Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/05/2024, 16:20

General

  • Target

    405922a3240b4b21ef1891ad2ec482a8_JaffaCakes118.html

  • Size

    152KB

  • MD5

    405922a3240b4b21ef1891ad2ec482a8

  • SHA1

    1336d89c12bf1a92944ae90d49520b239aa4b344

  • SHA256

    bd9fa1872fbbe0593f7bba83948598cb80269bd96021068b32ced619a8683530

  • SHA512

    23770db9d607b2a32e0db2951da0b35729013d06e706465c6931b0d2fa52f65b552e56f237c7d2e146224c9c59349b7055135e56196bc03ece8aa63228b2027f

  • SSDEEP

    3072:vTD5l9y5WaWZbPker/Sn8NuslcCEynt6l3QwqkIBZjIF9W5SVqhmYcs8O7Y1J0SN:vTD5l9y5WaWZ0n8NjlcCEynt6l3QwqkJ

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\405922a3240b4b21ef1891ad2ec482a8_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4460
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb2aa46f8,0x7ffbb2aa4708,0x7ffbb2aa4718
      2⤵
        PID:3680
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,8129306734185555706,15018404736645813318,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
        2⤵
          PID:2240
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,8129306734185555706,15018404736645813318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2980
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,8129306734185555706,15018404736645813318,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
          2⤵
            PID:3404
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8129306734185555706,15018404736645813318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
            2⤵
              PID:4784
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8129306734185555706,15018404736645813318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
              2⤵
                PID:768
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8129306734185555706,15018404736645813318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
                2⤵
                  PID:3944
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,8129306734185555706,15018404736645813318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
                  2⤵
                    PID:1644
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,8129306734185555706,15018404736645813318,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5048
                • C:\Windows\System32\CompPkgSrv.exe
                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                  1⤵
                    PID:4192
                  • C:\Windows\System32\CompPkgSrv.exe
                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                    1⤵
                      PID:2168
                    • C:\Windows\System32\CompPkgSrv.exe
                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                      1⤵
                        PID:2304

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                        Filesize

                        152B

                        MD5

                        56641592f6e69f5f5fb06f2319384490

                        SHA1

                        6a86be42e2c6d26b7830ad9f4e2627995fd91069

                        SHA256

                        02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

                        SHA512

                        c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                        Filesize

                        152B

                        MD5

                        612a6c4247ef652299b376221c984213

                        SHA1

                        d306f3b16bde39708aa862aee372345feb559750

                        SHA256

                        9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

                        SHA512

                        34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        216B

                        MD5

                        063b3a75036ef6629887861f34a9ad67

                        SHA1

                        3592cad35e228681d97c251e28cb4502dd4a95a8

                        SHA256

                        feae88140e58938e597437990bdc14a9fc504c41726af0416e53e0777c743b62

                        SHA512

                        3683eff124ffb723fe30da7719ea34c3fef690eac77f410975918181857963e85e72ef41d825aaea227a8bd092479841ac5cb11720c4795d4d8528967fa21eb9

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                        Filesize

                        4KB

                        MD5

                        665d06d4b96060a40f7549b35deecc0e

                        SHA1

                        98160f9c406fd1bf3f3b5ca921372ff3288daa97

                        SHA256

                        a224f092d3e75296bfe1de816afdccd4378bdaf30bb57bcd35f6479fc552b1de

                        SHA512

                        b13c3680b91e660cfd50859cde435a5e8bb5f8a3ef01683ede35a4d44b3984609cb5c605809820cb1b6e2a75249c743c033388d558a65dd6b05e07990e9096c4

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                        Filesize

                        4KB

                        MD5

                        44089507a828ccd1fda2e28454adb6e3

                        SHA1

                        02ae837f9b2a1f397534b46284a8073ac4e9fe77

                        SHA256

                        78482640682087f6600577a79912458e385346352d654ed52655740c35950ffb

                        SHA512

                        f555b8b064e91218b80e0c9233d046411ee3f1041aca5dca781b5b1137123700473d55547b0a6f7585abc85d72fb84d4d265c0925fb5b35809b25bc139bb2569

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        afa5b722342e9cd3e296d04c5f4d3fd5

                        SHA1

                        86cf9d708a63f57b55aacd3d6013a6b5fbed5b0b

                        SHA256

                        52e9db5dcccc05fe46f8c033adca5a90397b85725583ef03e9f56f97dc80d64f

                        SHA512

                        13dca4b9059dfba9b6e936365c0a041abf2a63d9e237d125896cb01b83efda2d276f3768c66c4234b1d8511595e22e4b39e4e140089f6e826fa1970bdd48ae6c

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                        Filesize

                        7KB

                        MD5

                        39a0113cdad8dcd3adfb4ec09c60cfdf

                        SHA1

                        bf650cb7c8e3093dbea100e0127199974db03186

                        SHA256

                        6ac9b58591af585dba4aff7efad6070cfbc894aa7ac34df714dc74ef9373429c

                        SHA512

                        2040de928e36abccdb51f273355b119439126082e0980eb0999f742a815d771c39527dfb4b07376b64a8f1846ed8f1c5d10edb0fede46f31056a1f482c3eb341

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                        Filesize

                        11KB

                        MD5

                        ec2cb93fdf7d95168a12e7c2e259e51a

                        SHA1

                        a20b01bdfd8607336b4b307e36d7db3e0b599f1d

                        SHA256

                        b4ca06eee2e9e5e1bbb6a5ee7b7c7c8387ce2842120550b767d5dd19a6d4169a

                        SHA512

                        f6502c611b2b511b22ca3d38fe688c68ad93368731d0a2ac665dd0fd9008354eda710b0cd9b34908a9b3b7570739ae5b9473db78027cf8d253ed6cd5be368f09