Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/05/2024, 18:22

General

  • Target

    4279f295e3170f2597f0699a022a1d73_JaffaCakes118.html

  • Size

    25KB

  • MD5

    4279f295e3170f2597f0699a022a1d73

  • SHA1

    dfff0c987bce517a15c1929da714a5ce481b0690

  • SHA256

    d1e287011bd1bbaf208743c3df37e443e5e340947117808a20c988eb8b41a8f5

  • SHA512

    d28d3924fe949c35b48996fc40ef09a0807f7e2b16f08836fe809f39dbe1b3012c5a8d7c9467c48e336aa7fc43d05899ee19e89e5f77b5e728ddb045d0f5defb

  • SSDEEP

    384:cpqKDAovPn4CrdD/s0AnTgunZ8HIHyaH1BKrCeok/9z:8trVk9Tg8Z2kBFxklz

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4279f295e3170f2597f0699a022a1d73_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:652
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c15146f8,0x7ff8c1514708,0x7ff8c1514718
      2⤵
        PID:2336
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
        2⤵
          PID:3776
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4968
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
          2⤵
            PID:3084
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
            2⤵
              PID:4588
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
              2⤵
                PID:3392
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
                2⤵
                  PID:5004
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
                  2⤵
                    PID:624
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
                    2⤵
                      PID:4692
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6432 /prefetch:8
                      2⤵
                        PID:5040
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6432 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1900
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
                        2⤵
                          PID:1992
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
                          2⤵
                            PID:3124
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
                            2⤵
                              PID:4712
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
                              2⤵
                                PID:4384
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1784,11089620505971944253,1291122264543501536,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1068
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:976
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:4636

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  ce4c898f8fc7601e2fbc252fdadb5115

                                  SHA1

                                  01bf06badc5da353e539c7c07527d30dccc55a91

                                  SHA256

                                  bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

                                  SHA512

                                  80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  4158365912175436289496136e7912c2

                                  SHA1

                                  813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

                                  SHA256

                                  354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

                                  SHA512

                                  74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  120B

                                  MD5

                                  8d4ab40ab68181b85d31cf3ee41fad94

                                  SHA1

                                  29e9f5c7ef0e5e3a30645b03456fd268e90fcc74

                                  SHA256

                                  f906ebd2128d6f18a89065e22f4ad9bc9ffc398d421507e5b3956b15d0c1fcfc

                                  SHA512

                                  07df67ac9e96d4963ca5d00bd6fbb66f951c25b7588a12d6f9dead8b0bdd21be3f7f33b97c1ee4239187a7c1f288004bc37c67e1f16b4e8c244f6973415cf332

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  144B

                                  MD5

                                  7424fe79b0c46fc4a9eba49c680e2c32

                                  SHA1

                                  796a7d2fd060e208b60f3285494adfbd25015b26

                                  SHA256

                                  65f264f6c5a51ee25ff19f27ab43d2ff650daa7fffeb50cf2d836aa2ab27bf33

                                  SHA512

                                  c95bb250ceecea804974ea793a0ed78d672bb803ff373c0b4857844a83195e8b1573149226d5d75a95285b516afc8ffa4b2c1367da76e78ee7405fe8cf05fa8e

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  7KB

                                  MD5

                                  94edd4cb1ed8bd71ea914edc1bc52b2f

                                  SHA1

                                  4d60b7d3857ed66507871efac02b6b65f30eada5

                                  SHA256

                                  99fab8fa33ebb937889316cf984d55f8341a2786df13c1c24648ded94f9c8103

                                  SHA512

                                  8e0e28cdcc1737ec2b2504a6ba72b4c8180a1afd4b4d249e33c96b31d2706002f9679ac439c1cb428c4508f485af8b2352877ef4f8ab206a2d094fdbcf564550

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  094de655b46c5bf33506252f1f9519ed

                                  SHA1

                                  9ed494b8a4787266268ec6395e7e66b5788cafc2

                                  SHA256

                                  a0b62b379bbe3fe7ca1f62103c482a0bdf1f46e9771ecb1470dc5535e71b75e7

                                  SHA512

                                  fad8c4385f1c7e21e5a151091ec3f7c7170483e577cd4b3b808769527363d187438ac8f2b4b5a64622c7bc371aa24810d20d1dd9bb7c437536b13146ce77d260

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  7KB

                                  MD5

                                  57f4d403fa2b52041059ced5f6d508e8

                                  SHA1

                                  96e3fd215bd3ec1e2f81f5f0e605b0cd49d2fc36

                                  SHA256

                                  2233ef7d5eecacd14112027d3c0d70c14bbfdfde6e7f01f6a8e4277289dee742

                                  SHA512

                                  ee4a6d2ed61e0737d85ee12362a21f875eb46709e2e6b0e148035cda4b4aeb641a72043c00ce5533e939b425124150597d773fe62e10801265c748f79342e1d8

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  04b67a90f4646ab90d6def852da1c48f

                                  SHA1

                                  8c826d0df59734cba1de2efdabbbab78f3fbaad3

                                  SHA256

                                  78c78d14fc89ee909334b135c731a9763324d701a466fdede80bb33123ed072e

                                  SHA512

                                  676eaf90fe582494e1a86bb7a21bff6e21e5dd473479a2d4fb223eeb44d709104d70bbcc57035315dae83b96c954ee1208271c6f7b835d55db2398ce387fe5a8

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b035.TMP

                                  Filesize

                                  1KB

                                  MD5

                                  16e12bae119e961dd29993779894c0df

                                  SHA1

                                  5171afec3aa53fa881e7b67892b189a5cc070461

                                  SHA256

                                  4e7b5aa298747fc4a24bafce1e564bdb70b8559f4b73370987aa3d05e87ad28d

                                  SHA512

                                  cb13b64a99daa7f852329e000fbc84f399315d372d58b33b0640941ce8affda64a042fe1efd701d95d6f3b60fce3ffc4094825a96df99be3e5d9ef43d8bef5e9

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b872ca55-16a7-48cd-a196-e4565e87d16d.tmp

                                  Filesize

                                  2KB

                                  MD5

                                  6a041946fc7cefa1421a299e4ca51f53

                                  SHA1

                                  c4a327a4fa4d333e1178cd7c289385c8309a1de9

                                  SHA256

                                  984e7c812c061d3f9cb4a72c2f2ad8729fe3d38346c31d75f6e361201b351890

                                  SHA512

                                  22a80c394c4f22e8496d45eaed3218cdad7ac45b05fb21bd31f8c7dd4542df1945c122a87dfc3c3c5c157dd8fbe3ebb197ab175be3a1a7fa7db60e30e9130059

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  206702161f94c5cd39fadd03f4014d98

                                  SHA1

                                  bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                  SHA256

                                  1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                  SHA512

                                  0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  46295cac801e5d4857d09837238a6394

                                  SHA1

                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                  SHA256

                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                  SHA512

                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  11KB

                                  MD5

                                  0c14239cedc250752032b0610705b434

                                  SHA1

                                  2537996d8727ba6bb990467962b2801a8720f525

                                  SHA256

                                  9751bce94cf7d8a2ae1ac57ede44c2aadb731789f84b876c6ab61201392d6412

                                  SHA512

                                  fb0fd8d7f891302155c334067800203f20de7c8cc2e442189957e052202b35bca3a691ec084d51f2430db05f052deefc9a3fbda8773c47677aa26755df652a21