Malware Analysis Report

2024-09-09 16:43

Sample ID 240614-w71dmasbrg
Target ab292f2bdd9dc6f42cfbc8757b848646_JaffaCakes118
SHA256 51e982bd80551ef1c74416ca3f8e7e7bd80305d5114c37dae0b67356c1ce4fed
Tags
ramnit banker spyware stealer trojan upx worm
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

51e982bd80551ef1c74416ca3f8e7e7bd80305d5114c37dae0b67356c1ce4fed

Threat Level: Known bad

The file ab292f2bdd9dc6f42cfbc8757b848646_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

ramnit banker spyware stealer trojan upx worm

Ramnit

Loads dropped DLL

Executes dropped EXE

UPX packed file

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-14 18:34

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 18:34

Reported

2024-06-14 18:37

Platform

win7-20240220-en

Max time kernel

142s

Max time network

143s

Command Line

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ab292f2bdd9dc6f42cfbc8757b848646_JaffaCakes118.html

Signatures

Ramnit

trojan spyware stealer worm banker ramnit

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft\px21A4.tmp C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\INF\setupapi.app.log C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
File opened for modification C:\Windows\Downloaded Program Files\SET2B26.tmp C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
File created C:\Windows\Downloaded Program Files\SET2B26.tmp C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
File opened for modification C:\Windows\Downloaded Program Files\swflash64.inf C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424551941" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BE8BA1E1-2A7C-11EF-8547-E6D98B7EB028} = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bcb23a1ba49fb1408feb41ee954e2f9000000000020000000000106600000001000020000000366650c9f6a87e0ab6709205a4ed7046e6e81b21fe989be581e64e0658b43307000000000e8000000002000020000000703cb1b6aebe44b3849331ed951a4e07d6f02a3518386928902cddcb9fb29f082000000083227d43710bfe01eca2c6675f7358d0ab4a721033430873411a2d50ced0c4b2400000005efdfba3e68cc6cdacc231dc9ebdb35fc38323b5aaffa3617234f52bc4841fbf307d802ec9dc3ded958804a40b107d0cde39defcfbdd247a2540bd1d815d9e14 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bcb23a1ba49fb1408feb41ee954e2f9000000000020000000000106600000001000020000000c55adc19a397e452c6fbd29b4682042133b2d0c45013006f042a5561531c2aca000000000e8000000002000020000000f08da51e9b7773fb11f915305bf60ad4b3778ce0dcdd2e4ba4e7b089837ecd6c90000000befcc7cfe49a64e92eee258715729bb7a5ad5c0a76dbf1af4fc5d1434e959596fef706068558884c5ac7a3fa889c94ba79b5de605293743c01c08dc71a9c870b554f6b1d9b961dc4ecfa9d0bccd28468f32cd62fbb467cf8f512109ff501f60efcc1b4dda2c62a6d45c37a5b89be87346e89e2ab140de531523c9b2d0f3f57162ee6bc7d41bec0dff438ad160382e732400000004c653971e73492815ab3c6cdd5089a7a65fb3e1a01c711ad2d12133da91f0683660884f99c3c40ef64aae19c9eb298c9c2546b41e41de07644daaf163d763028 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms C:\Program Files\Internet Explorer\iexplore.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80699a8489beda01 C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry C:\Program Files\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A
N/A N/A C:\Program Files\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2172 wrote to memory of 2504 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2172 wrote to memory of 2504 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2172 wrote to memory of 2504 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2172 wrote to memory of 2504 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2504 wrote to memory of 2736 N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2504 wrote to memory of 2736 N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2504 wrote to memory of 2736 N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2504 wrote to memory of 2736 N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2736 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 2736 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 2736 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 2736 wrote to memory of 1260 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Program Files (x86)\Microsoft\DesktopLayer.exe
PID 1260 wrote to memory of 2276 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1260 wrote to memory of 2276 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1260 wrote to memory of 2276 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1260 wrote to memory of 2276 N/A C:\Program Files (x86)\Microsoft\DesktopLayer.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2172 wrote to memory of 1756 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2172 wrote to memory of 1756 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2172 wrote to memory of 1756 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2172 wrote to memory of 1756 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2504 wrote to memory of 740 N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe
PID 2504 wrote to memory of 740 N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe
PID 2504 wrote to memory of 740 N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe
PID 2504 wrote to memory of 740 N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe
PID 2504 wrote to memory of 740 N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe
PID 2504 wrote to memory of 740 N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe
PID 2504 wrote to memory of 740 N/A C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe
PID 740 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 740 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 740 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 740 wrote to memory of 1016 N/A C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 2172 wrote to memory of 1720 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2172 wrote to memory of 1720 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2172 wrote to memory of 1720 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
PID 2172 wrote to memory of 1720 N/A C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Processes

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ab292f2bdd9dc6f42cfbc8757b848646_JaffaCakes118.html

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Program Files (x86)\Microsoft\DesktopLayer.exe

"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:472074 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe

C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" https://get3.adobe.com/flashplayer/update/activex

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:472082 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 cdn.joy.ac udp
US 8.8.8.8:53 services.joygame.com udp
US 8.8.8.8:53 i.hizliresim.com udp
US 8.8.8.8:53 cdn.joygame.com udp
US 8.8.8.8:53 ads.mgmt.somee.com udp
US 172.67.154.131:80 i.hizliresim.com tcp
GB 163.171.129.134:80 cdn.joygame.com tcp
GB 163.171.129.134:80 cdn.joygame.com tcp
GB 163.171.129.134:80 cdn.joygame.com tcp
US 198.37.116.50:80 ads.mgmt.somee.com tcp
GB 163.171.129.134:80 cdn.joygame.com tcp
GB 163.171.129.134:80 cdn.joygame.com tcp
GB 163.171.129.134:80 cdn.joygame.com tcp
GB 138.113.101.21:80 cdn.joygame.com tcp
GB 138.113.101.21:80 cdn.joygame.com tcp
TR 185.70.86.121:80 services.joygame.com tcp
US 198.37.116.50:80 ads.mgmt.somee.com tcp
TR 185.70.86.121:80 services.joygame.com tcp
US 172.67.154.131:80 i.hizliresim.com tcp
US 172.67.154.131:443 i.hizliresim.com tcp
US 8.8.8.8:53 apps.identrust.com udp
NL 23.63.101.153:80 apps.identrust.com tcp
US 8.8.8.8:53 x2.c.lencr.org udp
BE 23.55.97.11:80 x2.c.lencr.org tcp
US 8.8.8.8:53 platform.twitter.com udp
PL 93.184.220.66:443 platform.twitter.com tcp
PL 93.184.220.66:443 platform.twitter.com tcp
US 8.8.8.8:53 www.joygamedl.com udp
US 8.8.8.8:53 vb1700.mgmt.somee.com udp
US 104.21.40.73:80 www.joygamedl.com tcp
US 104.21.40.73:80 www.joygamedl.com tcp
US 8.8.8.8:53 download.macromedia.com udp
GB 23.214.152.196:80 download.macromedia.com tcp
GB 23.214.152.196:80 download.macromedia.com tcp
US 198.37.116.16:80 vb1700.mgmt.somee.com tcp
US 198.37.116.16:80 vb1700.mgmt.somee.com tcp
US 8.8.8.8:53 fpdownload2.macromedia.com udp
US 8.8.8.8:53 api.bing.com udp
NL 2.18.121.28:80 fpdownload2.macromedia.com tcp
NL 2.18.121.28:80 fpdownload2.macromedia.com tcp
PL 93.184.220.66:443 platform.twitter.com tcp
US 8.8.8.8:53 get3.adobe.com udp
NL 23.62.61.185:443 get3.adobe.com tcp
NL 23.62.61.185:443 get3.adobe.com tcp
NL 23.62.61.185:443 get3.adobe.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 204.79.197.200:443 ieonline.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 204.79.197.200:443 ieonline.microsoft.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\Cab1DFE.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar1F3D.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1d4bec8a811bf0de7952383af8c0c518
SHA1 bf6ce457c7de6b5ea0b72c5485d9330cc372fdf5
SHA256 19dba48461e232c9449203f4dcd8111e4539af1faa808541cff2c2f56c419a99
SHA512 155224b1f8394ae1fe0862fe0996cf58a7f0abe7d0dcf0e3b4af165b520d52630a835214c6b8bcd3f771cd2cccc50f40adc1877df0ca10b30cd7a91fb619d8fc

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\jquery.tools.min[1].js

MD5 64d50c53837cec47dcf42cd3b0bbb4dd
SHA1 5a863240c2e4bb834e18131164354ba39de813c3
SHA256 09c51f86f67749e38cd2f3e2a39c5e90e3ce442f8ed20b0aa3b1333cb86551ff
SHA512 c76ec9ffd913fb7a2d4e27a5948b6cd82da062f1aa05d20fa140de61a2b3cba4caa918b2189ffc0048be1202f9313e4c86488631764e5b3d606c8bb4e699afbe

\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 ff5e1f27193ce51eec318714ef038bef
SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

memory/2736-238-0x0000000000230000-0x000000000023F000-memory.dmp

memory/2736-237-0x0000000000400000-0x000000000042E000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e1107d1f707a1cecf51db442144797a8
SHA1 a88c4654bdee010e057624bacf373d9091c7b5ab
SHA256 68b2015b25fadbea6df1285a44fd4fab344a13acc6b591cf13716a97c54045ba
SHA512 309bc52d7f024479db797486a43f12ea06f2285831ffab979a13eb817470fdcb85a05fa43dbd70357fad7f6bcc9bef5446e103b7cc75fa3f188ffb1199b06a9e

memory/1260-260-0x00000000003E0000-0x00000000003E1000-memory.dmp

memory/1260-262-0x0000000000400000-0x000000000042E000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5d3e804b02912ba48be4978dbcbdb90d
SHA1 37c7b92f9d0b7a80d9019cc8be9422874e0c058a
SHA256 b1b9b81dfafe882abbf87ae38002faf5a28146da40699d89bc7e3223448a4465
SHA512 e64fedb0671ff3eac737b20f8cc8103cd72415d7c95dca7fa23aba41e2ea2ee86b8b270a368a5c5adb8b9ed9e9f1a65cdddcb0000b7adbf88fe7074241b96eb0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3d746e210ce1520b2e0cacbeac84e9a6
SHA1 31471f417c504544e335c0e28031b9a96bbae171
SHA256 11f963572a2c0391b54cb140791900ea929809b93c352de31d1476287acea22f
SHA512 ddadb7af5033f7c7604a0904ad716d43b1262615310ec51d71ec1a12b55082027ee70a80bf6bc7913115f0a633966cdaf9b9ee5e47ee1b16f3370767ec553297

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 87c7442f59c639d7ed4e3117f5a7c8e0
SHA1 bc042ff8edbc569b4b1df478480ccec5bbc1d1f4
SHA256 feb7d87cadae927585a918d22d1a06bedcbb544cc955a8ec8d56ff332ec4f97b
SHA512 6b5e8fc2dfb2f2207e085d3ecc7597ca0c9e50801fc0befc9de9794f6a26d6b53684b070b76cc861e732548686f862fd158201a5dcbc59662df32c9f9a6ea92e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d6851ea1d6507c420c0703dd6997c014
SHA1 9d4f18438f1557af7197ee3ee6288906c207a1a0
SHA256 9ffd9e3cdf0115f36289bbc744d0a70d95ba56affd11b4b5058baf0e997653d8
SHA512 4c6e69f30b91d35aa50fca1ec58df8e28ed47cf95f615c40058c97b0b340164578623fc41ef625461c53eaa6b11450673596c4fb33c27b4926b750abca95a0cd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 852cc2578d7bcc46d61177ba18ef4821
SHA1 cf74fca09e0d8221047801612c931908e8275427
SHA256 ac55a49a372b19104a7228c733798d5cdcb403f64f53d5fd48768426a7679937
SHA512 8c492e5bf59cbde58ae8b5b8de1856f8ae9f56c9677e118aa26597585efc4f15e21267a6fcdc9ebe234adce8e6132f7d73b89619952c59b9e0a6b1a919650ba9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f4d0d4ab61e35945fdba2eb7952d1543
SHA1 994fd59b25b9c27ae98c28c4b5b1e99e43b44fc6
SHA256 80e5c69be72ef47f53d8ecce46e07a02d9a81d868774352330912d5ade8a3676
SHA512 3f753f06745082484048a9a69c65ada29d3425beb5f9cc9a6c38b780c9c08ca173f3629de4e6da1ce90757e7a4a9834428d6776278ce856b1d29759649133425

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 861653149bfbe1041b645028d3edd8d2
SHA1 1f9d236e188c0835a8836d2deb1c31bc945acff9
SHA256 204e246ac1fd3811cc3ff57fc996148b9ffea847bc6b18223c738352bd642568
SHA512 7ecbb428e6c1d8e03a53c121baf01ff912b43b606f1cd2005a316b058db51eb340c6301b8e054f26c059e6429fc36095bf2f7522051b78d775e7f0be3a05dd7d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5603ee2940cb19ac19f82c3edb0201ac
SHA1 b379eb77408a322d4002dd963a440425ec5b42f0
SHA256 7527ecaa2ab747f6e6a8cb38449c31708bbaca878586f3f4a9df171541ead05b
SHA512 853ea64a59c6d26ddd38b79d23c58561369e916836af62da3f4d867896b3f2bb78e99ac753699959b711ce1da552191ff70856f01bef350f720df2c699721be9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 dfb11c5a6d100615ebcf7afe82d5c60f
SHA1 8a1699aca1a22cb494adcbd7617a7343852751d7
SHA256 d7ce797132d955781021a6a217f4cdf21d4186956e89ba231fd9ca769d833f64
SHA512 f364a3b3d4a1f6fbbbddd23a5186a23231540c557056f5ea622e4d74979355a3a3f57d06c14c5a7b3c49dcdd0472801a395b49250a2c578a3f5fc85c03819d07

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d664fea8409332a62fe281d94ca0befb
SHA1 e03a767f65323ad93b5651136072ccdc52519c6b
SHA256 756827002771e77d48b65b656d0d6be953fda8e4b4b52949f068f0882fa140f9
SHA512 e1435676ad1c7151104e6643bc3fdc7e1a600ac1007da05b47567d017bb76b4cb9fc6532a41cfeda650f00b1e4e48d085731efd12937ff83e3c6a6a5bb1cfd16

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 467ac473d46c7408a8953957ec68ac68
SHA1 6c7cd561a212a9fdd96522bea192b82f2961c542
SHA256 0ee1b17b1ab32911114aaf4e9ad36b5483733c95ced6e411342d30d4baa24011
SHA512 36bb4a14d7795834b8f44b4e1883eb79209718aa21dfe69135ac501e6331c886be1ec118a4e0088dff69002c8b9c28d311153851a1825c9243ad9b7d5fec6800

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\swflash[1].cab

MD5 b3e138191eeca0adcc05cb90bb4c76ff
SHA1 2d83b50b5992540e2150dfcaddd10f7c67633d2c
SHA256 eea074db3f86fed73a36d9e6c734af8080a4d2364e817eecd5cb37cb9ec9dc0b
SHA512 82b4c76201697d7d25f2e4f454aa0dd8d548cdfd3ebfa0dd91845536f74f470e57d66a73750c56409510d787ee2483839f799fef5d5a77972cd4435a157a21a4

C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\swflash64.inf

MD5 60c0b6143a14467a24e31e887954763f
SHA1 77644b4640740ac85fbb201dbc14e5dccdad33ed
SHA256 97ac49c33b06efc45061441a392a55f04548ee47dc48aa8a916de8d13dabec58
SHA512 7032669715c068de67d85d5d00f201ee84bb6edac895559b2a248509024d6ce07c0494835c8ee802dbdbe1bc0b1fb7f4a07417ef864c04ebfaa556663dfd7c7f

\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe

MD5 47f240e7f969bc507334f79b42b3b718
SHA1 8ec5c3294b3854a32636529d73a5f070d5bcf627
SHA256 c8c8cff5dc0a3f205e59f0bbfe30b6ade490c10b9ecc7043f264ec67ef9b6a11
SHA512 10999161970b874db326becd51d5917f17fece7021e27b2c2dfbee42cb4e992c4d5dbeac41093a345ad098c884f6937aa941ec76fb0c9587e9470405ecb67161

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1fc0dad6deddd9f8496e264bb711b9df
SHA1 2beeaffa6f738c757cf2b55b34d84d3e04504078
SHA256 87be3722f7cc4ca96cea89f3f39b500fb845fcfe76cc57d8b642c7fa751b35ed
SHA512 ed7d4f4690afa0fb4d0d316814f50b50e834ca2e6703593cf933cb89f6ed71cb5ca8dfb8d0e28b49811797671bf3ce62babe40a608627d7186767a201696ae43

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 bfad0e851e7ab92a99d977b01dca6a14
SHA1 8947b798350b291b3e5cb90a565936f8635c7910
SHA256 a3083d7387627a566313a107b095518f6e057bb0656331ed47aaeb82c3fae74d
SHA512 c530035150c66be4f75c90cda72cde2113667c811437ae4ba7c1a2464bdc47f8fa7000b7d386a9ba347c4a299c8a38be30acb8ccb838ad7e9f68ab8b4b7b6467

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 6af96ad2a13a03a3fb0372711c6530b4
SHA1 59a33c414366922185cdc237a22088764992745b
SHA256 eef4bc083dfd7fab1070e006b3a53650970d0a7c8daa020a629001536c379829
SHA512 d552aa63a6a4633cc231cfb0123dd4e7972f5a020ba94b714d3250f8195310a6e897189ebb7101020ab5e77f555a86832661d8d62f5c549460386861fdb5a6ae

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1ceb4939da8797452649e2aac028a484
SHA1 6b4b31647e73bb773960a5c8ce19bdabe851efe7
SHA256 3c8719c13b086b120b6bdd1857f3673a9e36d153e2caf09922fae73bdf6025f1
SHA512 000f90cba78056248ae6abfc6c92ae9329f9e4ba4e21da0ccca8173761683ace445193cca6752d67b866ee0dd3477e70d8a14da39ac23601c97e2cf7ded57268

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 89ebffbaf254a92c696285d63e1a69d3
SHA1 ef70eea91a26797a87161cff1dc2d96cb616aef6
SHA256 3d54576c03665ca317192060774b0be666f649434682084cc5422e1dc4a3ce09
SHA512 454607bb0992b93a0b3313a9823bf7b4e8af75ceb1b49174014082bece6c1014ab92929ddcee3cb89b0c35bf91ab2f89b3d5fffa499f4e7c8b5f36311b7ee859

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b3ea51b93fd22329ed6f0439b01774fb
SHA1 d394c474f31be148027b7856922ccb72abb3362d
SHA256 0e3af717cac038115e8d705881a8208c7e644c073baedb241f1e5c7bdebb6a90
SHA512 81e9e25ef82e7cb7a43a1baf6c64299aecd18da04148796aee3dfc26198dc6399b9cab1442aee51dcea3f8ad19fe7e786a736f5d09268510ef25a8fa8e5e097c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1ce7a6d29f350f036ca8ad348d937915
SHA1 4d1655aa61f850c749e7c4825dafca7c75177c39
SHA256 b9b0997431f7c1fe8fba4f53b346700f3823e8157e3b3d66332d297981fb97b5
SHA512 af52dd2c01e7154f3530d37b83e8aa994adf585dd4261cc4e40dafd66d6184974926aa7ef841fb700f70258d84a14af62c1a010e1f824501cecfaf0bdd9d9ca0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c5c5c0dfd868e3d2350288b32dfc873f
SHA1 192de6b3ba99635379dad7f57660be1ce5162063
SHA256 38b6c6bdf99f49b212e34877ff914f35e11c5c9e8f9ef9efd64c833b2a287e16
SHA512 51fdf01cbe1a7e525f58948f0f56582cbb6ab096d5eea38e3c0ebfc294561db46efbc978d6688e35b5ed0b000b3b72c098a305c6a46ed22634fc477d34d36d85

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f30c9cb630b9af926891e31ca9f82ea0
SHA1 cebb79e11974168c5974294463ea2650372005f2
SHA256 c3c30f053cb5e4cc1f498ee55becc5b13c0d077a4a8b4a7a780d6d8c2c8924a2
SHA512 deaf9dcb67146bcce0ac6acc16bdbb95d8423273eeeeb0519a915123533dd10590115db450d47d9339b12fb0778c879eac1b73aa33e47926df2512ea5b53c28c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 20e028992c8ed28b34fc8708fb1238a2
SHA1 f75068a8903c7d0a41d343d6350da2c0c0c7d9a7
SHA256 2224fb56b8df39bb78a7817457bffa850712919f024d122258f97038654d8a25
SHA512 529b287392611b84b2ba7d2b01010a55417b39d549790a347e347b24598b42e4538cf80955332827372e2f41a6271d048855caecb4488f7d67ac9adb753421d9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 8b81e26b9eb5ea3f26a0f7dc60fa86c0
SHA1 98be4d712354cd906296c51569643913d6516a65
SHA256 1d850b4e38798a4478b383d5696a6a1330d118593d2b4fbc8825b9aa88a65e6b
SHA512 980ce6f2db7b1b57f1c9b7c2eccba325bd5be78bdb1d3957f43f1d813e9772ca0f246f98a8a32180f4a0af607a489ed337530fbc57cc02d2aa3aee2b412f0122

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 50f02d61f972b05dee2fd925379e6d15
SHA1 32034337f93563076baeb620cdbf254dea49de55
SHA256 62a2aeb80bf97f39e0c3ad890bddfd7ba4ad2d3d296e6ad76c891c6ecdafa1a1
SHA512 744e9a97100ad85fd3dff20aa38fc81b9aa752b11c9af7cab9ab1cb22c648a94209721f7533a2960d8c44df44b7f71424d07370df8d5a5ffc6b76b93a3e32af7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 1b44aa195b9877703d5acd0f10341234
SHA1 ac3aacf420c485764f2c32d60ea3a3f3ca42cb0d
SHA256 5cca4386b8d0fdec57a9dccf0c5435a90f34329223c1ef0d19640b2faf7777c6
SHA512 3d8014ef38e9e417ac15bfa8e0ea01d15f3652ff7ddfe1fbfccabe606dd771a17686a184b5749d0692e592309b0f86a3d78c6bbffd8bd8b7950e2e51ff6c372d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

MD5 f704db28664a70d6884a24deac04d09e
SHA1 61f37ee248b43cd6763460d9951c0253a6abb34c
SHA256 02b04ea22b183a526d4f061c8253093b922391a3887c801fa56ee4863b5ee03c
SHA512 0e86fff0e6ee40c803bbb38a1cb05cc0995f352c2ffceab21dd554595651f58bbb9deb14064e5ac94217d7299811ab3a5de7d9bf486349d5f9db8cdd4db3d95c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 e69df4aeac7c0af3878eb5132f8a2601
SHA1 30219bde3cd99b4df79ac48c4aa8dcf2b9b39131
SHA256 1d5d322e146cf19e38a700c7fb459a62c1f78804738e9f3abecf7b773f5a9322
SHA512 5d6b373decca802425d919fca15460ea94fc02df56d02a1dcd84ef178ff61ae8300386a75d6e47bceb8aa93d9938ab8dc3fa80715c7b17fe9b058a3f90e9582b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3d8efd49825e89c214a84048231f6815
SHA1 b068418b41951287081804ff362accf6d615ad32
SHA256 a2544754cf3e71ac4d3b18ef55325179c9ee6bac56c39a7cc8fc3934ea5617de
SHA512 95f6ca1758fda62aa232037f057d318023f356fa62dd6840dc3b267844a87fe5a443ff455a89b46740162af436fd2ac8139b408952009fce127e4652c75be701

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 9861f26d4f96f834dd82cb7450be756b
SHA1 d9f32272aac82724f343973ab35bdc232cff6da8
SHA256 a9a98b1faaec7619957dd3f3d5c6abffd33ceba722ae1800a58e515c60027b63
SHA512 fced35630961930c2c885317c3cfd8968a3d3e331e5cac0d8e8153a9accf7d31fdb5ab77b4556fef9e754d93fc07dd92e79644e1952b4bedf0b08f82b21a00b9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d84ce3ca1b8daabc7116dc358add5e13
SHA1 c3fb42816e3ba7694f2f122359b72c6d9ba15946
SHA256 c65781072d380288712e827067df96e418efa83178a24f55eef43627cfe77780
SHA512 40cfb1764d9d4db74132614197a39ee558016608ea565f413524f5ab374cae85fcc98c19a10fcd7e5b5102e0b052ab86d84425a190ccc76c658a700eaef7c35e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 5110fce755f8d13b144e8d1b94c78d8e
SHA1 98995aed6c757fd6d30e7ca35a54e9eadd03694d
SHA256 3836dc0762b0defce58eaa5b9aae251e1ac91a77e36ff24a3d476e4f85c58e93
SHA512 9cc45af08402276d0f74fb4a62e27e813449138e3f2437549f4cdce3f694197d8abf02a7ab3d49c29803f47423fd3846dbd3950aa9c2d4bc4b0879977efd4e36

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

MD5 e4a68ac854ac5242460afd72481b2a44
SHA1 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA512 5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 f54f015f23e300b4e3802e011fd6914c
SHA1 cc197f9422c8957e688c3d2cf978eabfcc2c149b
SHA256 e2e2699aaa9dec04fa8668928c17ba0b8059bd7240206e121d067ae8f0c3764e
SHA512 0f8617a1f80cb2be8bc50f673dc567c30d58191325797e23a3e666f7e54e68e7f04ba057a3fcd25df2ea561170144a64baf049c78763b5fe1bd950ce352827b6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3b73ea681cd81ace387b3533d4a01b10
SHA1 f1dcd7e1b58eea1f746a3656485dbf628c4706a2
SHA256 bc377066d803bd3043317747c21324808c70dae12a548676441faaab9b601f9b
SHA512 c3bfebcd9d020b7d63c34d26cdf5f4a8ff9102982cca5f84b3eec9a9b245bef23576bbe570efa5db72c4ced97fef75c9f7af3166a8be93e8dc3848aabd05bf8f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 b3087275ccfbd631c69eb3f4b09ba89b
SHA1 b708904a9989fdc6c721ddb8ba7c74f05319d91f
SHA256 79e84e0107fd6f2d64f2318473c8097fbce81a87aa42c78d6837a9c4ca660f40
SHA512 cba76827dc63158a88e1e0ba4ad3bf3abbe11e2cec79d5ca15b5f73105315aed160064dc77ae2d27ee7cf24776f4edaf017d4681e96f4ab1202bae1c73fa251f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 39b4e80ecef3dcca020eb69e096aaf41
SHA1 db12898ca699e7728f879f575de11cf119f802a1
SHA256 e4054617aeaf8150bbdf2fc2142c972d55d8e725fe340441b8e3409228107d74
SHA512 b14b70443f59750da6314592ae4d4066a84d180a647c86aea87678fb51c8ce0bfae6e22978ebaffe204098f430ceeb957a71b145dfaff0dfbc9f130d8c7e96a3

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 18:34

Reported

2024-06-14 18:37

Platform

win10v2004-20240611-en

Max time kernel

128s

Max time network

139s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ab292f2bdd9dc6f42cfbc8757b848646_JaffaCakes118.html

Signatures

N/A

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ab292f2bdd9dc6f42cfbc8757b848646_JaffaCakes118.html

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=4164,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=4168,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=5300,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5344,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5488,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --field-trial-handle=5316,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=5964,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=7004,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
IE 94.245.104.56:443 api.edgeoffer.microsoft.com tcp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 13.107.6.158:443 business.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 cdn.joy.ac udp
US 8.8.8.8:53 cdn.joy.ac udp
US 8.8.8.8:53 services.joygame.com udp
US 8.8.8.8:53 services.joygame.com udp
GB 142.250.180.2:445 pagead2.googlesyndication.com tcp
TR 185.70.86.121:80 services.joygame.com tcp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
GB 163.171.129.134:80 cdn.joy.ac tcp
GB 163.171.129.134:80 cdn.joy.ac tcp
GB 163.171.129.134:80 cdn.joy.ac tcp
GB 163.171.129.134:80 cdn.joy.ac tcp
GB 163.171.129.134:80 cdn.joy.ac tcp
GB 163.171.129.134:80 cdn.joy.ac tcp
NL 2.18.121.10:443 bzib.nelreports.net tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 23.200.189.225:443 www.microsoft.com tcp
US 8.8.8.8:53 ads.mgmt.somee.com udp
US 8.8.8.8:53 ads.mgmt.somee.com udp
GB 163.171.129.134:80 cdn.joy.ac tcp
US 8.8.8.8:53 cdn.joygame.com udp
US 8.8.8.8:53 cdn.joygame.com udp
US 8.8.8.8:53 platform.twitter.com udp
US 8.8.8.8:53 platform.twitter.com udp
US 8.8.8.8:53 i.hizliresim.com udp
US 8.8.8.8:53 i.hizliresim.com udp
US 198.37.116.50:80 ads.mgmt.somee.com tcp
US 104.21.82.74:443 i.hizliresim.com udp
PL 93.184.220.66:443 platform.twitter.com tcp
GB 138.113.101.21:80 cdn.joygame.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
GB 172.165.69.228:443 nav-edge.smartscreen.microsoft.com tcp
GB 172.165.69.228:443 nav-edge.smartscreen.microsoft.com tcp
GB 172.165.69.228:443 nav-edge.smartscreen.microsoft.com tcp
GB 172.165.69.228:443 nav-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 vb1700.mgmt.somee.com udp
US 8.8.8.8:53 vb1700.mgmt.somee.com udp
TR 185.70.86.121:80 services.joygame.com tcp
US 8.8.8.8:53 56.104.245.94.in-addr.arpa udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 121.86.70.185.in-addr.arpa udp
US 8.8.8.8:53 134.129.171.163.in-addr.arpa udp
US 8.8.8.8:53 10.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 225.189.200.23.in-addr.arpa udp
US 8.8.8.8:53 71.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 74.82.21.104.in-addr.arpa udp
US 8.8.8.8:53 66.220.184.93.in-addr.arpa udp
US 8.8.8.8:53 21.101.113.138.in-addr.arpa udp
US 8.8.8.8:53 50.116.37.198.in-addr.arpa udp
US 8.8.8.8:53 228.69.165.172.in-addr.arpa udp
US 8.8.8.8:53 platform.twitter.com udp
US 8.8.8.8:53 platform.twitter.com udp
US 8.8.8.8:53 platform.twitter.com udp
US 8.8.8.8:53 syndication.twitter.com udp
US 8.8.8.8:53 syndication.twitter.com udp
US 198.37.116.16:80 vb1700.mgmt.somee.com tcp
US 104.244.42.8:443 syndication.twitter.com tcp
US 198.37.116.16:80 vb1700.mgmt.somee.com tcp
GB 142.250.187.226:139 pagead2.googlesyndication.com tcp
US 8.8.8.8:53 telem-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 telem-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 8.42.244.104.in-addr.arpa udp
US 8.8.8.8:53 16.116.37.198.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 platform.twitter.com udp
US 8.8.8.8:53 platform.twitter.com udp
US 8.8.8.8:53 platform.twitter.com udp
PL 93.184.220.66:443 platform.twitter.com tcp
PL 93.184.220.66:443 platform.twitter.com tcp
US 8.8.8.8:53 twitter.com udp
US 8.8.8.8:53 twitter.com udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
NL 23.62.61.97:443 www.bing.com udp
US 8.8.8.8:53 connect.facebook.net udp
GB 163.70.147.23:445 connect.facebook.net tcp
US 8.8.8.8:53 connect.facebook.net udp
GB 163.70.147.23:139 connect.facebook.net tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
GB 216.58.201.104:445 www.googletagmanager.com tcp
GB 216.58.201.104:139 www.googletagmanager.com tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 163.126.19.2.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 35.56.20.217.in-addr.arpa udp

Files

N/A