Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2024, 19:47

General

  • Target

    30befbf78520426339a755b10b6a40b9_JaffaCakes118.html

  • Size

    43KB

  • MD5

    30befbf78520426339a755b10b6a40b9

  • SHA1

    d44d6f3c074c3c72f48a0b633ea7fbe2452321f9

  • SHA256

    bf79214675c3eae60a58bc04f0046a83e527ecd7850d637ee44e5a6a5dae3c64

  • SHA512

    756003ff32094d34d7a97f76384ee9a41f9e42dc72c4ecbc77d6cf084e87cbc462314c17655a7d442d0c3f77f6afff9df8bc4b1145e8d5bd40f5ff89083577d4

  • SSDEEP

    768:vsqjwUTODd1H87NjN6EMe7tQPgs6gG0E+WHL4Ey54CRPC4O1tSTC29jL:vsqWx187NJge7tQPgs6CE+WrX0434ste

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\30befbf78520426339a755b10b6a40b9_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3440
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd179146f8,0x7ffd17914708,0x7ffd17914718
      2⤵
        PID:4544
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,12564607035660929441,11937781896747678402,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
        2⤵
          PID:4876
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,12564607035660929441,11937781896747678402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1180
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,12564607035660929441,11937781896747678402,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:8
          2⤵
            PID:4288
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,12564607035660929441,11937781896747678402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
            2⤵
              PID:4720
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,12564607035660929441,11937781896747678402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
              2⤵
                PID:3988
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,12564607035660929441,11937781896747678402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
                2⤵
                  PID:1632
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,12564607035660929441,11937781896747678402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
                  2⤵
                    PID:3488
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,12564607035660929441,11937781896747678402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
                    2⤵
                      PID:1848
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,12564607035660929441,11937781896747678402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6568 /prefetch:8
                      2⤵
                        PID:1228
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,12564607035660929441,11937781896747678402,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6568 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:964
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,12564607035660929441,11937781896747678402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
                        2⤵
                          PID:3880
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,12564607035660929441,11937781896747678402,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
                          2⤵
                            PID:4548
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,12564607035660929441,11937781896747678402,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
                            2⤵
                              PID:4456
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,12564607035660929441,11937781896747678402,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
                              2⤵
                                PID:4424
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,12564607035660929441,11937781896747678402,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1476
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:680
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:5072

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  f61fa5143fe872d1d8f1e9f8dc6544f9

                                  SHA1

                                  df44bab94d7388fb38c63085ec4db80cfc5eb009

                                  SHA256

                                  284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

                                  SHA512

                                  971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  87f7abeb82600e1e640b843ad50fe0a1

                                  SHA1

                                  045bbada3f23fc59941bf7d0210fb160cb78ae87

                                  SHA256

                                  b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

                                  SHA512

                                  ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  192B

                                  MD5

                                  c60804e719bd2d984f1dd7cac621cd99

                                  SHA1

                                  025778db9e6bb9afdf5f62ecd5e3f0a842435c72

                                  SHA256

                                  c214f577d8ca3db29b4791146c0aec9f4e4e0117e409e7e81b6e51b73e43199f

                                  SHA512

                                  c56b51493276798fc8a012ce445ae4cc460e9f9d405b0007711146e7a6cb7bab0d17934a1bf74c0712bdce3c83e135cf69746c667434166b267ff6dbba289d9b

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  144B

                                  MD5

                                  ef25212556f782c0436f26c0c0f4421a

                                  SHA1

                                  10bbf94feca21fd61ae78597f2277adaba9ede20

                                  SHA256

                                  6b8c4ab0a9869572bae53641f3354e20dc46f2e4b0ce81c354e777b39949a7e9

                                  SHA512

                                  3f2db420c64f710a17b231b4b5984a4d0c3366460620c552bc6639ce529c79b349c03f64dc52a658eef6a262c8de9118b79a3410b789efb1517d00e760c90e91

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  2KB

                                  MD5

                                  4459bc3395689df5d5bedd38f635a585

                                  SHA1

                                  0361c2f82bc913d342ab96c0ce24971e20454591

                                  SHA256

                                  eb220319cbfca7a40e52391e3bc97c556dc67c9d3cc1cb4c9f96f2a782ca624e

                                  SHA512

                                  bfec8c0dccbdcbd3217d7f92e7a67bcafbf8b4a0ecbbd77dacd203d4bd6d262be40945953942ca5854be91822737e1f4de808e1f7e8d9edaf53922a47ddfefb7

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  7KB

                                  MD5

                                  d8fdcc30e61b83042b73532c61f925d9

                                  SHA1

                                  36939789df81c574a0c74961c05771ce93537931

                                  SHA256

                                  373b3bfb528db1e1e5d72ff5b14e38a549e2d34781c6f019280cbd54dd21e3fb

                                  SHA512

                                  f11d221f967b576cbae3c66f6ebbea4dbd6c3e970524ec891f282f957070d76e8d8767ca33a319458b702e06b6ce036557ebe81f85f96dbbdf1c9c58765f00a7

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  406bb8e4bac5c75e7d0065147799859b

                                  SHA1

                                  2b9f2ce0bab4bec372aebf59035b6ee6f49fd1da

                                  SHA256

                                  dd581ac8d1567931ace713565cebc65972f2839a5b805adce9e2cd4a384c3c54

                                  SHA512

                                  e9681637913560cab8aae1970658c91571fcf74a2c5aea2ee24bfb1d913a218ad95e1da5a0ee75ef826868045eb1605abcccb5fe09ee7edc9c9f462d85d352f7

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  7KB

                                  MD5

                                  856557500aac64e461de78b319c562dc

                                  SHA1

                                  a9b932e1442856261b3046c37c2b4adfe9bb1169

                                  SHA256

                                  ce57c5e757736d65ce90b97fd5fe76c63d316b07b3dc3ad4af9f86d86f003809

                                  SHA512

                                  264dad28a21d1f4fac9068983cea7db4dcf02c861e6e3a7d4ff6bf283700f2b0b51184b4507de23053518197f155de3e3de9e4da6ea8a9b344a7b9b3865c9625

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e1c5.TMP

                                  Filesize

                                  871B

                                  MD5

                                  1880186fccafdbab3f1e7ba05b5db67f

                                  SHA1

                                  52c2b6624bf1d2ffd5298ea62d18a1f53a37a13e

                                  SHA256

                                  7b323d09e1828b51b4a4815fde781775371e1bbffe743cafe52eaf568b3d7c18

                                  SHA512

                                  69cb906574c35324aa0e32ddd2a55e9f8809e9a63a9f4f6ae858e6d15611963869144837537a582ad8d860e101b43d50868b118b8fafaec5040e030158a09cd9

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a2dcb56c-a465-4354-a621-218b3d471991.tmp

                                  Filesize

                                  871B

                                  MD5

                                  3eeb73c54b2e5f1b4f19907728ab13df

                                  SHA1

                                  d3fedc7c8d27c51085cabbba477757cabf5ab61c

                                  SHA256

                                  e5e018487c84cf0c2af1180024a79372504add795e0392e7712776888ae7015b

                                  SHA512

                                  3fb792d6bee45326fa53434c64da70e8f440ea28daf3b884222b492d7f5e68ca3de2182dc0cf8571e816a271bc570e69a50c53df46a8fd29a8d28da19dfea60a

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  6752a1d65b201c13b62ea44016eb221f

                                  SHA1

                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                  SHA256

                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                  SHA512

                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  11KB

                                  MD5

                                  bb9950a7243f43811407625ee5a165aa

                                  SHA1

                                  1718c1b4dc4661af045c691c33a54681a10d827b

                                  SHA256

                                  14c8e7cf1608e4960aa1deb260d6455d34b20b0bcca95346a01e28844e569dd5

                                  SHA512

                                  0283cec10cc403cd7c32a3c27a430a3687e3a0841f3206105abf86029404230cad97c643737ee538d5679c305b09bea8f5fa10a7e983290a5f8ae16915e23b60