Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/05/2024, 02:51

General

  • Target

    22e1b97c8b76349cbc7b6f136e849278_JaffaCakes118.html

  • Size

    163KB

  • MD5

    22e1b97c8b76349cbc7b6f136e849278

  • SHA1

    658572cf53dd80d67033775285cc125591622a0f

  • SHA256

    0d9c79c82db04d885b3daec9e2f4e724d4716f961ebe1cf366e8203ca6746903

  • SHA512

    0f6b618df7ff59c4bc7f34fcfce4f72afacd0d6cd495841af49571f2c0fa57b1f2b745f2ffe99acb4e31e7f5636348034c068db914d542aae49ef3a895204c5a

  • SSDEEP

    3072:LBUwNoQz/nDUrC87otYvO4ebkLZRIrS7wY7h4ij8mYW9mLnuys+tMlb+xmUqNbr7:jI6kh

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\22e1b97c8b76349cbc7b6f136e849278_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1168
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ff871a346f8,0x7ff871a34708,0x7ff871a34718
      2⤵
        PID:4792
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8690154960027135100,3434784529490277750,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2296 /prefetch:2
        2⤵
          PID:836
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,8690154960027135100,3434784529490277750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4644
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,8690154960027135100,3434784529490277750,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
          2⤵
            PID:2712
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8690154960027135100,3434784529490277750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
            2⤵
              PID:664
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8690154960027135100,3434784529490277750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
              2⤵
                PID:2936
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8690154960027135100,3434784529490277750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
                2⤵
                  PID:1504
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8690154960027135100,3434784529490277750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
                  2⤵
                    PID:3316
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8690154960027135100,3434784529490277750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
                    2⤵
                      PID:1792
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8690154960027135100,3434784529490277750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
                      2⤵
                        PID:3864
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8690154960027135100,3434784529490277750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
                        2⤵
                          PID:396
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8690154960027135100,3434784529490277750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5980 /prefetch:8
                          2⤵
                            PID:4632
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,8690154960027135100,3434784529490277750,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5980 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3860
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8690154960027135100,3434784529490277750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
                            2⤵
                              PID:100
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8690154960027135100,3434784529490277750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
                              2⤵
                                PID:2328
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8690154960027135100,3434784529490277750,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
                                2⤵
                                  PID:2908
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,8690154960027135100,3434784529490277750,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
                                  2⤵
                                    PID:852
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,8690154960027135100,3434784529490277750,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4660 /prefetch:2
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4528
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:3848
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:4412

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      537815e7cc5c694912ac0308147852e4

                                      SHA1

                                      2ccdd9d9dc637db5462fe8119c0df261146c363c

                                      SHA256

                                      b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

                                      SHA512

                                      63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      8b167567021ccb1a9fdf073fa9112ef0

                                      SHA1

                                      3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

                                      SHA256

                                      26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

                                      SHA512

                                      726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      96B

                                      MD5

                                      4e99a28224e0622845981c40816d47d3

                                      SHA1

                                      3d148c26acffd7039c807bdae185e2cfc754a44e

                                      SHA256

                                      5466bee5b573c7bdbeec063ae31257345c57d393073f9972d2415051975bee84

                                      SHA512

                                      70c09490df8a52fc78e43af96de633f32ba1e1747e134f3f66566b7be3deb730f500169213c49b72fbb68ce0803b6fbc69e008a9932efab070db449f9e2d1eeb

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      1KB

                                      MD5

                                      ca9ff122d84c71ef9896dfd9d253cff6

                                      SHA1

                                      18e8b64f4c9b86e05f6399de68493a7850982ffb

                                      SHA256

                                      794b12c0b8abfaba62e728f56e03fffc77e6545c961010b4b8766be780d78081

                                      SHA512

                                      832ae21688f67132ed8cf8c1629f4cae23c930761c377e24caa72b222336f78333ae57c06a954d716057c98dd25dd3cdf027fa9edaed98366acdfc7690d207c6

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      ae5e97c8b47d3dc3b23577b140293ad1

                                      SHA1

                                      ec2464bf5c24d2c0dbd98016799dc969f14d3d16

                                      SHA256

                                      9c7c363fa5b5a78b74df61a46b71a269b763254cd99b6377b16f63b20c673ad7

                                      SHA512

                                      ab3000db574f2c09ede8525269b8880b0bc7de9f6eee3bf429bb3f1424ad72a3515a72066382ab14c84822b56341784229e3ebe5709a97838c8f9fe73f331c2a

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      54b7b53bb44d9b8b4385e4b04003af4a

                                      SHA1

                                      69dab1d2886b036d6fc48468e8ec73475f33422b

                                      SHA256

                                      4f234c2df225f1ccf518bed212ace8dc87162236dfe2e516634c6a4bd19da745

                                      SHA512

                                      1e86650f68662f81a14051d7a3ee951c01ddecaae5f5fa3e35f94f350dcb3736204f52032b5af63144101ea125d1973f3594a6cdeb4ef8d8065e16aaf6c8fe8c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      d37297426590d8fd90a5d68781b40ac6

                                      SHA1

                                      fca4da87217a0661de267a7e4e395025faa57111

                                      SHA256

                                      efa93712adf807e16333f5ead67b22232fb2d37d7eb2889150e9a1657767bce3

                                      SHA512

                                      3e5a57de979107b1edee06f4f558e7ab16ca5e0d65c6f4aade248ca591126ddc6fccdf2bd0e30847d10505b4a5ff027a741b5cd119e25358e1ffb890245f887c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      528f494ea681ae5a7cefad827ea1ca19

                                      SHA1

                                      f49ecc3407059227b202696d10376956d526c13e

                                      SHA256

                                      8492c0b01d468085d83c526546407682eb7613392dd4ae261ef05ea56a2bbde2

                                      SHA512

                                      cf00c600392b3106f20a2bfc02ee862bcc86814b85d3ba9918da1506729b1541e41da8d3000eb0f7f13fe77eaa84ad859f3c0cf537efcfdf198335029266ffeb

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      371B

                                      MD5

                                      21940abf42ce89e10c7128e2ccb55f57

                                      SHA1

                                      3ea75e89a180c6e2b649bb382b356c7c132098e4

                                      SHA256

                                      b784a0848a6c546813871854757ce379c5179b234cb4d2ffe8449a8f2d6cb42d

                                      SHA512

                                      95c6554777e824afd8b8958de62531b52421eafed37541ee239836e4c511a8a2c25a9c4e11fcc17f608aef2ab8f614a983e6807d59dd668bb49e0b348640f6cd

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bf0a.TMP

                                      Filesize

                                      203B

                                      MD5

                                      f8224cf957783be19afe8668770494f6

                                      SHA1

                                      b86973e7bb0dd2114f8d21db0cd536ca95323da2

                                      SHA256

                                      738fe4613f0025fcd101e2afe98f0c3453b6d58502dccb9f02be763c44c9c981

                                      SHA512

                                      1be137d55e2b956ccc4d6a054da171e3363c092ef8444666969126b3c44786fa6412303e5892f7e102c9bd8dc52cd23f36d0dce05f21f4dcbdedac8d75ce1d8b

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      6752a1d65b201c13b62ea44016eb221f

                                      SHA1

                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                      SHA256

                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                      SHA512

                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      6a0a822f76ac98064dd2f159454b5759

                                      SHA1

                                      2ef09b5e6d0b0d4421b3790da081731152d30435

                                      SHA256

                                      319d916e8adbafffa74f45b86a6e015859137baa041b0615cdd202a245a0fe37

                                      SHA512

                                      31dc2ac4c8f38099d9fb15a61b36b298194c20bed414827bc827694cbc9bc63ed06ab4885e6d6e5ce5c90d57ab682fa8e7d3c9d26559e020730e844bbab11b52