Malware Analysis Report

2024-10-19 09:36

Sample ID 240613-1dn6qa1bkc
Target a6a960c544cd8905befbd21fd9cdedc5_JaffaCakes118
SHA256 63b8aef384c437824c54047f26c13029955ed664e07c92e14c45c745559d2478
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

63b8aef384c437824c54047f26c13029955ed664e07c92e14c45c745559d2478

Threat Level: No (potentially) malicious behavior was detected

The file a6a960c544cd8905befbd21fd9cdedc5_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of SendNotifyMessage

Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates system info in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 21:32

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 21:32

Reported

2024-06-13 21:34

Platform

win7-20240611-en

Max time kernel

117s

Max time network

131s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a6a960c544cd8905befbd21fd9cdedc5_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb81000000000200000000001066000000010000200000002ef5f5905240e5cf94cd14cd5f32726c132a7161d8e9c33707bad9ffdd2ff575000000000e8000000002000020000000933e2629c3991ac7d5973ced1d7573533f940e78b89207118374af5ac9821810200000004ca858a88b490b19fcaabd56520c2da684b403333ef7e715abf302c0175d0f5840000000400f8cae36c8bb35aa46563b09139cc30b639c28816e30e75e9322bfd247e58beec5108a5edb0e3eacfff51d49864ed8335f396b2e84df0e8544a6bfcf8c8abd C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000b2968c6cf60b74b94229c882944fb8100000000020000000000106600000001000020000000bc25f898386d5f1a662a44e69c33ff22a9e07ad35e83e57884bcbeca0b5bc900000000000e8000000002000020000000b99eb69383abd67c3b47fa38db3a7a5dbb48211b44186eaf54e0c5e552d038e290000000c2c41b95fbae9179ec657788dc5bedf9be8869745f499c50dbbbd7e320141ed6181852a6c3f9e24a8e7a28280a0748c56eb8c0e24bf801e517e57623cef470f9c96eeb7df3cb29b267076b21d8002bd0f2447a36362846b6eb045ff81a71c7405d8a0084fcc2000fc7b88bd2af0cbe4f0b37c3f8a223102ea0272994d06f07bc1bc062b263309e0b1e24c4e1ff03de95400000006080b6d09280b1ac5de4475cfb392e9c4f9d5834daa5a1fc8da99482d4b627d07dec5de7af9eb71a3b95ab2f46ba12775dd547ba97128f7d4f5e5671000aff2b C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424476205" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4054573cd9bdda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{65FA2C01-29CC-11EF-A85D-46C1B5BE3FA8} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a6a960c544cd8905befbd21fd9cdedc5_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 buro075.nl udp
GB 216.58.204.74:80 fonts.googleapis.com tcp
GB 216.58.204.74:80 fonts.googleapis.com tcp
NL 84.244.165.144:80 buro075.nl tcp
NL 84.244.165.144:80 buro075.nl tcp
NL 84.244.165.144:80 buro075.nl tcp
NL 84.244.165.144:80 buro075.nl tcp
NL 84.244.165.144:80 buro075.nl tcp
NL 84.244.165.144:80 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:80 buro075.nl tcp
NL 84.244.165.144:80 buro075.nl tcp
NL 84.244.165.144:80 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:80 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:80 buro075.nl tcp
NL 84.244.165.144:80 buro075.nl tcp
NL 84.244.165.144:80 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:80 buro075.nl tcp
NL 84.244.165.144:80 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
NL 84.244.165.144:443 buro075.nl tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6F0O117Z\jquery-migrate.min[1].htm

MD5 4f8e702cc244ec5d4de32740c0ecbd97
SHA1 3adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA256 9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA512 21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

C:\Users\Admin\AppData\Local\Temp\Cab3B7D.tmp

MD5 2d3dcf90f6c99f47e7593ea250c9e749
SHA1 51be82be4a272669983313565b4940d4b1385237
SHA256 8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4
SHA512 9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8a023e9af78309e39785fb014819febb
SHA1 1d83c43d3d9098ce755f6072861a1941d23df70e
SHA256 6a69ca514919c721593757ccbc0d61e7a2bbb7ff355784da65d42f2833902bbb
SHA512 de1401dddcb09da25e18c3ab1ee5ee13750bcc0c8230b9b1bed5fb12d69f013a76512429e784d20744d5a87371f66f58ccbdfc6d3ce21eb32df0a80eb14f4f3a

C:\Users\Admin\AppData\Local\Temp\Tar3C31.tmp

MD5 7186ad693b8ad9444401bd9bcd2217c2
SHA1 5c28ca10a650f6026b0df4737078fa4197f3bac1
SHA256 9a71fa0cb44aa51412b16a0bf83a275977ba4e807d022f78364338b99b3a3eed
SHA512 135be0e6370fd057762c56149526f46bf6a62fb65ef5b3b26ae01fa07b4c4e37188e203bd3812f31e260ec5cccff5924633dd55ab17e9fa106479783c2fb212b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5c2dccbd0bbe70992bf4b85a2417e489
SHA1 2b8327b2c5fd7532f8e813f81dbc06bad4d6b48b
SHA256 8c256b1a3958886f8673e64af9618083ce84d7b2c1ccdac1200ae21136735e3e
SHA512 61eab8b1d11acfa586f3299a22247f38100ee913e81e28907951a2b1d7a862508563aee9c84cd5985316215c4a8dcba9e89d0676ec464e56aa5250f78cbacb39

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6b5990002092c378045391e1391a1c5d
SHA1 49c58d000df8a1569f0da7e71aa76cd9a141a9e9
SHA256 5f53d949799c143545b9e3075881ab22b133c55e92ae40074ead640564325399
SHA512 43eb4439506f4c098efc7b61db161ddfa51bd117012ea3e931f7ffc88c7ecb474749c87cc44a35336d8a867b52e0c1bbda5bb8921ca2eb51c867fbea9905dc39

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d321ecc31657a5b3ac450e7ff7ed78d6
SHA1 b852d08f85cab4719c9b66f4c53c41b3a171150c
SHA256 4502ed93f043097324b528ba24229ab0f32895171ce59b5605d1de9b7920f6be
SHA512 b112b6e6cba8898ac092b3afca338202e663119669a49ca203fd2f62367661f6653a03c7adda8b419014197b6342e8cbd3cb0cdb2c045ea8fba352499c239454

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7bb2aeae82b381ecce2adfca630c634f
SHA1 ed0dc2d61049b912209327746fa7ed424e33e474
SHA256 e146aef20ba39a6c569f3bb2c1240d94643d1a09d704b9fbadef9a63538fabfc
SHA512 70a54fea66bfea4607479b49d481af32841389f6a86376f9717b1b7f161d1bd16164178654d950313665a8378be959813aa30d9d9956ae2e0b8aa45b62b3eea2

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a316023009d4da3cacdafc70e8b98e40
SHA1 ce6fa04be917786cd81c7a1ee76a71b2e6965ce3
SHA256 75842009065ea270d3769d102a98541668dc6332886e624cf967483a565db5cd
SHA512 c9f83f25badec86a5188ef0188dbc778727c9028d2c1b13f7dd1fea2dc3bddee8987deda1deb2348a88e1438b41d9b96be8b7f723c4d120c368cada2495bdf66

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d2466cab8ded4a9fea4bce83b6915183
SHA1 73fd2f9681402bf255b9e2a5c99ea81c5caaa981
SHA256 43cce8712b2619c0e72bd42c58c04d8cc61030e1d763b8a0d7806d9f98b275bc
SHA512 30c3de3ec59e539c8c9cf6532f861c6226a34b84fcdcd7c7b8699738db59a561e36150ce74240e365872fc2524f221fedc5431df7071d05028b5282074235737

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 22e21da579e15af15f26a92cd0fc8025
SHA1 bb8b41808ae4b442d7e301c7dbc9c90d4bc958d0
SHA256 ea64370c6a3ae79babe3a8d28641f8105d8fb5b755328678e22d91a9b4c4b52c
SHA512 38c8f633c050210f796cecd9d2f18a4bdf1a0def5464ac08010e212add270af748cfafee3bc238894e49bfac94d5f99d04632057a4775816c021034f5268ca10

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b0102b5e1700cd0447b9e134b563eeac
SHA1 a734eebf75f482c7bfdc85aaed4a6d04d910ab75
SHA256 7815ca9fdd71f32be0d5e347c3014093d75ab989beb8f8473c7996da7f30130d
SHA512 8802b970f83b86226f6b50cea8fca6be6346f040bad3a8248b3434702bbc9e4d71238972553771de695870cd4807c6f8edf694bacd73f7ffab69bb2a1ae46b2f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 95ee378e6239f3119e8a99ca2cce21e5
SHA1 92e84dc715c87e05be60e491ace07f59018a54d1
SHA256 4e4751d3c149b5cba251aafd918088e9fa8e3d84ac1d2db4541fddb6cbcfec05
SHA512 ffa27f7eb3e255dbb18ed861186645c21b347beb50e77a15a745758dd6f2704ffa1e897d046ce8b5a792bfbbab4a35311478443129357f22ad75234e6aefea4b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a77aa51654da405c86d5a02bddd732b9
SHA1 ffbdd70c3ad95690eb8fc07568e5e70a002d057f
SHA256 0d8701cdf368a70492d96e3348fa0fdfd5ddfab178c3a05b04d60470f51db0f5
SHA512 a6d94bb3036ac6e80d8f4ae0ff8e55c1a882e4469f2a0aee9fa27aaa3e6e0a18a72ad92e26dd26ef5c35a7dde35e88981e87cc9310d78756bac458d976faf4bb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5114b0e53b1e4dd233f8495e1480aa50
SHA1 4ce2367ac778450ce1ccdeb4b59e220dcfc1416e
SHA256 ffd7fb7b18c48a05f0db57b8bcae65558b46391a15215ddc652bb841b5f84473
SHA512 0e470ee8e7759e1609b85efc369c2fd4c13ffaafce94dd98a2918aaa046bab5fdd9873dc0475fba1a51bb8d42819705096f81132258a719ab530b17285b1750c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2c8879a472393e72ef608597b3fc45e1
SHA1 0bd31398a13c4626fa7be201f5e1dba5f1f6f31b
SHA256 ec8640d6997c6f5b224dcd0216177ca95efadfdc7646d78e5f2d127b4bfd02e4
SHA512 41398b585a11003c180501665e1f8ec1feacb558d888867e888d2101a039b06dcdc310142fead69d9b6a8b43947aa19ba8194f50ef639edaab18f4d8d5df4eed

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 845921ecf6659897c9096a53b2c680ce
SHA1 fbf1b22e6b15029a514eb7acc7f2cec9eae9d4bb
SHA256 3bf1600b1b951539d9c5f48eb40d9a358f051a6741436156e3f040b832db1027
SHA512 d1297f936917a9e2020fd0ea57d02c69a8eabe67513ebebf42fc65e6245f3a95e1d052b45393091edef4fec18dd292d7ce465bb1aef4c3a4d9a0ec54b49bc293

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 91a2b543e41a943ac0335471dcf36572
SHA1 839bf9736979a0e5655ba82c6351458fe30c1972
SHA256 4a7d783f0a412fd36fcf793c28544c7f59bfd74d7ba8afabe9657365f3788858
SHA512 de349541dd77f7c7b24dc9b8088d2a11a0b174bb0cc754ccdd216ab90d640731304e8f779ba05cc8bf024f45ed8401abcdfc5bc8c79d22fc766b3de52b27f415

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 72324ad679fae9c1a3b888d9e529ab66
SHA1 b159be48db05d9d04f111227db2451aa0e544e3c
SHA256 715a0d61407c7651b0cd40325cdfe0b4e9785feb5a90c5a75cb6138b82a47d3b
SHA512 10325420c97b98e435911afe0d9b766d168c01656fed031fa6d2d8c08b93ae601bdefd322e0f83018a254748dfe2e79ef9faed109db506ff10304c09e76bf3b3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 509b43d7dfac2e126c2b5b71e8ea2361
SHA1 f6294f7dc5f7f4be196f0991c3de08b57fdf4b6e
SHA256 aae5d2678c8b759a8b83b3fca552b62172691e12196613f83e7be168ab62fb89
SHA512 aa3044f49a74dbc99cb8e71502bfdd5496b507c857d202dbb14bfc538edfce2d6cc5f2977733ce0108592014dd673b80aaf6fa5cebf6a0ea38425c38ee82fc9e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5a99d29989d6b342f32367b7056b47af
SHA1 216d75334241ab718a0250633abf6df405ecff83
SHA256 ce6cbdf8daa2fa6940ac69dd5e91067d7398e3f59354017a7de570c119c80625
SHA512 d7ae89e6e198f5651418051ab9dbf78c38b08d692f2cbb9824826054840b9105e5190a4d19327c9ca5628d23db96f6d8b1c76027458699139d1c76ec18f04587

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 784a6a63749699b668b1f3488e028c86
SHA1 b10df5c2f819df5aa4fdb04e29a1b76e69f745df
SHA256 07c6b55715acfef59175c2ceb079f4b3c49a6a52d62754710fa2e75b82e3d96c
SHA512 0c87d08b90e8a9b583542f00404faca642e32a05b4a2b17d7e25319fc45dc45ca287aa91ee81d17db2b2bc5c696a57ff9bd7212889ad8250cb53d638809fa8d3

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 21:32

Reported

2024-06-13 21:34

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

128s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a6a960c544cd8905befbd21fd9cdedc5_JaffaCakes118.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4360 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 4736 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1248 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 1620 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 64 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 64 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 64 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 64 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 64 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 64 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 64 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 64 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 64 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 64 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 64 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 64 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 64 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 64 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 64 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 64 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 64 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 64 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 64 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 4360 wrote to memory of 64 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a6a960c544cd8905befbd21fd9cdedc5_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc763c46f8,0x7ffc763c4708,0x7ffc763c4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,3392029946710985275,12883838993182071306,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,3392029946710985275,12883838993182071306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,3392029946710985275,12883838993182071306,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3392029946710985275,12883838993182071306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3392029946710985275,12883838993182071306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,3392029946710985275,12883838993182071306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,3392029946710985275,12883838993182071306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3392029946710985275,12883838993182071306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3392029946710985275,12883838993182071306,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3392029946710985275,12883838993182071306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4384 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,3392029946710985275,12883838993182071306,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,3392029946710985275,12883838993182071306,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1932 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 buro075.nl udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 buro075.nl udp
US 8.8.8.8:53 buro075.nl udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 eaa3db555ab5bc0cb364826204aad3f0
SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4b4f91fa1b362ba5341ecb2836438dea
SHA1 9561f5aabed742404d455da735259a2c6781fa07
SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 2ba005b690b96b0f49a92cf28af9811d
SHA1 853e2bc37452ea684c28643e10cb94bf25c9a3eb
SHA256 e1d41e56b844c648bf46d97da3326c004cbe54df2d6f344669a345ae82fb90f7
SHA512 e838733e6ffaa86467ede4dfb355551a6057a1c6f2814d9606a8b3accfccd2764cc08246357ad0707f7a3dfd59b6e972bbcdb788e5fbc8595e74c38ab90bdd8b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cac14e3a-871a-4547-a7ff-d680afca4ae5.tmp

MD5 1c8fded2800fff39cd4ae7ac83b73f38
SHA1 04adf8fa8d6d75a17c4c4a8a27d63b8f644de63c
SHA256 bd4f5bfabd96a619a03a0e14b629d67c0e86ea3ef50bf42f8d283a0821ff88cf
SHA512 bc0c962d5599b2162560ee3ae161b2339b89995aeb4b3d88ff00c2507563e3f186f6bb751dbc987b95371c4daab02ed0867ff51b8d1f4b4d0a75cfc59fbae9e6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 1dc7f28f64f989db92910cff734d565e
SHA1 05f745c8df2a9fa2a3461a3f615ff3ecedb063b2
SHA256 4a5d2d2af16fc5c453e4c927f8be4f855215b210db42f560f7a7b6de1b67c6d9
SHA512 e9def73d5fb18044a52cb80109a5a19331690a2c133f6dcd1157b1113cfb3c959aeeaa803eea55fa00665b81704e66fd014fda292e206e5ce9f55bdd799425ee