Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/05/2024, 14:51

General

  • Target

    3aab6d4e46f35b3a08592eb13a773cee_JaffaCakes118.html

  • Size

    131KB

  • MD5

    3aab6d4e46f35b3a08592eb13a773cee

  • SHA1

    79f8c6f8ccafd9d87ea2ecdaba469155d22c7b35

  • SHA256

    597ce36c1e3764f7d43895b926194793138f335ae3389a8372fbdd9cd4d5f18a

  • SHA512

    f9e20e85049690f643049cd5348cb8e01c1558b1212dedc9ef0ee3f2a1030a271d180ef058ef430926013e981c16f0944a5b5a853480ef7e9264be04baa2c2c6

  • SSDEEP

    1536:QHLGfaXCvjHLOpPzaWtkkTnpgly5Z8phApXCf9+NRsOqCYnp6B83QdeUX/oAMkKe:g5aLLOpPTh+WUAq9+NOVp6YSsi

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3aab6d4e46f35b3a08592eb13a773cee_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3228
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd1d746f8,0x7ffbd1d74708,0x7ffbd1d74718
      2⤵
        PID:1816
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10015390533733466429,17573384323827175508,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
        2⤵
          PID:4876
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,10015390533733466429,17573384323827175508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1400
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,10015390533733466429,17573384323827175508,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:8
          2⤵
            PID:4148
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10015390533733466429,17573384323827175508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
            2⤵
              PID:1236
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10015390533733466429,17573384323827175508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
              2⤵
                PID:1136
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10015390533733466429,17573384323827175508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
                2⤵
                  PID:4360
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10015390533733466429,17573384323827175508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
                  2⤵
                    PID:3768
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10015390533733466429,17573384323827175508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
                    2⤵
                      PID:3184
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10015390533733466429,17573384323827175508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1884 /prefetch:8
                      2⤵
                        PID:3968
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,10015390533733466429,17573384323827175508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1884 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2300
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10015390533733466429,17573384323827175508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
                        2⤵
                          PID:2428
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10015390533733466429,17573384323827175508,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
                          2⤵
                            PID:2552
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10015390533733466429,17573384323827175508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
                            2⤵
                              PID:2680
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,10015390533733466429,17573384323827175508,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
                              2⤵
                                PID:2676
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,10015390533733466429,17573384323827175508,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 /prefetch:2
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1160
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:1892
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:1416

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  c9c4c494f8fba32d95ba2125f00586a3

                                  SHA1

                                  8a600205528aef7953144f1cf6f7a5115e3611de

                                  SHA256

                                  a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

                                  SHA512

                                  9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  4dc6fc5e708279a3310fe55d9c44743d

                                  SHA1

                                  a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

                                  SHA256

                                  a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

                                  SHA512

                                  5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  1KB

                                  MD5

                                  413fac30e31e58cdd5580ba930859e25

                                  SHA1

                                  2858d8863ebbbcfedc62b5a3f3fa51b1ec79bb41

                                  SHA256

                                  a7eaf1af8225c48dcc5372aaf31c9a3d31bfd034cf7172c9c4397102711c3d56

                                  SHA512

                                  7609484b54966bda2e5223461aaab9024d976b95efca65f4c5bed09c3329c4fc47303023c2241db415f1c70cf613777922ea0f8bcbeb053bcbbad61ddc8866d0

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  1KB

                                  MD5

                                  8be5cce9fea56659657eec32c1f5066f

                                  SHA1

                                  d38074617aa5b2cd2751e2c426b33c43c86b4350

                                  SHA256

                                  786e0ccb450b0e0828a532f3da62ff8fedb14a5719a2eee4efe73aff6fc21b5c

                                  SHA512

                                  76aa03cf16fa2ec964ce6f646e93cba327d4580003a7abfb0e175cd5ea70f35194ef624aa6aa86f6cd0e5f81ea456e623ac7a7433d86402465cd0c5b5ac72d39

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  5KB

                                  MD5

                                  cc2eaa2850f5527924a34b53cc615aa6

                                  SHA1

                                  bbf4ced35ff404da8addfbb0f7fdb00005e206d2

                                  SHA256

                                  d8a13b712f6c7729abe3c334665e9249dd3f2318eb4997b84b0cde2497af237b

                                  SHA512

                                  9562fc4a24e48e1ba7e13534305d00396420ceb5100171987b8e73694e7a7bd64e4eb9f3d27f91cfcb12711323aaef6cac21c1d8d0c8551d1b38d13aa8a2c6a0

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  b69d294e7f4c71f9199bd319365edd26

                                  SHA1

                                  86af5f9f5d31304208d3cbe710b41cc387c38f95

                                  SHA256

                                  39f0cccfbf9e30195de5fd4a6ef969a1673679faafbd25f49bffeda7b2118938

                                  SHA512

                                  5479a68fbd0dde63c0cea1685af87d82ab448d8ce8e8c2fbe7ae5de66ddb3dd81f94e0d88862fa30d41283633d13a97503b48f397db5c502b05219f37e8a738e

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  704b3009f2c286696ade8a5ef0799a09

                                  SHA1

                                  3e5f22210afab96d5d081426522eeaacb93e91fa

                                  SHA256

                                  f2131b0008fcc707e07b05a926e1cdf68c390808db8cf4aadcf72e46a25fbf03

                                  SHA512

                                  0bd2566682b73ca1e2c1097bda831aa6c523c9edc4c0fe0590d68436d93d31b644800b8a2293fe535bd32080a6212110945cf76e1e32c14aad40eb63f7996dd7

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  bee37f3941831cbc9d1f1c54945643a1

                                  SHA1

                                  ad1132102337ae0a53799b2d9ffb369ff0f90eb2

                                  SHA256

                                  c90152c2a705e9fe61a6aefb3496df4fb6757182ab249bd1b1a18a6378d222fe

                                  SHA512

                                  443895ee2e6beabc94720d9ab216bded0e6a77bd444251e081fbd53138109562a4e4ca132d8fdeb608dda7eaca6f5b0101a8953ac5058abd5de620963dd0565f

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  370B

                                  MD5

                                  5de249d14f63922b8e9b92a15345c98d

                                  SHA1

                                  cac803acc26706c4b67f0fce806945c73ccaa41e

                                  SHA256

                                  310340590ee3a2ee2ec3acf87075dcbf774101747b199582b9f06be41e9f3ef6

                                  SHA512

                                  e20a6654ac0a1eba3fcfc04df0f9180989f553941cbbf9854a7c1bd790d810eda98e3867d42deeb89126cc7d320a1f97d9a261bca3808d9814dc77077cfe9f37

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  537B

                                  MD5

                                  2fa300a8221584be42385b3fa8bd3f37

                                  SHA1

                                  2a11d7790745e008a05599237470d16c08402cd0

                                  SHA256

                                  b15278618e195642ca50402536a97d3eeb9d983632d08a3bb13544c601d6652d

                                  SHA512

                                  db97059536bfc59c0f60e2cf38a67e8fe0410ebda5d0568535532ab17fad0e37188296fef0d4edee9ca4c04cf6c7c6e48f502e9fd16477e63ada1eba32d915ec

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d8eb.TMP

                                  Filesize

                                  203B

                                  MD5

                                  5ff03c5ba846274c6cc75d47ce121482

                                  SHA1

                                  7cea28ed0c54abc7fb8463703f3ba2101f59ae44

                                  SHA256

                                  3cbac2d684e2756c62e3d8a0c6bb39422a7fe9c69f2cc02c44e5350868609c14

                                  SHA512

                                  2bb04699f86838e0da410c19e9f8f3fc314415a7438ed1cd412d595632d6cb86da156a69c978e0fa44ad489d891cdd77148a1ef27dd64b2cdf3100b5eac3d2b8

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  46295cac801e5d4857d09837238a6394

                                  SHA1

                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                  SHA256

                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                  SHA512

                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  206702161f94c5cd39fadd03f4014d98

                                  SHA1

                                  bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                  SHA256

                                  1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                  SHA512

                                  0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  11KB

                                  MD5

                                  6622a82dbc4e1c1602a359249f02e948

                                  SHA1

                                  19dcfa45d0512d4686d56e206aca9a379a29c324

                                  SHA256

                                  43436acc6199ea685108d979dc40f10fb569c535684d5d2e10141aa803be6b85

                                  SHA512

                                  0a474c2ea6c5044d81a9d1ff9644f13213e52a3812e31b7365bcad036eba50da6ab4dc58ef34e704d7bcb81266e85800fbd2ad408abde9ee8557e575895e2240