Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/05/2024, 20:43

General

  • Target

    21a6870621169a9b54297d06093c7437_JaffaCakes118.html

  • Size

    19KB

  • MD5

    21a6870621169a9b54297d06093c7437

  • SHA1

    33598a686dc89124bb50d3357bb0ca0ad8c6f459

  • SHA256

    0efbaa2504ecd144cf8ba5ea3418c286b908d749ad545c6f1749ae23557412aa

  • SHA512

    3ffbe4a4659bf06f8b49b773d1393da3c44f04613394478b0e108bbd377b4dc43401ee4b05def241bedb60b8dabb75eec9c2c7a098dd97796abf952cdb23baad

  • SSDEEP

    192:SIM3t0I5fo9cKivXQWxZxdkVSoAIp49zUnjBhbN82qDB8:SIMd0I5nvHZsvb2xDB8

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\21a6870621169a9b54297d06093c7437_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4616
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed2f246f8,0x7ffed2f24708,0x7ffed2f24718
      2⤵
        PID:1196
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,13750523730752055011,10625215218702145662,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
        2⤵
          PID:1436
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,13750523730752055011,10625215218702145662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2016
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,13750523730752055011,10625215218702145662,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2984 /prefetch:8
          2⤵
            PID:2984
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13750523730752055011,10625215218702145662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
            2⤵
              PID:1476
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13750523730752055011,10625215218702145662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
              2⤵
                PID:4884
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,13750523730752055011,10625215218702145662,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4916 /prefetch:2
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:1156
            • C:\Windows\System32\CompPkgSrv.exe
              C:\Windows\System32\CompPkgSrv.exe -Embedding
              1⤵
                PID:4620
              • C:\Windows\System32\CompPkgSrv.exe
                C:\Windows\System32\CompPkgSrv.exe -Embedding
                1⤵
                  PID:2348

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                  Filesize

                  152B

                  MD5

                  8b2290ca03b4ca5fe52d82550c7e7d69

                  SHA1

                  20583a7851a906444204ce8ba4fa51153e6cd494

                  SHA256

                  f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

                  SHA512

                  704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                  Filesize

                  152B

                  MD5

                  919c29d42fb6034fee2f5de14d573c63

                  SHA1

                  24a2e1042347b3853344157239bde3ed699047a8

                  SHA256

                  17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

                  SHA512

                  bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                  Filesize

                  5KB

                  MD5

                  391466e10e5cde6a4c385a23c3f9efc3

                  SHA1

                  ba58a61cf8bedcdc2fc11c4574e8ead66b6990f4

                  SHA256

                  acb1325d498ff40df941ba79bb38c54ad88b9342eddba49741b53cc33e44945a

                  SHA512

                  8325673296b4997cbf32b4a35f688e266140f9bffb9124a5b0437a4698041afd0703eaff2b8d6a95d79c730531cb84fc81db4808bfee010f67716d7f3e997c34

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                  Filesize

                  6KB

                  MD5

                  928fc9e1ed9231425a858eb26624e9ac

                  SHA1

                  863845e4edc4568a276c514d9e595a13d264b583

                  SHA256

                  882fcd292e3fb190e5292e33b1780c52208f301052da5df78ad1240f9e3ce3b8

                  SHA512

                  1cc4e9265d01aaaa6ad0a8703f17a75c229a2b5b2f480fe35e29bd54474c3d87421954b6ce40a10d1dca07f3c7fcc46a4a6a65549df6ce6660962692c51eac80

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                  Filesize

                  6KB

                  MD5

                  0203a9dc9778fffd5639072e5dc37a87

                  SHA1

                  11d314a9c13f5cb69fcf9145660237c625e43597

                  SHA256

                  fb56dd691fa4b4b04824395aaa9a7b607dada670b9d322a1e0ff18ace44b4354

                  SHA512

                  b078416f99f4cc6d0db6634193a02d9250878b1c7537a4a706424998bc82f12c0184fa56c625393bbaa45ce49190d9aa57b413cb3b0c9399fae659d934ad8b3b

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                  Filesize

                  11KB

                  MD5

                  e773e988eecfe2f27b9ff5062a3a5533

                  SHA1

                  c1a008b49872541195cafb921d7c3118f046cc0f

                  SHA256

                  2f381b7d26a2f5fa3577981895e2ab6fbbc0a8318b507ad0792553c6d2edd949

                  SHA512

                  62283b3d15713cd37e6f5547cd585084d4486cf481011d5cfc9fa808ab234b6ee43dfec6e4edb32ee425a709de1b816218a5e2d3afab79467b9013f67609dc92