Malware Analysis Report

2025-04-14 03:18

Sample ID 240613-d61nwsshna
Target a3b324c2ed72c24b06a83a67b172dc2b_JaffaCakes118
SHA256 5a6939ed61fc750f060e19645a31b0df6f597a682913a7505f8b3db1cc5ca8d2
Tags
score
1/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
1/10

SHA256

5a6939ed61fc750f060e19645a31b0df6f597a682913a7505f8b3db1cc5ca8d2

Threat Level: No (potentially) malicious behavior was detected

The file a3b324c2ed72c24b06a83a67b172dc2b_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.

Malicious Activity Summary


Modifies Internet Explorer settings

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 03:37

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 03:37

Reported

2024-06-13 03:40

Platform

win7-20240221-en

Max time kernel

142s

Max time network

144s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a3b324c2ed72c24b06a83a67b172dc2b_JaffaCakes118.html

Signatures

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{55064DC1-2936-11EF-995F-5A791E92BC44} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424411748" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ebc3702f57a4934588d79887cf39197b0000000002000000000010660000000100002000000070a596a5d52a3f35d9e3f35dcd487d900b9395e16a1937e6e15aa073cfbf3915000000000e800000000200002000000003838de09cab57e5961e390b6e7a065fcad32adb5733dbd8f7daec933f041fa0900000003a7ce10a76ba8f16008aec9cf23ca7f13d2628bcf2a2f330c20262e38ebeda00133fc629aee415194db99f21604e5e0a1fc043f4959ca6836c70cd246e714d4085a47f846431b8acb7b5078a1435be319f646348549632c0085175f50313a19204b374bc899296a452545883afebdd8024579fdfa5043526392fe240437226c9a31670879c88a2a92962e7034a95fb67400000004ba529aff19af58e677abb48836bbba2682515424906406d1fecbe2062ec3946bd1341d09cd4ecf00ae3b57e3498bdf5ac905cf9650b39e33f42ac4955105a13 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ebc3702f57a4934588d79887cf39197b00000000020000000000106600000001000020000000641fa608a1c1f5fa446014f4faf290a5687e76eb28e89ae37e7940a06a10467f000000000e8000000002000020000000c39728ca953e638d9316886cedbc19213956e7a10376bc1ab39c6f3df27807fa20000000841c8231c7dd548ce702cbea1ad1d92529ba9560095221726c1d77502948873c4000000083bb8824a245869bf705f0bc34581a90f9a0fbc742c08a9bc21e1b59bfe584f99dd557ddf9dad524904ab17c9884509b90b6aee589c813b653b8ba3a812a8a84 C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 607e113843bdda01 C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a3b324c2ed72c24b06a83a67b172dc2b_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2952 CREDAT:275457 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 naruto-hokage.do.am udp
US 8.8.8.8:53 www.cy-pr.com udp
US 8.8.8.8:53 counter.rambler.ru udp
US 8.8.8.8:53 naruto-great.ru udp
US 8.8.8.8:53 naruto-brand.ru udp
US 8.8.8.8:53 anibest.ru udp
US 8.8.8.8:53 aniday.ucoz.ua udp
US 8.8.8.8:53 anicrow.ru udp
US 8.8.8.8:53 anirai.ru udp
US 8.8.8.8:53 kinocopy.ucoz.com udp
RU 81.19.89.17:80 counter.rambler.ru tcp
NL 31.210.170.12:80 www.cy-pr.com tcp
GB 142.250.187.196:443 www.google.com tcp
RU 81.19.89.17:80 counter.rambler.ru tcp
NL 31.210.170.12:80 www.cy-pr.com tcp
GB 142.250.187.196:443 www.google.com tcp
RU 193.109.246.70:80 kinocopy.ucoz.com tcp
RU 193.109.246.70:80 kinocopy.ucoz.com tcp
US 104.21.69.195:80 naruto-great.ru tcp
US 104.21.69.195:80 naruto-great.ru tcp
RU 193.109.247.85:80 naruto-hokage.do.am tcp
RU 193.109.247.85:80 naruto-hokage.do.am tcp
RU 193.109.247.85:80 naruto-hokage.do.am tcp
US 8.8.8.8:53 mc.yandex.ru udp
RU 93.158.134.119:443 mc.yandex.ru tcp
RU 93.158.134.119:443 mc.yandex.ru tcp
RU 193.109.246.86:80 aniday.ucoz.ua tcp
RU 193.109.246.86:80 aniday.ucoz.ua tcp
RU 195.216.243.16:80 anibest.ru tcp
RU 195.216.243.16:80 anibest.ru tcp
US 104.21.69.195:443 naruto-great.ru tcp
RU 81.19.89.17:443 counter.rambler.ru tcp
NL 91.226.31.82:80 naruto-brand.ru tcp
NL 91.226.31.82:80 naruto-brand.ru tcp
RU 193.109.246.70:443 kinocopy.ucoz.com tcp
RU 193.109.247.85:443 naruto-hokage.do.am tcp
RU 193.109.247.85:443 naruto-hokage.do.am tcp
RU 193.109.247.85:443 naruto-hokage.do.am tcp
RU 193.109.246.86:443 aniday.ucoz.ua tcp
US 8.8.8.8:53 mc.yandex.com udp
RU 87.250.251.119:443 mc.yandex.com tcp
RU 87.250.251.119:443 mc.yandex.com tcp
US 8.8.8.8:53 top-fwz1.mail.ru udp
US 8.8.8.8:53 kakuzu.ucoz.com udp
RU 95.163.52.67:80 top-fwz1.mail.ru tcp
RU 95.163.52.67:80 top-fwz1.mail.ru tcp
RU 193.109.246.128:80 kakuzu.ucoz.com tcp
RU 193.109.246.128:80 kakuzu.ucoz.com tcp
RU 193.109.246.128:443 kakuzu.ucoz.com tcp
US 8.8.8.8:53 privacy-cs.mail.ru udp
RU 95.163.52.67:443 top-fwz1.mail.ru tcp
RU 95.163.52.89:443 privacy-cs.mail.ru tcp
RU 95.163.52.89:443 privacy-cs.mail.ru tcp
RU 81.19.89.17:443 counter.rambler.ru tcp
US 8.8.8.8:53 js.hotlog.ru udp
RU 89.208.236.251:443 js.hotlog.ru tcp
RU 89.208.236.251:443 js.hotlog.ru tcp
RU 89.208.236.251:443 js.hotlog.ru tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\newbanner[1].htm

MD5 cd2e0e43980a00fb6a2742d3afd803b8
SHA1 81ffbd1712afe8cdf138b570c0fc9934742c33c1
SHA256 bd9df047d51943acc4bc6cf55d88edb5b6785a53337ee2a0f74dd521aedde87d
SHA512 0344c6b2757d4d787ed4a31ec7043c9dc9bf57017e451f60cecb9ad8f5febf64acf2a6c996346ae4b23297623ebf747954410aee27ee3c2f3c6ccd15a15d0f2d

C:\Users\Admin\AppData\Local\Temp\Cab1B40.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\Local\Temp\Tar1B62.tmp

MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f3165a718d187d302b3963dda9e24c51
SHA1 883f1ba98590f02efb58b05a3798ae7d02c160ef
SHA256 7dc6812582548b4581a1d5530daea7efe404893f573bd627d4f14694b09c57eb
SHA512 9e4205437fc6f488d5dee778c380b80dfdb4eaf64b02b0e13ab95c40e835af60e8461cb9c07026ac9dfed801c18d29dadecc2681922ddaaddb6a0c6ad9a3cfe8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar1C49.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b5933b2042c94da6f6481353116edbba
SHA1 e7f47dec19d11317b5c0963dcaa37b55834d04d7
SHA256 204e236a1fe10ff6cfc12305c56691f1201879ae403e6d547d6c16db9b43adca
SHA512 a923f7280b8dd196afbc8a4d0a548e70fb7b82fda16a8de9ba01624584fc732b35c331ac65035212eebe61105168048a4acacff4ec0e86469da510bdd4e2a5b1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 29d297a8858f044a4ca38e2afff353b1
SHA1 91e577cbdfc1eae84447d0ee36a54f401bd5f94a
SHA256 6764ea322facb9922d2426d0ba21a00b75ada3121bee82ec9042f7c80ec28b4e
SHA512 aa93e902cec6bf928406bee91c586fef2a2528c6bf9eb09f3473433e07c66b49420ae492ac55cc00a06792e1a17f2298ed247926a75718b345523b3974a84323

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 0d5934473c67501eec810911d31e4b7a
SHA1 3d1e97894bbe7a7e90563251f53d4083f16453f7
SHA256 4b9620995faaa55a126a50c1fa3c4d057501ceedea71f325206ce82b7ae8ae19
SHA512 84d42f3f6dc1ad8bbbe728a802f839c45db2b37c0a6ea5b1fa84cf9bfd0634cc01dccaa1d380e0e7e9fc02f6afae50d2bd34a24b584e14bfbc68b6bbf28f9481

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 3bda034a15996e8ccd9afdc3b3da19a9
SHA1 1f8e5303deb56ec97abec30e37a2a6870a7bd129
SHA256 e2d1cb08bf891f6966ebb1d04dd314f09952eb9fd3e84cc52e279da88dc662e0
SHA512 0fe96ad9131361ec50437153d1166feb15c3442544da72c1618d849d9b1d454b55d6f0c0fcdd3de74b1510fe334962da144958cd37d55361a17eb5ab8f97151e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 aaf642c144cb3bd3525180135ccd9cd4
SHA1 9090f98c36dfcaaaf9acbc11663625ef1bf8e251
SHA256 7b74d59821064a65268409899c4dab29b31d5a3b03f0a711a8d531e3998f8a92
SHA512 83c37ecb17feb1652e0b3f64968025be7f5fd605c9c16d958c1ef70bc395a4dc16ee8e2c030825d1fdd3c3f6466aea438c43f09bf916442b2982622db9ce5931

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB

MD5 ee6bad06594c87f316f0d97e93c61ca2
SHA1 82f2578706b16663f11d4658e2db7576fa154a0d
SHA256 1c8dcec8bb716748c985b40379c63083543b847abd5cface5b21f09c7e71017d
SHA512 6ac3daa56c5049169e8f44d28396ce56066b8a0035e1ef4f5e268906366b44052a0229122ca39604b1ea23ab6b513620b90ee0f0d5396e0658706cb248896548

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB

MD5 d9f99f631cc45b009e4d8c7fa02ccba5
SHA1 15339e7c50438d272eeccd49161a93eeee4678a8
SHA256 ff52f8b83f9423588b391c48528991e202c059c2c4f9c4446e5fb3e03f063880
SHA512 bb63879265fb5b117681be74f3f3f1e94c51d76d0e4c0f0235011512bec96ee1f06cd2544bf1bfb7b9e8e374787675bb7d6ff2f73200a4e04b33395de3d58652

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4d986787c472a82ccf3a59f325c60929
SHA1 2ab162810bd717bed2f52464299e75fc4f376e3e
SHA256 9b7816ab6127106f5f91b5e884bd0fd72f2abf515fc8aa163be8bf9be175d9e2
SHA512 1fa2d58b8aa1b7f8fbff6bf199abc45a0f6f4246ba4dc2f086e23aa0fc88b354f59563fc875d14b465eda0a10b4352a5cfdbdee610f4b94e031e9e3c3ee36986

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4a970fab198e628d52dcd98edaaf7a89
SHA1 6bb5fde4f447f62dff8fb1d102fbe77184449ff1
SHA256 563f2f735ebb02ce861bd1633cd7440433a7fc7edc96ab28533bd8a7fc27a062
SHA512 290390392500c2477c88c24ad47371b1cf07a320f1961a870cb01739f79289742976ad9a349b80d6a30d91bc828f9aef092ca060da5380235d8497310c6380f9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 937626eac9c5dafd7cbac603f8d69b63
SHA1 afa1ed1cb42d9449502ba0ab086c43ba5325744c
SHA256 aae0b4bdba1422c0dae6a0af70b4c583a0282c38a95f18d201553aee89eda145
SHA512 5a16a83a43f363094f9da184c430bb7b2c5aef5a77aa4a666c13990765962f4de42f81a0772661cce3b81f62b2bfcf3774436ebe67e2982251e0499d622a6fe8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 021bbc71db53dd620dda7a92018534d9
SHA1 75abf111ba8a557072ef50ee670514e38ed1e0ab
SHA256 aef7dd62adcab975355ce808462fef23cb59c64d8632270ccada096a6fb64b50
SHA512 73cea6f7d2e923b0069efe7d66edfcca74d905131c3309ba80507d66c6e1033b24b4378f73c936d32ce6b49a749a4e7b0aa8e45601787cd33ff8176ed06c49d6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ba82f5ea92097dc80747162bbb44d698
SHA1 b8023cf4a5b1e75d99070c7dadb1a4793a21281e
SHA256 c45c7f675d46c1ab8b1d348a1b5d6775678e290949aca25dfb7b91bfc9415b7b
SHA512 502281c3ca18486c7ab002b1886a7e41e68b2b6ab0af328ae92dfe9501b5374c09fc377f5444d86b45a20eec8510174fb8acdfab555f1cdb64f60ea9500faa72

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d64070bec4b0f3d971e2e97842f75bc9
SHA1 99fc54b02f29bdc3105a112d683bf832970f8501
SHA256 c89bbc87893d770b06b70b42eecce2eea4599068a2d765f70b18f2518bae9769
SHA512 55c7b739ebef20a66657b282c0b3a4b1060b7d90130c539be3d3246ddd8c3407e28cfe95f12b1f8eb0c61df1fba1950ed76b3329b7ce45df1e53069f3fa2e8c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e35afad25db713cb6f7c58eee18457f2
SHA1 828660311a88520a373e2b8843efd566fcd5c172
SHA256 1388db25bd017a606b963037924b8eb898ce571f0ccbbefc986526bce9b6818f
SHA512 de0c0815784ae15e330af3f20b01f6cacc1dae707dd10835bcebc422fd5e2a818f88b7d37b18b14d77805e5f43d0110197257b6819dc6f5048ea1feda7577862

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 52a9e5a1a998169e7e8c570cf1bf9516
SHA1 260806ed5e494598aa60265e83fbd86614d0e078
SHA256 fa8eac461747eb2135d153899a2e5e64f8aa8d14677d9929d7e92b18e8f74107
SHA512 baa23f715a383bdc081059f123954b74c0e7fd1e015d84f7086d659f71929cd508be78ef340de516dd6420d37221133635f4776091b4e4bba37ef86c4570e0a6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 85d9a69a76b8a99047defcbc87064fc5
SHA1 a87a0c5536336dbc81f1b31e0238b9b12594c2f1
SHA256 8ad03b32ea002670a3373719bb6176343d87388906a4e402b53b8e0054c309e4
SHA512 830363a8694c149d2f1616455839e2c8c691151c6764001fd734cd83fd89da30ede8e5659e6fc5c4a5c041a15b8f5336ab92803366fa8ab99c912f7504dc5650

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 52516fe61bb26504166916fdf161362c
SHA1 2bfd5d1276fc877d980ad4be0df04f3ddd16e003
SHA256 ad34b2352ff32c0879ced58a47f632b5d183fac4d2da5ba55cc03fdc38ab335d
SHA512 006ad80175c6f762ef6eed840c9420c015bd14ca612536b51fb91fff19212507d657beb4485e8ee3023e4368fea3a8917c33a6a44469859b51f88d553eac1584

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 1eb2781f6f7e450927e6853ba1bd8299
SHA1 00a8787c06a58a04dd33c02b2e87b3e581ccd5cd
SHA256 915d1f27f2c9fbab770defad41e805b30ce744126773839dda0028fbfaffc2fd
SHA512 2385d77949f45a2c8d73c5dfebd4cd4cdd6bc293e04ffc1cc376e4e45625c6a5110440da56bdf92bd23d9a6092f7c03cd126d4344b3bb173c881085e872896bd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3f82cac2d0d1b381e844b95712eea3f7
SHA1 26552e21414f579de4fa90cf8e7fc8d1ad303400
SHA256 fc981e525261db643654dd2be50961d9785b49b92a94f2655d1cf52f5155c08b
SHA512 ee84c8d219909d5ab1e0e46699887dc4b755857363732ae145e1491052f75e0802576dbfd662310d6ab482dfab5c2942004a020cf92e217ddea15441d8fb5c55

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 43f7c8a5ed62da862c773cb3e9c9ba86
SHA1 ad2d79e56aedbe72904cadc6c63445949297e420
SHA256 f70ed5d056c72406b9333486d08bf844af78c4f3b6232158ceca6c7a72c8fa42
SHA512 51ac42817f6e18a35439c524394ac8c4cca76af5d92448ce23d6b97f2ddf22dc3acc94a04c12aafb6178f4355e742f628617a83bb4503c6c2c9b673b69cbb5ea

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 67b7522a69e74c9248c114cf7607cde0
SHA1 97dfe0c96f57428a92924035a4203a02b207ec0f
SHA256 40ebe35d02d599b36ecc40be9b9aed86264d6631cd9dfcf4b77319c1458272a8
SHA512 e92f164662fb202166e2f0c831915183cfc8f8c7683e841743607954031366debf07037a6ef14e51914d6772c4efd09359cf9675bbcc122d907ca35cbf2e7f5c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8bdf35894a7fd6cc8abde1215d0337b9
SHA1 ec22f91d9814233559985eaf328ba0e9e1aa6bbd
SHA256 a15771897dba329093d8c68e02efae48bbfb58a97d159be68f363bfd985b93bd
SHA512 4661a5f4b036e0ddde7b3fd1bd23195b225da9ab0244d961bc60ea937bcd857483a9dc7d06d8ba5424351ff2fbbab97bb6c822d7351670ab1f731d135865e623

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b1cefbbcfd1da00a0cf01aadd6b3b080
SHA1 3ce1120103c26df82f92fc6b31cb9988e35095d6
SHA256 c7a5dfb85a4a6a707bcdf5593e8f14503ebbdc2080688ffc634bdbbe53de05f9
SHA512 37759752dd73ff6692098cb79b775cf324aa09cdce37fc2dd991ca56ceb5a369846ea28037df564738f4311fc3073606057f3284c343ced6a155cb0b80d2ece4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a7041002490b1a1e51e0e8f998efd8c1
SHA1 001cf5434c9ccdcb34efe7df0fa45d5af3f2ed10
SHA256 46461d9aeda37aad2c36e93632524beb7684b59f46cedf08f63869efee005ae8
SHA512 52675ff4bdcff2de6b753ee25f6f68363f34894845f0b03f49c6bd4176705c6cbc17b81db1053d9d2acb886b1c85ecc40967979d7ae02742fe8654e25306b74b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1993e4ff66b677ba58f619ee6335f3be
SHA1 f4c009a19d15bd614c609250fac0a7316874ce71
SHA256 8816ce46ceb23af0c8b3c519bb95079a33d31f06be10d8e67cc90f7a775237af
SHA512 6b820138ebb9158bceb101cfc46b981bc10c0af0cb50c5638a66a089cae295c3969cbb7475565047b90d686c437f2e1f8d36b699532cf6f1723e9a58e2606383

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2db880166a7489af94bcf373f813af5b
SHA1 945a24b7809c81fbe3f40e25764369437c37b07d
SHA256 4a117914999f8a9bfcd3af80724662e0af9858b8a795d8e0ad17a4b52881de46
SHA512 5638c6801f0b128848ecf29d072c6b141eafe097288fd53907814a1bed4b551375959f8de3670a833d3342b47f2f4ecccb27e044dd6bf44d6ad9703781c726aa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 15333d12a9d3676c3e0b37798db4d86a
SHA1 8790a1c245afa7aec7f3bcabd1c2da5f3a360358
SHA256 0972e40db051370cc6c36e4e248504997d3b5296ffb09aca3494432ef3e8c4a6
SHA512 3956640845e63e98d1c7beabff9778864c98b0f1b13d5b03a1d6ee1a2d730245bb444654333f4cafa43acdb48c9edcbd2a9da7eabec8f9bb0fd55c2016cda1d3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1301c4d185852690f3e500daf7759339
SHA1 09bff17e0d8b70c87433d4883e6697c7c70daf9d
SHA256 2769d55cbf01095ec78df8f33edda0efba35d61947265ec6309692d1631ca2d8
SHA512 d91e2fd25192a7a9a826e8cf43a4a792ce7f2d095301185409e921a8e5c11b82b203f5fa6115a3052571cda30939ed97ec28e8cb73473e0fca2bfc3f463bcb1d

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 03:37

Reported

2024-06-13 03:40

Platform

win10v2004-20240508-en

Max time kernel

145s

Max time network

127s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3b324c2ed72c24b06a83a67b172dc2b_JaffaCakes118.html

Signatures

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 924 wrote to memory of 4180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4180 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4216 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4060 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 924 wrote to memory of 4264 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3b324c2ed72c24b06a83a67b172dc2b_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa292946f8,0x7ffa29294708,0x7ffa29294718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,6904309960900170774,17670315650996916443,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,6904309960900170774,17670315650996916443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,6904309960900170774,17670315650996916443,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6904309960900170774,17670315650996916443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6904309960900170774,17670315650996916443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,6904309960900170774,17670315650996916443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4180 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,6904309960900170774,17670315650996916443,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4180 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6904309960900170774,17670315650996916443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6904309960900170774,17670315650996916443,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6904309960900170774,17670315650996916443,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,6904309960900170774,17670315650996916443,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,6904309960900170774,17670315650996916443,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4176 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 s85.ucoz.net udp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 naruto-hokage.do.am udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 top-fwz1.mail.ru udp
US 8.8.8.8:53 naruto-hokage.do.am udp
US 8.8.8.8:53 counter.rambler.ru udp
US 8.8.8.8:53 kinocopy.ucoz.com udp
US 8.8.8.8:53 www.cy-pr.com udp
US 8.8.8.8:53 naruto-great.ru udp
US 8.8.8.8:53 naruto-brand.ru udp
US 8.8.8.8:53 anibest.ru udp
US 8.8.8.8:53 aniday.ucoz.ua udp
US 8.8.8.8:53 anicrow.ru udp
US 8.8.8.8:53 kakuzu.ucoz.com udp
US 8.8.8.8:53 anirai.ru udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 eaa3db555ab5bc0cb364826204aad3f0
SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

\??\pipe\LOCAL\crashpad_924_ZVRLMZKTVHWQTIQX

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 4b4f91fa1b362ba5341ecb2836438dea
SHA1 9561f5aabed742404d455da735259a2c6781fa07
SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 5026d82f137912d6cd3e867e6e91b023
SHA1 5de19951c9f10999054047845d5c97550f06f66d
SHA256 f22af93b942a5b911c544f18594d94bc2985a050fc65a7e7aef1a0e85a14159b
SHA512 3b5fd4e268942ca4962e5719e35a45bcdd03baca190d8f4519bc50a0248cebb7e431068ac6b38cde5fa26a55da3e483e1d45d6d3c3e621164260de8cdb1f083c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 dd73ecab6eb742e54e2cda90ac10e23d
SHA1 24c1c4b9c5d24a02363c5f5968948e40622692b2
SHA256 0ee5e18d784bd9192535fb307e4581605afbccfed4fd9ec3e95ce368f2d7d32d
SHA512 392b23002aa58abfb15be123f3a6fe20bec320d608f8481b4b62ea33804d26c9f635d2d045baf8b36b43083ec7e2aaacf686a2d7be7c143b6e9c3fdb0164f8a3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 bbb653632d4cfb36b185ac8adad32df8
SHA1 df70344fd3d95b8cc10df7d74661ede6a8765813
SHA256 30d726b5c3fe9719fa169bbace21b982399cc29c41b7de21e01c14ead4dd1dc4
SHA512 d086e0dec7ea45b74b61561ccbade0516283f3423af7dfcfacc9d9b6d2d62c32f63d6b3043d65ef0a148b8a5dd5132ebde51ace6d6ad94f12ec1f9fc99451a8e