Analysis Overview
SHA256
1395d4a92225e96c0e3e646696eb53a9bd2e4ed62648348c454c0a6407a00d01
Threat Level: No (potentially) malicious behavior was detected
The file a50ff88147c51b091a33004964851394_JaffaCakes118 was found to be: No (potentially) malicious behavior was detected.
Malicious Activity Summary
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of SendNotifyMessage
Modifies Internet Explorer settings
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-13 10:22
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-13 10:22
Reported
2024-06-13 10:25
Platform
win7-20240611-en
Max time kernel
150s
Max time network
154s
Command Line
Signatures
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\InternetRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\PageSetup | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\GPU | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IETld\LowMic | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Zoom | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E6FD9AC1-296E-11EF-AA16-D671A15513D2} = "0" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Main | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424436046" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\IntelliForms | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\LowRegistry | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1344 wrote to memory of 832 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1344 wrote to memory of 832 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1344 wrote to memory of 832 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
| PID 1344 wrote to memory of 832 | N/A | C:\Program Files\Internet Explorer\iexplore.exe | C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE |
Processes
C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a50ff88147c51b091a33004964851394_JaffaCakes118.html
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1344 CREDAT:275457 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | www.wirelessdd.com | udp |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| GB | 142.250.187.234:443 | ajax.googleapis.com | tcp |
| SG | 178.128.83.5:80 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:80 | www.wirelessdd.com | tcp |
| GB | 142.250.187.234:443 | ajax.googleapis.com | tcp |
| SG | 178.128.83.5:80 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:80 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:80 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:80 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:80 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:80 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:80 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:80 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:80 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:80 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:80 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:80 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:80 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:80 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:80 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:80 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:80 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:80 | www.wirelessdd.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| US | 204.79.197.200:443 | ieonline.microsoft.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:80 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:80 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:80 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
| SG | 178.128.83.5:443 | www.wirelessdd.com | tcp |
Files
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | cb85f3fcf86ef0de7ef258539cae87de |
| SHA1 | c73288fff07885a62f8c7033b348863ed3b8cad1 |
| SHA256 | 7430a96d94b1faa5363b7656b323ffa416fd262e0405e498bb143dc93443963f |
| SHA512 | dc152f2e8c8f7e316e84f7a1f3996e02c08d582d6d0e40b8bf7171e359ea952a80b7452e56690b30fe98b4655d4744e8529a930449ef1cd853e377f86294b2d2 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
| MD5 | ac89a852c2aaa3d389b2d2dd312ad367 |
| SHA1 | 8f421dd6493c61dbda6b839e2debb7b50a20c930 |
| SHA256 | 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45 |
| SHA512 | c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_0E84AD23AC2E74B30DEF739614C7EB94
| MD5 | fdd4fae6ea64878261a052af0ec203fa |
| SHA1 | 87ad368861589634b21d9f01ac78c7fc680fc252 |
| SHA256 | 247160cf67963253907e2eaf1a9ea8fc4dba6a62b3a00e52c359dc2c1d21da1f |
| SHA512 | 79378d1523d76942561925dee3207b973e33f44e332d47e065fe657c2c8db86acfabf3d0d1b7c78b882255c9bcb6e64b6917758507987a44c3e8d1f1eb8f3044 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\86E0D0192884DB74410BD8F4BFAE877F
| MD5 | 49b045f1a7e9e35caba66cd519e69df5 |
| SHA1 | 1898264ba58a4f62b693ce3c0e81bc300c676b7c |
| SHA256 | a95e03eef797f62bfe32c083f9715c4e4910a9d96ad1930fe52a00529450791a |
| SHA512 | 95dccc9a406c2cb03b460b5c00094797615da9d56ace97e528cb8893862afd11e00de4930d08b7cf06facb7d235c1d205b7b1dd40c005620c60c8e2be6959e19 |
C:\Users\Admin\AppData\Local\Temp\Cab6EAC.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\Tar6EAD.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 907c50c99ce95fe19cbc076598770780 |
| SHA1 | 60c0144c123dc9e98429c6bfcc01e0c77b587c32 |
| SHA256 | 0d345e25ec3d16e8703e8d0d258c181c7b2984366bcd30c2c3f647b8add06176 |
| SHA512 | 310fd11b5dc05ca4d0771a85ad77144b5f36ae065aa9aa3ed2d652deecee6af5b0dd196a0f30cba41721c0851a1bf345807aa9eb26fc94351afa656898f6e6cf |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 801225bb57f77e99ce0d24e7844b4cf5 |
| SHA1 | 9b9a91088115775fb4f4b8fc26446a84fb773c9a |
| SHA256 | 59af6a0cd0eff7192141bf30e7c56cdfbf8585fb2387947578a955adbc963339 |
| SHA512 | 63791fa13916e9d1483ad6f9f3ca6a1c345ddc427ff69552e486fc83d130f3883b2f9b2eeff7fde6d102f58a9d64c8cc4de6ea6bc365b3bc8df86ef7498d4e75 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d6e309b4f1ff74df17cd099d2d8e8eef |
| SHA1 | 4e320c2ff6db8261e921d997bd242cbd8ec17fbb |
| SHA256 | 6adfac8554b9bb3475b3de646cfab52c7d7cc6143732bf6d4d888cfd0690436e |
| SHA512 | 491fed13c44de077e42c970526c7ec06b1b1a6b08b261bce74de89ceac27e18e81022f96dabfe0cd90ba64f6a845fa113a23f5b8e3415d36857a26cb16ba52c9 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | e89c0c68f785231e1dc62825fdc3ce93 |
| SHA1 | 2f489a96623dc23cd1b2737d4be8120b1b9a780e |
| SHA256 | 0bf352c2e71d8ba2acc9dcd9f3dc8e651a969de6d6c635ba12288a2b6f10aad0 |
| SHA512 | 13e883567252e7432a837d80c4abe846607bd54b12b4d0f1b0ecafa30a5b9271a12c9c93caa7bac0a19888c1e47c10dd83eac963e7585b08a019fc35205dc3f0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 21c7d1776b13aacd56e3e2a537d1e085 |
| SHA1 | db5da76f6ffde871a5a85c1287e8089887d5d00a |
| SHA256 | 289de30f0c042b8a6cffa8db4e24e4e35710b74bed1e13b0b4810cef05dadf01 |
| SHA512 | c60ca0015fff56f5d6d0c8bd1458d15cb2bd822530b021eac6ca79e486cd48c170b73e7f49c5b3d021e50ce2307470e405dc4b85f74842e24bd1b2a86541e009 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | c8da6b354b8249ff4b0607746d3cafec |
| SHA1 | 74b0b12591d6d80d369e89a4a975c365688827f3 |
| SHA256 | eab0ebf4d30ccc2cdcb99b9569ac4387ae478deb2c8f1186c643115d38bbd50c |
| SHA512 | de2d84dbf2595e5835f82d9d86e35a00ff4970978cbf4232ca43f05ae7b47d7f2d60f6f2d55dd0080eb81a2d87f11276fcf20830e417ea1e685498157d55630f |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | f1d042ce2284152d27df4c065c409c00 |
| SHA1 | 45b598850398613b1cad9d4014c38b5d989a85a5 |
| SHA256 | 776fc4190da3a21539d0451507e14f254f03022b3abce132977edc7fa366a331 |
| SHA512 | b18e50e2b2434e3fa92fd5330249bf86ceef92b5f4cdfa6c635d5c89c003f88881672ecddd0e6a82945f7830eeaee47bf8aaff2da4858c25038235f408e0f1d5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | d5b0b92bea99936a7d6ecddbebadbf11 |
| SHA1 | 319751393270918ef7902ed18705eaa22edbedda |
| SHA256 | 67a9286b9d27a7d056f7d159c33bf90c35ff4fdf90515c3e9abbdde364e8fa3d |
| SHA512 | f741bdea4962c3eae5d58412e7107dcdbaaa545db63dc508e76e6b3b788e618a4a3a25c3be5e10e6811539f8a2eac457606b435a105dc8821ca6763eb5de5b07 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 66277fcb1796363011c74062f89af3d6 |
| SHA1 | d1664406cc113658a66481f4767140bde398dd3a |
| SHA256 | bf11c402bc3083926417d0d728451c1478ee28b6d930c3ee44f644a6a1def491 |
| SHA512 | f17f13d035e1d20cbeb35683ae41e6a101d5b61e64a2f2144b8638384976ae4dce76ec9ac6b82991c1661375167eae3dda47be1478a060b3cef288972d80a57a |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 96b9bb673056d44e4c57bd2b8ce5e080 |
| SHA1 | 50d2064dc20a0fe04fa3d88c46b84ae80e753194 |
| SHA256 | 8df820088a7068a8c804f5540a20860000d9f1f0297769a35d19b4fc958dcd20 |
| SHA512 | 70135817d6ed559592aec55c2057ed486bd45ce3901f0e97b88aa630062ccff60d7299f710f679d0e9165216192811513f3dfb66364ad930d626cbc2a432ea08 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-13 10:22
Reported
2024-06-13 10:25
Platform
win10v2004-20240508-en
Max time kernel
147s
Max time network
150s
Command Line
Signatures
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a50ff88147c51b091a33004964851394_JaffaCakes118.html
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa37e46f8,0x7ffaa37e4708,0x7ffaa37e4718
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,7413592254107804522,15460529288252310754,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,7413592254107804522,15460529288252310754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,7413592254107804522,15460529288252310754,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7413592254107804522,15460529288252310754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7413592254107804522,15460529288252310754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,7413592254107804522,15460529288252310754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,7413592254107804522,15460529288252310754,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:8
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7413592254107804522,15460529288252310754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7413592254107804522,15460529288252310754,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7413592254107804522,15460529288252310754,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7413592254107804522,15460529288252310754,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,7413592254107804522,15460529288252310754,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4428 /prefetch:2
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | netdna.bootstrapcdn.com | udp |
| US | 8.8.8.8:53 | www.wirelessdd.com | udp |
| US | 8.8.8.8:53 | ajax.googleapis.com | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | www.wirelessdd.com | udp |
| US | 8.8.8.8:53 | www.wirelessdd.com | udp |
Files
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | 439b5e04ca18c7fb02cf406e6eb24167 |
| SHA1 | e0c5bb6216903934726e3570b7d63295b9d28987 |
| SHA256 | 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654 |
| SHA512 | d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2 |
\??\pipe\LOCAL\crashpad_2836_ALCBCPAXUTYCSPHF
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
| MD5 | a8e767fd33edd97d306efb6905f93252 |
| SHA1 | a6f80ace2b57599f64b0ae3c7381f34e9456f9d3 |
| SHA256 | c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb |
| SHA512 | 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | d3a105517a973ddac056d9a8c61e2cb3 |
| SHA1 | 66b25f8bd747aee87a3352b2e9c10af9daadaf49 |
| SHA256 | 97a4a9cdb62853e6bc972371caaa59112dced483609c372615273a07801141f2 |
| SHA512 | 778a34e4ecb1f8350b079a4da36bcc8e3e9280e827be5d6f9fe43a98d911e5fa469a3ead46130b02330cc04ac3ce60a22a18912daca60a9155d8bfc3fba7364d |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
| MD5 | e123320cba39af3e5fc2f4574d6fe4ae |
| SHA1 | e393179cc4e42b254dd798941044bd0ef53267ba |
| SHA256 | d3b787b7162dacbf983167220fa00462d9742691d80f14d4fac2a2574b508356 |
| SHA512 | 5569b9df5d13e565bb38b8ff229c4d6d89636a64b23e4c805ae1e14c1d80d9587cdb0393426f1e97d161566d68c4c26447e715aab5aa32e5af3a8f39344b8920 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
| MD5 | 6752a1d65b201c13b62ea44016eb221f |
| SHA1 | 58ecf154d01a62233ed7fb494ace3c3d4ffce08b |
| SHA256 | 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd |
| SHA512 | 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389 |
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
| MD5 | aab3ac904a6589409b17c57a57f32f1b |
| SHA1 | e5f04b1ac6d6e4e2a81122e373946a016da79ca6 |
| SHA256 | 166e2ff0102d5da76fdf6e52b2f9f918c6bde0b49077f08726ab74a48ec0aacd |
| SHA512 | ca8486d768359b671a1ddccadb2897bfa0a848097706716d90f2dee2479da95ac57b03bad48be78e92eee8226865e968f9209a8566badb1c83dcdc311fd74c06 |