Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/05/2024, 21:35

General

  • Target

    21d1455e2e9c27647e4f60eade42ee38_JaffaCakes118.html

  • Size

    193KB

  • MD5

    21d1455e2e9c27647e4f60eade42ee38

  • SHA1

    8aa528dce4c251ba23f5493510749de045755b70

  • SHA256

    ccbaaef7228f97de21bab96a741e0944f30b7b124d83c71f60060d63aebac1f7

  • SHA512

    de97767bd5b55be7185b958ae066a272cfe18b2891d7727c5cfd3908d297f55e29f37b1a121abcf225784056297b43237dfb2940bbb79917a7244736e6ee8f21

  • SSDEEP

    6144:hPll8iGtMSkZxB64GtMSkZxB6AGtMSkZxB6XZFk:XlDzSuP64zSuP6AzSuP6s

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\21d1455e2e9c27647e4f60eade42ee38_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3464
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffabfa46f8,0x7fffabfa4708,0x7fffabfa4718
      2⤵
        PID:2492
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,16681302824625685475,14855668956384741022,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
        2⤵
          PID:1536
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,16681302824625685475,14855668956384741022,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:5024
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,16681302824625685475,14855668956384741022,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
          2⤵
            PID:3812
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,16681302824625685475,14855668956384741022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
            2⤵
              PID:5240
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,16681302824625685475,14855668956384741022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
              2⤵
                PID:4428
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,16681302824625685475,14855668956384741022,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1
                2⤵
                  PID:2356
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,16681302824625685475,14855668956384741022,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5144 /prefetch:2
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4520
              • C:\Windows\System32\CompPkgSrv.exe
                C:\Windows\System32\CompPkgSrv.exe -Embedding
                1⤵
                  PID:2200
                • C:\Windows\System32\CompPkgSrv.exe
                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                  1⤵
                    PID:3960

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                    Filesize

                    152B

                    MD5

                    8b2290ca03b4ca5fe52d82550c7e7d69

                    SHA1

                    20583a7851a906444204ce8ba4fa51153e6cd494

                    SHA256

                    f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

                    SHA512

                    704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                    Filesize

                    152B

                    MD5

                    919c29d42fb6034fee2f5de14d573c63

                    SHA1

                    24a2e1042347b3853344157239bde3ed699047a8

                    SHA256

                    17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

                    SHA512

                    bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                    Filesize

                    1KB

                    MD5

                    725808e930ebbb1cd379b40e01a34177

                    SHA1

                    edf387e90e9d5edd0d6a2a5f625a31878124280c

                    SHA256

                    25b996b91726d86c92f86f07a158915fa12a68f70f941d5e58a19ddfce603c90

                    SHA512

                    add40afc5ab6a3d21d6b6e8f3a9d0526c71fd793b5337268fd3066cbef4abdccfeac4d695f57db593d12914f4a3607294c844767cc4131acf0666e3cea709ac4

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                    Filesize

                    7KB

                    MD5

                    fc138669215cbbd4b84a19d80ea2015f

                    SHA1

                    b8f425ae4431dfbc2f48462ad3462b34f79d3d14

                    SHA256

                    3f61b7e33c1891c16bbb90643f418a51427ab1b3114b064d70b34f3d015c8e90

                    SHA512

                    5ab0296461878e3114fb0b55551b05573256be592aae05c24783558c2badeba2445961c237414d97593a4a703d99c98f5498b79c7b411b2149a4fc61ba02fadb

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                    Filesize

                    5KB

                    MD5

                    846c65a38291129de7d72b7221ad6fc8

                    SHA1

                    e4813c3f161c98f7be48677f16a02066395b89c4

                    SHA256

                    c84268b4a0b37f441a8b295549683253a6105f5e5038a5d91e978b18f9178eaf

                    SHA512

                    9ff4f52060f36ddc4532081187bda9de41a022554befa4d96518b326a80825526cc8097709b286f0f94aa3d13322a0a055423162d1cdc7d2df4fb8c3253c7b81

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                    Filesize

                    11KB

                    MD5

                    3c2d8f40fe9b7932a6b930bd8ed08cd4

                    SHA1

                    74222b62e969ad3660dabc378f50f85e3d39cc61

                    SHA256

                    64d55f953a674db922fe0913b52cd6f871757faf3382d4a8db8d38483784fdf5

                    SHA512

                    4c6bf8efaf7620ac4bfa37f258933e93ea69cac3e791bcf650d173e3abea7b2ae615b725472cdde6118f54d05587024f9cc902a72b34c678a95be1eaa57b1a88