.239.32.29:80 pki.goog tcp
DE 142.132.202.70:443 forwardmytraffic.com tcp
DE 142.132.202.70:443 forwardmytraffic.com tcp
US 15.197.192.55:443 dest.collectfasttracks.com tcp
US 15.197.192.55:443 dest.collectfasttracks.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 15.197.192.55:443 dest.collectfasttracks.com tcp
US 15.197.192.55:443 dest.collectfasttracks.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 204.11.56.48:443 dl.gotosecond2.com tcp
US 8.8.8.8:53 cdn.examhome.net udp
US 103.224.212.214:443 cdn.examhome.net tcp
US 103.224.212.214:443 cdn.examhome.net tcp
NL 23.62.61.75:80 www.bing.com tcp
NL 23.62.61.75:80 www.bing.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab1CC4.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar1D94.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5MK8RSJO\stats[1].htm

MD5 023a6b42adde31d4c6bdd07b0419eb44
SHA1 273ed1141a88a5c3d5e6df223850bb587a571bb6
SHA256 61dacf8b561d397f5884b675aee037bb1446338a7a7e70eac6d24c16bca6d18f
SHA512 65a1d8a56cb227922bf99cef4af502d058b9bc4a90190ecec0c4fd0dbf19e7f8d639714f7ddc9d685de2de19d78b6eac50f58e4f50c3dd26ab247e0cc8dec84e

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZADZOIQN\scripts[1].js

MD5 9843a52c0d0aa74fc3932786da1c08e4
SHA1 53eb1eb4d6ea1ddb99b7c70cf2cc1c9d6840fe8a
SHA256 e5e9461e9b011f638acf9005de291211e659038c03678ee90d768eb7a2c798cc
SHA512 b85852b366e3b4f33aea529bdfdb1fb208beb8499508617539de900160a7229d06c0a3182a546afa79211f7b5b3d3e221ff92bfb5b7b1a82047b3a3f8679696c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 29cea9cb5f27eee96a6ed72562e1fe15
SHA1 f98d38bcb4d1879ab76223e6f35b65c35b4f2751
SHA256 318e8d0015356e18618502175e19b35d23f7b7e802b555ab91faa94dae829201
SHA512 42022fe9e8bb19ae5166b71a92ebfe441b7a7740a3b9d91a568ad6fb4371a4d35a85a0dc2c5afffbbdf87d2d9ca7ced96396a4ecfdbb414242fcc3ed4bae82a5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 7662153a423af468270d96bf78f9c770
SHA1 b2a7749d79d20df36937e9971f57f1195435fd17
SHA256 332a79b655d69733940efb9b3324d3e0d1e8e68a2ca4478acc354b390c311084
SHA512 c2f048986eac0f1a64a29fb25f051fd76fef093a583df16cc4b58a49d062e88a2270859301708669a66bf70cc0c733c126b34b5cd5a4e189967a9e57e1a297b0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 12d6ca916c26baccd54acb8bf70708d8
SHA1 d338c59f7626b165fed2707bd61e536ed94c87f6
SHA256 1cc42d516f1603bfd59acd9f578c0395d1133e3ef659623f2e6556da89a4516c
SHA512 f0e395374aba62715cef6c7c67837c70b1ec62a65510064dc707d332676e533d7c2d2018a6a8ea184416dba175ee623d790a6ade4e25602c24647a66a3523d96

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b7770a885e38cfd2a65fa2431f5be9eb
SHA1 ba281ec58de539ad92c4049a6ee9437b4a9a2b50
SHA256 507267d4386886f82f34e4a2b0be6df1eb19238e2218345c09e218d9d7c16357
SHA512 38fc15ec9d15f92dcbd85abe954342748a5fd70239306460649f651c0f356642cf98a0aa6090d0bc64363aeb30d6dd40a2f1ebc5cb71b33ef74a6900e8f31015

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ad23af5256af2d6dc06a5db5e9a4b35f
SHA1 6c0b6ffcbc6eec1722e92e5b2929def945865146
SHA256 5bcf906bb3e58b6411c4917fef0531c3a443c0540be5fdb113d0e16177bebc72
SHA512 5df4b43056122e529a85b2c06eb8d80da2550ccce03d7aa22338499e9b8ad5f0614e1063f304052c5563ef22704976f99a3fb27dd5e6e644729807760f38abaa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 b565a2068ff2037ca52b2e8573669af9
SHA1 1290f5796fd58cbf0f8931b96bfcd9d65b038552
SHA256 0643a9b7ac3b15dc479ff67c8f58c598acf9dd49a0dabbfbbec31b7e7413fded
SHA512 32366a486e63f63b8d0eab0c0431f9d3943de8010f31e37a5fa28599954dfd7525a69321fac4446854a2033bd01bc878b072e1698434b5b728e0cbc04fdc86be

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f29e3f5979e72d3625686faf098f2bad
SHA1 f4d8b7d73d4e42cebd98eb371afb41198f3e6118
SHA256 31793091c788a07b7934bc924ced5b40f9cf6f9cf495f18452e4d8c6700ee8a7
SHA512 ce40238332e0a3f3b54f1fe5de6ed0264f7dcf26eaba917fc09346f1b4bf0464723e1a1a088d051dbf9e9ce8d2591d8a50dfa97f9eae9bfdee4405fea883ef86

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9cadf4919e82f6760c25c229449d95e5
SHA1 67713f5706c4c760f2bd68b183e4742269cf669d
SHA256 aeee389d7e586c20940bd673242dd27410f0e587774bc11d7accafda92c33fa3
SHA512 2c874edfa07f0417c02054a69ff88382eb7ccb3642ab9bc190526aceb4082aa552f1841ea707cd51e5ca664a6544ab0fd703c53b793ddec4c968b7d62dd52092

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5beeb3f349402c875df619be143eeee0
SHA1 22b2e656544c9e38e10333d2ce04b4e2dd3df5f1
SHA256 73f5390cbd978dec734de62520310106c2c7fb42c75d15e032bc2803eaf53e1e
SHA512 cbeeec2d5283d06a117391700c091c1671fa891d020bd4813d04f83ec09c755e156355289d16737f8dfb116d67ceba0852e8ee6eb395d0d982bbb41a0d2626d8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 45a045b027879aa32dd49f73edf94229
SHA1 863bf50845ede8399a35724f2363f4e5974d0c67
SHA256 0aec19a46732182c46a207023a5fe58bbd8a04fe0608c68d236ed3493be7046c
SHA512 071d30331c6d3b1fd737b881e40cce343377d2018d78d05ee9f7df374b072340a78ebae4267e25a82ba869ec32253a3b0abe69ccde86def0302d7bf709ef73b8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9ff3e7ca00d4e5d95ae423f9354ebd23
SHA1 03a06042f4ef708eae36242642948a0631d6d5db
SHA256 b79be50a03cc7a466bc4027755ada1f4f64e3e27ffa1a0badd3ac8fffd351422
SHA512 4fa8c7b2a634ed81463e19cffae3659d239fa2ebf173cf05dc9a684730c4466ba0897347f6792aff336f2a0d4bde44ad28fe8673e5e1ea1615316f41e61c335c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a1eb1a3a215130767b710d6df3eccb5c
SHA1 d1df0953c7fd0933f05c55b3acdc7ab3726d8d3d
SHA256 42fc0db4c79aa2330de41c597293ffe55719dc896efd8abe86ec0ef2ac0a2372
SHA512 f744ab17af15d56b833c8bc1a62f93b4d02b5f66ad357e48f69bd46146650b3feb6a6181e519ea1e648e35ac4fa0da35c570c68d92b4eeb05ec9b8a65a70448b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a62dcb94195d57b589365160b959aec9
SHA1 83c315c3673f0147b7e6ac42679310476de34f9e
SHA256 cac0c1ea19fd95447e43270b9fc029d1bb4e8ef5b9c65315482726b5e02bc632
SHA512 f6c4360f4893e43188bcaa64569c941e9a3a96d10e203729ab65a709bdb19949f85a89146492afe6ac791edb4c1be91015b944a8aa9ba8ce8ad1cf5093867485

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 904515d543fbca97bcd2c8dcd9feb1c2
SHA1 2f442f79d4732ad6fc61f2ffe0e4923ec409fa0e
SHA256 5a1ebfb46bc1ab2184150526368f3f5f548ef34be71de72ef7e4d9633c6f5f5d
SHA512 5596922fda6d21e05e9b1be95d5b3052f41dc347230ecadb8c57bd855470d7b3492d5ad2114bf5b4dc301d01c5c7477a402873b40b3d476a82af049f72143d0d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0f86e4b7451eb299687e2448a86e6c8c
SHA1 dccab8eb4ad748ab08c6120b36cd6dae4f6cbb4b
SHA256 561c20022bcec3eb639540db2f38c4ee6a808d9f6c2cbf1f647726d48bc93357
SHA512 cd920a4ea5c7421d04dbc3ec4882a0b554876ba78f0ace8d0d1ec2059e36f7c63328b759d6a7442fd6c57f3ccd1a70eef4f194e0929e007b3241dda056239724

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f24a962e4c978e4ac45bd4b85aa640e6
SHA1 d96719e337015714602e2390c2e7a0b4e24d79c4
SHA256 2f2dc9c8ebc6684621da42a609283e5543e8cd604acc0375c7f6a28c9454a8e1
SHA512 c28446f3ffd59b746c19beefd663cb9cdd47f0dcad54b5196a181c755c59423eaed587f2dd58748ce379299bef7a9ed3a28a440b480539aaa10b8fcc41035de5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6106bb063419540cd670007196738a0f
SHA1 aa3d1516d0b046eb42171128ce0a2b4e175adbbb
SHA256 ae28bab9ad2103efe424ae446ec1e70f8cbea74b6a3ffcacb9d50f101d37330f
SHA512 0b6d2ae6290b90d1632da4fda73db6f749d135a2cfd2cafe109ce3f66f4bf26ed2723e890f208a477de1964b02ab947b0985d3c75efb2fa9ae0e06261ba83016

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6c3e96cbef50827811714e62ff93f887
SHA1 57f77550234c3461beedc35ba06d0cab45d76b49
SHA256 e8b394e302d3a48bf829afa3534a6bdb9f850b7b62fc952e3e9507f4c4cfaaec
SHA512 12cbf668e67e6c48a1c0789564a8f13d0dd0f92417ee88d5348f9a91d3c36a0ce147096a1477a09a1ce1d7f3a2f547b4347badba8487f2dd13a5262f75a769da

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 da480bb3299f396878d17bea480c1f19
SHA1 fb8fd731f4567398c9cc43b76866bd3c69c15aeb
SHA256 7ec2041035cb50193998aea9ffea428bd7ccebb8c2942fbc96c6c9826c6ab755
SHA512 65a6f7517eecb7e97bb727b2f9ab22d65e7950739dfa35a57c2973318342fc5edb2dff13aeef96607240c9e1f75d1a03d58fb3aff650660602a70692652eb48c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d038169aaf181136d1f42067ab56e5e6
SHA1 1a670a78c681c08b8093cf928f957d6c1d6d6152
SHA256 784a255106417dd62e36b8ad4f7de42140d5afa55fd675c4c4c28d15ef961065
SHA512 26417b0e4674f4242bf015ca99b891ce444e4be823e32de571b1ba4d19a9fe449268ff5b80efb4308edc8277be9e5194edaca6916009f8a025470700b7468242

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b38d24549a75faa382b92c27f02c3f6d
SHA1 f52a94da08d92c8b773dabd81949e40efe8a6404
SHA256 c8eed6d2b1c908d9bf305b30e6b892f7c4ffc208db8b26450a49e4217618dc06
SHA512 801dd8950b56f3653ae841e203ea78b531c7879f63707a1f9bfde7a756dd45e654e1ea9f45d6e26f81d0b083e2f82ba085d8eb0b530b10597f8d49be422b8faf

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 61f24306db66e23a23b9b8c4289bb5b4
SHA1 eca8a35ed9431cdbd6880f7b8e882f4ce685d938
SHA256 4b7acf35c1ae85ed6b878056215da03f6c651e80cf3c4b8a3d9f4b4ffc16dd02
SHA512 27988a879de5d3d76ea4fbda96dc9c3f74a3b19e2a14ed28ce88f900572d3e96d9424cc9ea8ad5694f694e14146e20572ed3cffe8654336af64bd2a8be0edf8a

C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

MD5 da597791be3b6e732f0bc8b20e38ee62
SHA1 1125c45d285c360542027d7554a5c442288974de
SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-12 18:49

Reported

2024-06-12 18:52

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

125s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a1d46ca5d1dd3a4128aaf74091f63f91_JaffaCakes118.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4304 wrote to memory of 2128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2128 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 2368 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 5004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 5004 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 4152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 4152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 4152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 4152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 4152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 4152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 4152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 4152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 4152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 4152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 4152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 4152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 4152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 4152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 4152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 4152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 4152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 4152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 4152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4304 wrote to memory of 4152 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a1d46ca5d1dd3a4128aaf74091f63f91_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97d9546f8,0x7ff97d954708,0x7ff97d954718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,5994258422932879544,17067280248367382555,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5464 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 css.digestcolect.com udp
US 8.8.8.8:53 s.w.org udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 css.digestcolect.com udp
US 8.8.8.8:53 css.digestcolect.com udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

\??\pipe\LOCAL\crashpad_4304_ISQHDBQGGRDSUGYL

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8afef6236bf143423a72a26a51e0dcd9
SHA1 5e0dfb273a0fc26351f9e7d343b9d49b21b7554e
SHA256 fb7ee0bd8e12b233cf35316edd08915cd66d3f0da1bc713be68fcde3a8d75ff1
SHA512 62d74d5e61965f7f5d98520591faa17440354abbc2c18a0b3002fa5b1118d12fe4cec357073c5268e8c61fb9ea2858980f29647d46e4a09532fbb06b2b16e05a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 30a365c4e9615bb31910a50efdc5d919
SHA1 4a8359455b6c70a8e774c1b5bccc5808e4eb5288
SHA256 e7e78251a23fc363a47374de33b960087c6ee13c0cf5014cb29d5cbeeaef98c3
SHA512 2fc8e079146781231d40b9e803f9879aeb7b2ff823167526d116bd929e45fbb90fd3e13a69478513b646fc52addbb041f2cadb54aa6805806136fa0fd2befefd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 429f54f92823ab87b606240dfbc37ee1
SHA1 3ac886f6e303fdee0ae3dad49a2085811a534907
SHA256 a272a36de17fecb29e2c80ae2359758405a50ca4affb555a7e8a1c5c086ac788
SHA512 f820ca92e0ca75d9fd431f9c3d7babf06c1e8c304331f49c90ec283284e467e4547df793ec9255f6f66081332f9eb2dbf5bbf52e026ed5fdd8ec316c79d64299