Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2024, 16:48

General

  • Target

    139ea04f3d956ae15613b5e8a8cb2e17_JaffaCakes118.html

  • Size

    18KB

  • MD5

    139ea04f3d956ae15613b5e8a8cb2e17

  • SHA1

    3af666f32c9fc9e35890f032f0338c5d8d23e12c

  • SHA256

    03caaad1b0d0d037c49a4bb6aa76ec38114067b580ff1c0193e9a6bf09238cc2

  • SHA512

    9b249114727bf76b86dc23a076873235080c3e77c2a3d38d2c52ae40f25a9149a8fb490d27a28b8d334445646271baf7f464ba27591fe1ff497591858c323251

  • SSDEEP

    384:a3lLk7fHBp8qUYgIwCbrZuoJUZe0aE+k+gRKVI3gSlODG1TD2fTEfuZj5IjGtUs4:a1Q7h+XZxQNbiUn/fASuT06JqLEf4lIL

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\139ea04f3d956ae15613b5e8a8cb2e17_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc468746f8,0x7ffc46874708,0x7ffc46874718
      2⤵
        PID:1320
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,12144001498887985032,8711732131671757469,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
        2⤵
          PID:5032
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,12144001498887985032,8711732131671757469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1836
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,12144001498887985032,8711732131671757469,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
          2⤵
            PID:1952
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12144001498887985032,8711732131671757469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
            2⤵
              PID:3656
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12144001498887985032,8711732131671757469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
              2⤵
                PID:448
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12144001498887985032,8711732131671757469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
                2⤵
                  PID:1816
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,12144001498887985032,8711732131671757469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
                  2⤵
                    PID:2196
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,12144001498887985032,8711732131671757469,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1532
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12144001498887985032,8711732131671757469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2200 /prefetch:1
                    2⤵
                      PID:4552
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12144001498887985032,8711732131671757469,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
                      2⤵
                        PID:4976
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12144001498887985032,8711732131671757469,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
                        2⤵
                          PID:4580
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,12144001498887985032,8711732131671757469,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
                          2⤵
                            PID:408
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,12144001498887985032,8711732131671757469,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5024 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:628
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:3792
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:1644

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              537815e7cc5c694912ac0308147852e4

                              SHA1

                              2ccdd9d9dc637db5462fe8119c0df261146c363c

                              SHA256

                              b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

                              SHA512

                              63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              8b167567021ccb1a9fdf073fa9112ef0

                              SHA1

                              3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

                              SHA256

                              26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

                              SHA512

                              726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\58951a51-ba96-4a33-ac28-a9700e5c9daf.tmp

                              Filesize

                              6KB

                              MD5

                              b18ee94918e7f2b30a023648a088225d

                              SHA1

                              a2bb4b06b22c72c8033cf554c3065913f769eda3

                              SHA256

                              36428c9b841ba11a087ab14ac0f7be99fce7a124b1fee7b012a1b2775245cc9e

                              SHA512

                              5c61474d785fb9e7859ae0784c85a3e2b1ace9cd2f7dad8de1f3c3916343a6ae8aa7dc98b379fad37956e96abbef176afa83f79b5aee2c9c7f2100ed243de283

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

                              Filesize

                              22KB

                              MD5

                              5e74c6d871232d6fe5d88711ece1408b

                              SHA1

                              1a5d3ac31e833df4c091f14c94a2ecd1c6294875

                              SHA256

                              bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

                              SHA512

                              9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              144B

                              MD5

                              6bd2539027e388177208fbe99617722a

                              SHA1

                              3691b5bc96630dd284b709c1382b145e869ab16e

                              SHA256

                              19a955b44b6f6711b5486829f2249723e332db823b57a117c532e015aa7ee2a1

                              SHA512

                              7f47a9753e9fa7a2233afbbfb52bc644cdf0edca869e48ddcd838ce3fa26c95a53dd3cbe169932ba7ffdea8ef42235549ff0cb0e5b5abb6fba509bfb5bc100cc

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              120B

                              MD5

                              e8be192bc1b269210c9fd10b1c411e4b

                              SHA1

                              402c2d0b67013affabac08d660aae95125a72262

                              SHA256

                              76c818943c4ef8f0c5e1651beb9242e874f233b8735c46994b24e8089b2331b5

                              SHA512

                              b127c180b9e7653caa1aa979516fe1fd38bba140cf6d27e5394f40c2dded4802c2abc27405188c5de19812b5c0b776f53421136af63b40465ab140f64e1dfb13

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              8a5731763791c7fbbc6c2ca5b5ddbfab

                              SHA1

                              a13055081c1381cc7c97492755d570f611d29ec7

                              SHA256

                              4baf56a122bfb1eb3f42774c155358b4944d80b0669c1be149365c64b39f2e4c

                              SHA512

                              628f0de59f4b75ce7d9c27f03724849d9a855936a05bd4b70192684da8134ddc052301ddfd5164bb634d3b5e61ed956bca9069ea9b38315ceb87f8c69759e32a

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              4895dc5111b9dcd62e93489ea0537cdf

                              SHA1

                              d19a11a1919d69751fe08d66366c174980804c70

                              SHA256

                              5ea06f2fd78b281acd713966d1f9472c1aabb8021d05f6b1baa12443699dc47a

                              SHA512

                              c5ef5f9f4c1e49099ca85986b76d92866706a09cb6a5bdd64d14a4721aebdb7e2dc9b95ab9aadfbd5b492882294c47582317da5bb5b39eccf504f2371ce15638

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              b830b4430bcb82e2e1efa5b07d3dffd2

                              SHA1

                              6fc87edd51478f895a5574b7f1e52d1c9906f667

                              SHA256

                              e8d92ad1e78e3454ae73856edebcb8899540d21293d76430002aea09aff0e818

                              SHA512

                              30b2805db68841fb980d7535663dc38c7694bb8b1e593d93cfd6be21a8d8e3759888c0138bd2f8bae73ad48130690726708fbf1f7e5691c851b605fd676b10c2

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              11KB

                              MD5

                              cae9fe7f1031bfb7cdd44267514a6242

                              SHA1

                              ee287fde65aefc0e6b5087e35a0fb52c8852703d

                              SHA256

                              6016bfef85ce14c003264e4838afe8437609d53203725e954bba66123d0ffab9

                              SHA512

                              bf097df81199e05212b5512594d25b5b129f5820d2bc2c1fb6e0cde0b227a32390e7eda34cb5201bb9b1dbfea91c2dda02edb0ec1334bccc066550a1a3e5fea6