Analysis Overview
SHA256
ddeba804b526ca6ef7e259133ab69772753d5c0535fbe5c8581dc0112a2ff8ae
Threat Level: No (potentially) malicious behavior was detected
The file a438b17be3cadb95416804fe504dd7a8_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-13 06:32
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-13 06:32
Reported
2024-06-13 06:35
Platform
win7-20240611-en
Max time kernel
150s
Max time network
154s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424422237" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C0CB7D61-294E-11EF-9E55-E6415F422194} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\International\CpMRU | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2184 wrote to memory of 2564 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2184 wrote to memory of 2564 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2184 wrote to memory of 2564 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 2184 wrote to memory of 2564 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a438b17be3cadb95416804fe504dd7a8_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | cdd.net.ua | udp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\Cab6BC0.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\Tar6C8E.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 7b15965229e9a50b895859a5c78f5a67 |
| SHA1 | 270f32cdd22e9e18604ab2748a6b2497e99831ee |
| SHA256 | f0387d7fc0bfe42c7f82691ea8c00f93d6335aaa9afff4f1a5e1c2b0c8d1a49d |
| SHA512 | 83621b13e2a8e390170181f9009158cce5a3825492de7e94abfdcf8bfd0eb25cca1bb6f9a40f3288aab6c058eec6010d7f5d52fae10878834137c918990182e4 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 82d265f18f802d4f6c1be40a27a0fee4 |
| SHA1 | 22e8f14fb5035e971c19bbfd771d54b582413428 |
| SHA256 | 6081af87b5d822e579191243666b1f031b5a9c26425c5b8353baee931f3a298c |
| SHA512 | abf915502f702b1f82d01c28b5ead8d667d5570189f89db06367d5528c068c8d7ef3b08ab4409750ae4b871fc0edee43edd18a193903979325f42b70a2f84e13 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e30767761f289172244f92fea22823cd |
| SHA1 | 33e3fe3aec5b15f2027238f5e3319c9a5181b52c |
| SHA256 | 647ffd21f85f59df5a2a865bcf9a017d3f4a6914f4db6244bda2a3d7f9ae6a99 |
| SHA512 | 95d2561ea9ad92037eee57e64a32b58fcaa85616a7d080c0491022be61df9e57f04085adce387046ea750a1d6a6be301054b7ea7a7afcd2280b6d729be1534af |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c6b5f531ca1cdb1d0306e45c40f52663 |
| SHA1 | 94815414bb02640b6b4c0ab26aae88d6ee496dac |
| SHA256 | afe8726fb0166d1ec31fec1bac4035ade681bf8e25ed42a62f2e6d26b4d2d347 |
| SHA512 | 07b7026b26512e988bdcef14f02c8cbe361e721114cf031c6e64257b3119e2e576f38c34f851dffde21b1046d455bb813983a925a9e13c0e80f71a7725f0e31e |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 0a36ec8c164a572f99d085486618495f |
| SHA1 | afc512d9445537b670b5e75f8cc28de09fe5760a |
| SHA256 | 048eb3824e296f2f87df7f9cad306514adacd678aa4b997bcce9a004e4912d00 |
| SHA512 | 1ccd09e038a922da15f6167145390175fe7c507af45277d3108dd9f0f8759fe3a344f766981f75ecd364ae30dd14becfe2afd7a03a592cfebd9d04282a24d46c |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 15c997b96c20776dfc9581c78552ab93 |
| SHA1 | ed0f700b96cd4d5808e3368d39c1b3b059e01404 |
| SHA256 | 96d6dbb0bf8316ba9ae47a123811418d414ab8a6f01618c74ba67cc9b81bb780 |
| SHA512 | 93146150950d42c7094f25b4b23e8c1e25fd440db9cd0da10eed275f407cbae42e17c576a5a5c36425e139bd0b91fca7aa0105c497555a4346ad0ecddb731522 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 81576b0e48dd18db9eb382b9f876e086 |
| SHA1 | 03104d10105d5b06e8c7a74a43ee735994f66c95 |
| SHA256 | 4ececfee4487d11289a812de0ed6bac1aaf527d438c1d897ac8885e84f57c60a |
| SHA512 | 35ba4a17edef2c2c4d791f2d69da160a432e5a228303fcf3b16fbecf5cff22dc28991711c8c7b58f3ba4280fe11f254a089f92031e358d7a42ff93d0c56621ab |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 93523215700cd511bbfec35b14c77521 |
| SHA1 | 93c463b48a2d62fd5af1712c87b1f3ab7680fd1c |
| SHA256 | a2caf2592f10c47c930c291dc2d4a012479889958a114b8374f372f7763446a8 |
| SHA512 | a05fb8cbb289e65ea5f379169659926f2620550cd80a7e3bd938fff8cafa89cfdcbc3b8c3b07d56ed65c876c7452682ddb1ae8eee78af93e1ab41fba0f57fade |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c9683cc0cdec1ca9ab2a75080abab036 |
| SHA1 | bca0c671afdaab1f826dfcd355b28b8e7ea69f9b |
| SHA256 | 9eb6d1b20b2b95514d3138881c058a27514efc311c28b63457dd9dc9c461a87b |
| SHA512 | 57821ee1fcdc4e469850c0047c4ce9b92e5ce98632a9ff0e4a5210c28bb3ba1cae10d9c848cf54a580bec4bbf570b8a0d2c3f1e61fbbde5a6224f09da0e932df |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | a5dcbf872ee342731a6a18b71beb7846 |
| SHA1 | f1d1021ae58635d6b4ea14a4ade51bc34a4eaa8e |
| SHA256 | 3d5596526def2a52479819e9dd9746f9427f482eb71d5d5f56b4c92f58010beb |
| SHA512 | 422911762673bba575837db3a9186be7f6d2f0bee1618d40fcc2a3290547627cdf5a88b702f199ba9068c4e1ce4914a46d5b57995798fc433b0abd5bf35670bb |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-13 06:32
Reported
2024-06-13 06:35
Platform
win10v2004-20240611-en
Max time kernel
148s
Max time network
151s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a438b17be3cadb95416804fe504dd7a8_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb750746f8,0x7ffb75074708,0x7ffb75074718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2046677919747653132,10648361963989736790,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,2046677919747653132,10648361963989736790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,2046677919747653132,10648361963989736790,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2046677919747653132,10648361963989736790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2046677919747653132,10648361963989736790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,2046677919747653132,10648361963989736790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,2046677919747653132,10648361963989736790,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6100 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2046677919747653132,10648361963989736790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2046677919747653132,10648361963989736790,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2046677919747653132,10648361963989736790,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,2046677919747653132,10648361963989736790,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,2046677919747653132,10648361963989736790,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3520 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | cdd.net.ua | udp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| US | 8.8.8.8:53 | 68.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 203.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| PL | 89.184.88.6:80 | cdd.net.ua | tcp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 105.193.132.51.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 56067634f68231081c4bd5bdbfcc202f |
| SHA1 | 5582776da6ffc75bb0973840fc3d15598bc09eb1 |
| SHA256 | 8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4 |
| SHA512 | c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784 |
\??\pipe\LOCAL\crashpad_4760_JWAPFFSUDTVUPHON
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 81e892ca5c5683efdf9135fe0f2adb15 |
| SHA1 | 39159b30226d98a465ece1da28dc87088b20ecad |
| SHA256 | 830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17 |
| SHA512 | c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 62e9fc71c968d4bb9ba20cf4c42b6c4b |
| SHA1 | 839b701d9776a00cd6d33364050dda4558257aa9 |
| SHA256 | 79bef29f467d3858dd4f18abb1275dfa6e561989f626ba3827d4e52ec3c7ea39 |
| SHA512 | 832686300aed6254dc75302396b7160697fa6c563448c20bb9ff4378cd0f22f85d73f038f4f1aa8fee86cac5546f18c89a88727b1b40781abe2fdc2256e88e32 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | e4a1a43c066fdb5b3537c5c9191ae254 |
| SHA1 | ec877ee6eb9559bf3ccb7ad7e59206993de4d878 |
| SHA256 | 7aa473e8609cd6c4f9c5c486d20f2eaa9f02f03b43f5a192a948d4ef7e3157a3 |
| SHA512 | bf22314f23530ccb0c904243101cda57b274b1cbe13457d6bb6c77ea1414e598cfdc84b27ddef220e78d3616618cfd3616d3a71d63f5e07a8ec74ec4cdf7fc37 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 9d4e2fbaa0df060f1f83fa69324b54de |
| SHA1 | e292b72c22fb2f765438c6f428cda22c0cbccf62 |
| SHA256 | 13359a27be54c8cc45d6cf806c676c3737872a343863bad50d8ecbb324863d80 |
| SHA512 | 3bcdebaf13ff21825a6c242b9e3ac90ea4b3f4b5e7e8da5595366e45bf02fa2138ec4ff280b28689e6c03ed280c39dd265bfcfefe58dfba0b9f336bd4a19239e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | 5b3afaecd6fcc0897d4d7d4bfdaab4bc |
| SHA1 | 469a4f085b8bed1a455fd16b89f0d80021ce5897 |
| SHA256 | b10ca78944676a9c0ebf79e8e3f140a4f02b1ab5fd6cc36bbe7d766f80e584c6 |
| SHA512 | f35c5cc4e3a9d43721954965e23b924cf6fce5beeae73e0cfc526c2037348ed205c26f5e6eaf268b9d9317cf7d26f940f2b645fd9eadeb32f1bea0b6eb27b6f2 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |