Malware Analysis Report

2024-10-10 12:07

Sample ID 240613-qzb36svgqj
Target a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118
SHA256 242b022e42435fdbba932207488fa3bd5cf10914f33052354a411321f3425e54
Tags
discovery
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

242b022e42435fdbba932207488fa3bd5cf10914f33052354a411321f3425e54

Threat Level: Shows suspicious behavior

The file a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery

Deletes itself

Checks computer location settings

Checks installed software on the system

Enumerates physical storage devices

Unsigned PE

Modifies Internet Explorer settings

Modifies Internet Explorer start page

Runs ping.exe

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-13 13:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-13 13:41

Reported

2024-06-13 13:44

Platform

win7-20240611-en

Max time kernel

149s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe"

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage\searchtmpn.com\NumberOfSubdomains = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424447959" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\{5E703563-7A42-4852-AB0A-637D4935543C}\URL = "http://search.searchtmpn.com/s?source=%7Bparam%7D-bb8&uid=a5067efa-fd61-44d8-9836-a4fe7847a3ba&uc=20180118&ap=appfocus84&i_id=packages__1.30&query={searchTerms}" C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A4E17F51-298A-11EF-A490-4A2B752F9250} = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000967b99be4b063009dcd00d5bba98402a6b0e4c4ceea4e86324e7ce47b23d896a000000000e80000000020000200000005d19dd119f9f6c1f793e9d6a270d157ebf67bd01683778e961f045014eb700c620000000f78503b7cf5e9f7c455da3372477b697fc875e52e50af290dfacf0fd5bb7d03840000000315c3ee6ffb9de26e352d9fcad69d9b3a02b5d6a3154ff3207dc665131a1ab8890bae3d2fc68aee040ef0ec662d70da7e24b3491abdfee50b69039df864fe2e5 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a0390500000000020000000000106600000001000020000000bc0b82b6d915901d6282a29403c14b494ace3d4acef4a79444ac586a5653ae2c000000000e800000000200002000000003b47828398f177e3bd0bd36b00afa97a7f786fc74849bf80d26dc9b34308be790000000e99acadc92f8723d77499a0998cc71e8e8c2d8078c898b81c80d2609bd4c4b79890ed0f73be1743cdc7dae34db5707cddd55c68a123db356771f3657d39030a5079719a808df4ede3f39a8f61d7eba450c89dcb51b2f30360758d3967e1b31a69d02374e2fc62328414c5392b66abd3d009d4b6aa1799a6e18f7d6c8b2c02622dd79712cbb9c80d67b9c6a12c115b580400000000377a561d87d94033a4dfa7b99bd54fbe3ff92f97c11c40661fbd89eddd5f2dcb0456e97dc48602158028ad8511c5ab7111878aa5419ec378f733de6934f8ac4 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\ C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\{5E703563-7A42-4852-AB0A-637D4935543C}\DisplayName = "Search" C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\{5E703563-7A42-4852-AB0A-637D4935543C}\SuggestionsURL = "https://ie.search.yahoo.com/os?appid=ie8&command={searchTerms}" C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DOMStorage\searchtmpn.com C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90ec6b7c97bdda01 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\SearchScopes\{5E703563-7A42-4852-AB0A-637D4935543C} C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer start page

stealer
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://search.searchtmpn.com/?source=%7Bparam%7D-bb8&uid=a5067efa-fd61-44d8-9836-a4fe7847a3ba&uc=20180118&ap=appfocus84&i_id=packages__1.30" C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2108 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2108 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2108 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2108 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE
PID 2764 wrote to memory of 2528 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2764 wrote to memory of 2528 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2764 wrote to memory of 2528 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2764 wrote to memory of 2528 N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2108 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2108 wrote to memory of 2740 N/A C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2740 wrote to memory of 2112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2740 wrote to memory of 2112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2740 wrote to memory of 2112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2740 wrote to memory of 2112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe"

C:\Program Files\Internet Explorer\IEXPLORE.EXE

"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://search.searchtmpn.com/?source=%7Bparam%7D-bb8&uid=a5067efa-fd61-44d8-9836-a4fe7847a3ba&uc=20180118&ap=appfocus84&i_id=packages__1.30

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:275457 /prefetch:2

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c FOR /L %V IN (1,1,10) DO del /F "C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe" >> NUL & PING 1.1.1.1 -n 1 -w 1000 > NUL & IF NOT EXIST "C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe" EXIT

C:\Windows\SysWOW64\PING.EXE

PING 1.1.1.1 -n 1 -w 1000

Network

Country Destination Domain Proto
US 8.8.8.8:53 search.searchtmpn.com udp
US 8.8.8.8:53 search.searchtmpn.com udp
US 52.204.0.168:80 search.searchtmpn.com tcp
US 52.204.0.168:80 search.searchtmpn.com tcp
US 52.204.0.168:443 search.searchtmpn.com tcp
US 8.8.8.8:53 ocsp.r2m03.amazontrust.com udp
HR 65.9.19.26:80 ocsp.r2m03.amazontrust.com tcp
US 52.204.0.168:443 search.searchtmpn.com tcp
US 52.204.0.168:443 search.searchtmpn.com tcp
US 52.204.0.168:443 search.searchtmpn.com tcp
US 52.204.0.168:443 search.searchtmpn.com tcp
US 52.204.0.168:443 search.searchtmpn.com tcp
US 8.8.8.8:53 d3ff8olul1r3ot.cloudfront.net udp
HR 65.9.23.78:443 d3ff8olul1r3ot.cloudfront.net tcp
HR 65.9.23.78:443 d3ff8olul1r3ot.cloudfront.net tcp
US 8.8.8.8:53 connect.facebook.net udp
GB 163.70.151.21:443 connect.facebook.net tcp
GB 163.70.151.21:443 connect.facebook.net tcp
US 8.8.8.8:53 imp.onesearch.org udp
US 8.8.8.8:53 dap2y8k6nefku.cloudfront.net udp
US 44.195.188.78:443 imp.onesearch.org tcp
US 44.195.188.78:443 imp.onesearch.org tcp
HR 65.9.23.226:443 dap2y8k6nefku.cloudfront.net tcp
HR 65.9.23.226:443 dap2y8k6nefku.cloudfront.net tcp
HR 65.9.23.226:443 dap2y8k6nefku.cloudfront.net tcp
HR 65.9.23.226:443 dap2y8k6nefku.cloudfront.net tcp
HR 65.9.23.226:443 dap2y8k6nefku.cloudfront.net tcp
HR 65.9.23.226:443 dap2y8k6nefku.cloudfront.net tcp
US 8.8.8.8:53 api.openweathermap.org udp
US 8.8.8.8:53 internal_tiles.tiles.ampfeed.com udp
US 8.8.8.8:53 internal_banner.tiles.ampfeed.com udp
US 8.8.8.8:53 ocsp.r2m01.amazontrust.com udp
US 8.8.8.8:53 ocsp.r2m01.amazontrust.com udp
NL 37.139.1.159:443 api.openweathermap.org tcp
NL 37.139.1.159:443 api.openweathermap.org tcp
HR 65.9.19.26:80 ocsp.r2m01.amazontrust.com tcp
BE 104.68.91.91:443 internal_banner.tiles.ampfeed.com tcp
BE 104.68.91.91:443 internal_banner.tiles.ampfeed.com tcp
BE 104.68.91.91:443 internal_banner.tiles.ampfeed.com tcp
BE 104.68.91.91:443 internal_banner.tiles.ampfeed.com tcp
GB 143.204.67.183:80 ocsp.r2m01.amazontrust.com tcp
US 8.8.8.8:53 region1.analytics.google.com udp
US 8.8.8.8:53 stats.g.doubleclick.net udp
US 8.8.8.8:53 www.google.co.uk udp
US 216.239.32.36:443 region1.analytics.google.com tcp
US 216.239.32.36:443 region1.analytics.google.com tcp
US 8.8.8.8:53 googleads.g.doubleclick.net udp
BE 108.177.15.156:443 stats.g.doubleclick.net tcp
BE 108.177.15.156:443 stats.g.doubleclick.net tcp
GB 142.250.200.3:443 www.google.co.uk tcp
GB 142.250.200.3:443 www.google.co.uk tcp
GB 142.250.179.226:443 googleads.g.doubleclick.net tcp
GB 142.250.179.226:443 googleads.g.doubleclick.net tcp
BE 108.177.15.156:443 stats.g.doubleclick.net tcp
US 8.8.8.8:53 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.200.3:443 www.google.co.uk tcp
GB 142.250.187.196:443 www.google.com tcp
GB 142.250.200.3:443 www.google.co.uk tcp
US 44.195.188.78:443 imp.onesearch.org tcp
US 44.195.188.78:443 imp.onesearch.org tcp
US 44.195.188.78:443 imp.onesearch.org tcp
US 8.8.8.8:53 imp.mt48.net udp
US 8.8.8.8:53 cdn.45tu1c0.com udp
BE 104.68.83.229:443 cdn.45tu1c0.com tcp
BE 104.68.83.229:443 cdn.45tu1c0.com tcp
BE 104.68.83.229:443 cdn.45tu1c0.com tcp
BE 104.68.83.229:443 cdn.45tu1c0.com tcp
BE 104.68.83.229:443 cdn.45tu1c0.com tcp
BE 104.68.83.229:443 cdn.45tu1c0.com tcp
BE 104.68.83.229:443 cdn.45tu1c0.com tcp
BE 104.68.83.229:443 cdn.45tu1c0.com tcp
BE 104.68.83.229:443 cdn.45tu1c0.com tcp
BE 104.68.83.229:443 cdn.45tu1c0.com tcp
US 8.8.8.8:53 imp.searchtmpn.com udp
US 8.8.8.8:53 openweathermap.org udp
DE 148.251.136.139:443 openweathermap.org tcp
DE 148.251.136.139:443 openweathermap.org tcp
DE 148.251.136.139:443 openweathermap.org tcp
DE 148.251.136.139:443 openweathermap.org tcp
DE 148.251.136.139:443 openweathermap.org tcp
DE 148.251.136.139:443 openweathermap.org tcp
DE 148.251.136.139:443 openweathermap.org tcp
DE 148.251.136.139:443 openweathermap.org tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\CabF00.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\TarF13.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6a20337836a387d181228e17f850249b
SHA1 318c20b66bec8cb70ddf714b8cdce17db02d7dc8
SHA256 550dcc1a7d7d1cb7ce6b057f19d01acbe302d940b9217c5072770b612a4b196f
SHA512 cb9d0e9dd36a398b8c26f2b6af2e78db57af1b677aed4901cc03e4e07469ca0d4c05c545f0d792411f09bf24052c8ec2b9ca9f07798a91713d0c21643d0194fe

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ee8c5334da2faea39abc80c1dbe02858
SHA1 c35bc864b891103a8aff5a8364a0cf45d2eef60a
SHA256 4e9038e947a11ef883a3d362464af866f71b76a295ca1b62482288f8973f0ee3
SHA512 eec808fe89e2c56561162fdb6e1632f78553005ba0d0bdbef7e62a69d315d65a5a88c0d6c373bde8ce37b326e5bb7f6ed6a77eeb275c38b76d8376a374b0110f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ab104a76ddbdeed26f2957ba42df17e7
SHA1 7eeb5782b401c071746cf2c785fa931bc0efd1fa
SHA256 2f9289fb1b1a9b23eb76234d9b492c3da42795c81cda38d1149d0d2f18a9e22d
SHA512 ac6f5a2a950a9585e5c603d464f322ede60067e1e61114f9993cf3cf6ea09a4469f68fd2d8394fd86f9af72b37d74285dd7335281eeccf0ed90262566426063b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 aa0332602fa5791539ecde56bad1b3e0
SHA1 e756f78640c146d08e9171b8df028854ba0159d1
SHA256 6720931063e214037fdcdaa17bee418e63598f8ff83b54114590bd43246d3f26
SHA512 6e10e48f9e59370bb4c4f6f2736fcee4a7ea21a4eb83c8f4b1aef8296b389bec2e431f479ede96cb84f60a1de32b603eb7cbaca52f987a2de24abc137cc98f7a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1925c38a955212a58d97c9264d9163f9
SHA1 2e51ef1e1c6f2da53e4cdb982ff355d9e8675ef2
SHA256 cb80671bd16c3d66fd5a4e397eb3590c9384fb06161843a775896fe31e36cc53
SHA512 cdf97024bc0b5b45a0e3fac9ef7f37ec32ce30125a312846df0b13045e0e55161ee07f23823bb50680e179c69cfdfb356dd3c79f5a7b8fdc3ab14957be3b5c57

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TNPG4FQ8\js[2].js

MD5 64631f0c7e3bf8993a385ccbc9767862
SHA1 9a36783f09269d486eeba5f7bd995c63d70786c2
SHA256 b009e07dbc054030978f445e719c56ea688aeb063ad74b310ae7967f7921ed31
SHA512 127a916f5f4641a961e6abed067c86a1633cf69754a0698fc1d8b1a2a1bca2cc0b960390c9a1800a4c7c86d5facd8df92c14bddf356b8761a3599bc9598e39dc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6240a01e90019ed33f7da240bfac6250
SHA1 1937df174c9739a0e819c35640f3589f8b0d1e44
SHA256 fc6bc653b852ff90b59a1bcf14a1b2dbe9407879a3e7f1a8500c36fc3859aafb
SHA512 55342864d58ff6a445552bb53f82b0c4606a1a17991d3796fcd756090b93f07c13802a14a022a66eb37034b70048d83df963ccc212c9da15aa51533d0ab129d8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 25fc96a15daf6d0ad717539b944ef357
SHA1 ff0de68cc702677e31b77fc46e68d46bc2eef953
SHA256 fef47a19e4f02a2562477c504e84d36debefe33cd0c00feeab3fbb6ffbf0a0f3
SHA512 59d5ef91f7d4e7076475cec245c5d2ca1c102e813350782d3290bd61903fc667b2db9cc2f9b47fd0cf6eb2f7919b6d5e13776d1e7f7e695d8d499e8c34f8f1e1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9dd271efc4b883796793ab66c1a3d0b2
SHA1 e34021139c6d4d0d6f07b1dc57db98a70e78029c
SHA256 69f4a376d07187ac0a49e22a7bba46b5e45522133828fc62e4bb9b6cfc438f9b
SHA512 2b464eb3023ae99ed206c471d843ce20f7fdd4b941029c6452cfc7df3d2aa1ca51bc6e49f5f1008f5f32e952c2ac4616ece00ef185050f0a2c1f492c6eea676c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_9487BC0D4381A7CDEB9A8CC43F66D27C

MD5 5445a48daaed8b986c5124ba47437680
SHA1 5745038ac4afe70c2577d661c93dd017fca8e113
SHA256 4f6659ef6d544da762627a51501e8ccd480f0debc8d5d3804e4116b9c5eb069c
SHA512 154812fbb21114f0593c05d2f654dce8378150c1f7937a975d19789150a9bb9d8c644a3bb6ffc43c8c96871c0ef48b19d663950bac209f05ef2d388a4b43663f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_9487BC0D4381A7CDEB9A8CC43F66D27C

MD5 2bf75edbb2bd681f86547e580213c4aa
SHA1 5fb2a38c42c6a05954c5f04ffb5f57214488a56e
SHA256 4462c6982ff0e2bcd94ef419cbb79732826c20e4e0c8c6c1d193e654957b9dd5
SHA512 b1b049f79685e9b534e667249a44a7d55c669d460fc087a2b22d9cf48d60084d1b942870e26f09b7b85fad879974b931c9db105b88642ddf6951547ff4905a24

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ILL7IV63.txt

MD5 d1d32658fc7f2bb8796c7013c0019699
SHA1 9840b5c407ccdb4c896dbbf446e85eadc77453b8
SHA256 651ff8c4859cbe298f2e07ae2a362a068407781c0fcfde65a246b18432470144
SHA512 0789dddefb1d412a3e13f721166b8540e07b8e97286ffc9e82738e15e0cf0d9ee7f5375ce91766354c3746908baa10b46aabcb67c58b279b17e3d99a84bed889

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M0DW1CQS\favicon[1].ico

MD5 504432c83a7a355782213f5aa620b13f
SHA1 faba34469d9f116310c066caf098ecf9441147f1
SHA256 df4276e18285a076a1a8060047fbb08e1066db2b9180863ec14a055a0c8e33f1
SHA512 314bb976aea202324fcb2769fdd12711501423170d4c19cd9e45a1d12ccb20e5d288bb19e2d9e8fd876916e799839d0bd51df9955d40a0ca07a2b47c2dbefa9c

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9yhbznx\imagestore.dat

MD5 6ed479bc8fabe429db456567a9d6d08d
SHA1 184838e45860873f4339fdc340022fa0c6bd02b1
SHA256 a48b06bb3a8378443f3413f51f6f7912b37d028f1bc0d0999b5a06fb21d4827e
SHA512 f161c34cf997befbbcdce968a5a750cfee74d0454948a3e6363ab92bd85408b9e8b2c9296a8a84cf46df7479eba3eb7c93b65fd4dd2798b25aab16cdbb495c7f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b21321f7b1e31ea326b317b4c5c5abeb
SHA1 5ccdc719cb34ae8112b7a69ca3ab4a5cedae99ce
SHA256 afca7b0a4d6145c28585fdbdbb1e80c355d9e26478405c8b15de57948616d8b2
SHA512 50465fee499b1e8f964ca612ae19cec133a6fb07f7d5a434ed590b1c666e262173683eaa8ebba46d9c804ad1a2cd09489e1203d3589936226e3c3a22f6688427

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5bfc0b872ea1ae9432c1c7ace5bbf75c
SHA1 fe48ad7a92a71ef2eb319730a0cf20697f172a26
SHA256 97ef1654e31763640e3d8388efad7282504591b05ce3522982f484cf90a39676
SHA512 bc62f6169ecd6b3bf5d526f93dd5f59ce904de6254eb191cbf292d350de325ce91b7c3b11733b94aacda2bb9733b0eca14a8a0920c9961e363f2043e86ee7eb7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 08a4cc3165e6d25e9d119408ef3e2056
SHA1 dece4c03e298916ddbe206164c8e53758118a63d
SHA256 c0be2233e72ced7aaa481745da3270ce9d126aaf5fcf1ddad71600dd74664661
SHA512 40db13004e1a14cdb9e6bb65ae2ac59920e87f59405068d2686424b650e26ce4a8db1222205c3442e243fed3c18fa144c56e508d8c6bbcfdc4c645ce105249df

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8440ea88133389d836867ed8bd505158
SHA1 d0dae897b2bf3bc3a16a67acb42531dc27fe52bf
SHA256 eab0c6b53b4000f33779cfc935044afe5c182b612cbcbd59d8c98cb76c060a09
SHA512 853863f80667fa249586f8b6f80d8cb9578db0cd6f44a596068b4c9b3356b82abd26c3d8357af2f25faf0ef0944b06c9db070c7809ac4c15fde7455b3b58ae98

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2d643ebe08119669e2b3ffd7e27628c0
SHA1 2e45b793a1b4d03a98b7425cf5b4e78743473dc0
SHA256 474d558d8e28b21c6b13e2018e0ce3f9221e1a86c58a79d4c56fb8d793c75fa3
SHA512 eec62f2069e9fb14637778e15012cb0729d27d42d627c9527e384100ad4eb7036436065c436a2d804c8107ba95502948186e3bece44cda0324c6b1e1a5ec1e97

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c1013a9fbb8ccbecf51f0c573e8b5a44
SHA1 3e17a9b230d164fcba28f5aee50fc68b6218a824
SHA256 853246525a3ee05af25cf09bb1a423045f032eb905713d3c478d60fb91c8479a
SHA512 41d8f52acd52022909c462ab0b8588e4b806dcd09fbc612adbb96902ef6b3b4956ab7f2563a1bb81879df9bc71a9f55819f6b27ea7bfdc4b33ad66122b0f15d8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 72a97798a44b65a80a1e6f7d44d1a83f
SHA1 0f17e42f8310215c2e6c1a4953b2cbdf55ab97ea
SHA256 304a995138b2f747b2240fbd62d6f2edeaa31afc0ea2bc73b73d055028be1962
SHA512 ee8ef88b53ec1c5d7771e145c5ba47d484ad137b5d82643aa92c728d4b3acf8ce7c91d5e8cea851b7abc0498e6e52ef2e6cedab7a55ef46301240c0a3f706b18

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 54242c1e449300b5ab9bf23bcca49e4e
SHA1 98367f5cb8083c724eb41d76dcb69864741e0c7f
SHA256 9cedc965a4d6f0bb4b60b5809d26af6149ad85ebce2c490069c5acc91c25c1d9
SHA512 d09512b610c1eaa1a411d4a68bef381a366e4707c8d9230afa58486f67d6f7586b54ce2d30b48b193ce90327bd585185630645dcb469574d23748a4e4ff1ada0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a09f5b0ed49364cf8054c0d0186446e2
SHA1 47e63edaae1306856b2b373b9afd480208a83ac5
SHA256 a760c33ae3aeb930f74ab8ab7a84b57983d959c6ea3ce1cfca0cbdf2e72f13fb
SHA512 b6341b6f8125a3d59150d5db1c21f31c1e0d95252f1ef859901d9fffe147439b8eaa22be046436116e49af042e590d01f61cee53d78d27ce24f3b2792e1e4d1a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a67671b2fce7e98f79522c7ecd2a911f
SHA1 2e4c9b53c0c1a27c3e91e39c99b8140ea66354a8
SHA256 572f59f0475a182da57659c8a5e860bf2d5ff3912754b1515f94bf1b44687544
SHA512 53afc94e5c5cd97bec432f5908d2e61becac2444efe4550f97eb4b8798e614c4703893366604577f2831bb1078a65e28eb02df01f6e89a03229ea72c9d4d08af

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3e2f1cb0165bbb1c99b7b67d762e56e8
SHA1 65165f26cee1d8cf5d1e6dba74bd978fdaf747d3
SHA256 2cd6e3f8793d383d56daa08292bbc2bc386573e81595c1577d4478f074d04abf
SHA512 36947bf8b8bd23a3166b095a9a3bf19d7ab222a84b06f382d357cecc8dbe4f5fb5cc843bcee9a4552ff8f4ecfb035ddfb7cc4121ae9ca8fcddfde8392bd979ae

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b901f3e52dda10694516d3a78455960f
SHA1 db86c2fd6003c1f428636d5d9ff4085e5f94c2e2
SHA256 4adb8245c6357524c7034d55f2dc71f65c400efb8a3d51068f68a8177c51cd90
SHA512 673bfd5fcea55d724b5231c131c8d436239d8a0520fd158bf5671b7086b08427dccd5782bfd62b88934ba6c34b12176a5f2053ba53997f14f66650d6cd7a70a9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c2911882b07693590620b37adb823eda
SHA1 7358284c31ae143c7d054435076b34a3d9d80883
SHA256 b0fbdf046c4fe1e8a13c6e22194e0bca46d058666563bc171a35e114ef894a10
SHA512 74c02aadd47af2559c17ab6f2ddbb9e1c6ab0ee24d51037a6f5029a48a46836400a5e8ea95b2cc403661b14b81d4a32cad6d0a287aef2ef67ca377cd9a8465c0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9cd44a20d0e907f0c48b7c9bbea56cab
SHA1 e55e52f6e4a0bd681c02977113c2565c1e5069cc
SHA256 e912902eb7448311e27a9f9d1c0bd1822442d10660c759d3a9ebe533280d84ea
SHA512 548d472ee838239b3592229d9f825d5190cd442d246123a9b7379f10440e01dccfe040ad36fc27959238146d285698c50002d68f96d8f25495162980f6011b68

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dc07300b76a117c54e8369b6c0ff09ee
SHA1 feef53b9ab2d273f01dadc060aed01c0ece61fca
SHA256 b78fd1b596d540b6b319402d34cc5318bb0a1b9e660bb4afce5119f33427f3f6
SHA512 d01f436e20ad7f18848a822bdb26d17a6ecde0f2c21ed11327b7541d1db0e92476d5abc9200a49d62fc63baaa9f56a3d40fc5abd5d252605eaf57aaebbae7ef0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e39d2d4d040d3562c778b97eca8f60dd
SHA1 3f91986d8f2a9f6c207a413970e2a79f4b7f39fb
SHA256 1751026b1028be55bea9ce2cf3b7c10bf1c9a178af7b641820b9b50e6b86f647
SHA512 f2f41b33690054a0adb76f3b9cbf643702c26be323b3cff8c9f8a9b7ce4f67bafbcea98865528da65bae53f6ff5581ce5dd214022c735e6a41e0d915b6bdbad7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 538f33e86eac70aa0649fd3ec3ebf165
SHA1 aa4bed09c3ee1cef86df6117563f8ddee43ce03d
SHA256 e81c5f6d1a340ec48c865104c647cd68e316a1480f01e32ba3b68532a10e447b
SHA512 354b493e606f996d54d9d7b995111e7300ced618cf38ceee92bd98c8d37bd50cad25ba49f9a4eccd430e151c9f49b4d8091997e9297431463fb6baac6e9ddf44

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 67cce22895681d0973eaa74ee78cec50
SHA1 137f309b39dc6f43cfc2913e89506248bada3686
SHA256 4006e861feda3205b5a3e5d726a9b499afebfd4aa3eed072f29b0ffb6e0a3645
SHA512 453c1edc91b69b8092b33e95a6396a39a79a51590b241986689b971822f37484233d0e3b4a223b71e418f6c48dfe035cc9a89dd43fefaf257b8fb88810bdc4ff

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b751ce4298033bc43efdb668a6b12399
SHA1 eb4e6e3fd59e5c6b4fbe29f1cc635374e9977947
SHA256 45c5d681c573f92dfb032e978dfe6df7ba674165a9583cb061da9069b92bddc7
SHA512 320bd796fefe2dbcc4a2b2793d1f2d07d04114d08e66475ba2cfeba1ef8af80e144cbe0f96982540072c70d717f133bbaf48e176037999fee45ef588f57968b4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 a5e1048275735efc6ad015bfb9228b59
SHA1 5fef1aac3def6d645ec21b859d18b5edac34f4e5
SHA256 6608a8afea45feb1b1f877192fd87360d086fb33930f1a5f05390bba755ee86b
SHA512 dc7682fd47d4006475efb311fa9bde2f6fad7120a0dd986508b4249504bd3ac8cb68538d1d0e5dbf5b57128b8cab2c89104f9c5d2bdaf349f9a68a8f23f32930

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-13 13:41

Reported

2024-06-13 13:44

Platform

win10v2004-20240508-en

Max time kernel

77s

Max time network

94s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe N/A

Checks installed software on the system

discovery

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424447978" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C4C903E7-A422-47E6-9F69-E2B196334127}\DisplayName = "Search" C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageShow = "1" C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C4C903E7-A422-47E6-9F69-E2B196334127} C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C4C903E7-A422-47E6-9F69-E2B196334127}\URL = "http://search.searchtmpn.com/s?source=%7Bparam%7D-bb8&uid=a5067efa-fd61-44d8-9836-a4fe7847a3ba&uc=20180118&ap=appfocus84&i_id=packages__1.30&query={searchTerms}" C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{C4C903E7-A422-47E6-9F69-E2B196334127}" C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\ C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C4C903E7-A422-47E6-9F69-E2B196334127}\SuggestionsURL = "https://ie.search.yahoo.com/os?appid=ie8&command={searchTerms}" C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A954E15E-298A-11EF-A084-527CD1CC5F27} = "0" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Modifies Internet Explorer start page

stealer
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://search.searchtmpn.com/?source=%7Bparam%7D-bb8&uid=a5067efa-fd61-44d8-9836-a4fe7847a3ba&uc=20180118&ap=appfocus84&i_id=packages__1.30" C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\IEXPLORE.EXE N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a5d6a3d55f6aec29a359cfbb12654d10_JaffaCakes118.exe"

C:\Program Files\Internet Explorer\IEXPLORE.EXE

"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -noframemerging

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3440 CREDAT:17410 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 search.searchtmpn.com udp
US 8.8.8.8:53 ie.search.yahoo.com udp
US 8.8.8.8:53 ie.search.yahoo.com udp

Files

N/A