Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/05/2024, 15:43

General

  • Target

    6f04c76848259f38d14a48dd78143857_JaffaCakes118.html

  • Size

    27KB

  • MD5

    6f04c76848259f38d14a48dd78143857

  • SHA1

    ad6d646e10a0a881a82f67419cab9c3eecbeb190

  • SHA256

    67efe1d775ce3ce444bd66eeb21f95d843c8a35c7f631ae6ad890b08ef2cd5e5

  • SHA512

    652e58a337926f5e3f44f78aaab45faf75b31c4dd6a2963e7928a4a8919277b1d85277f4f46f6816556ee6e11a5213eb26a2361d14d899a75dc56a5b1e52d104

  • SSDEEP

    768:r/164gVSpr0sB+3/Asupgp+w6EEx/kz7rA90rcmYj4h+w:r/165SpnB+3GgHEx/kz7rA90rcmYj4hT

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6f04c76848259f38d14a48dd78143857_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5796
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa127d46f8,0x7ffa127d4708,0x7ffa127d4718
      2⤵
        PID:6084
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
        2⤵
          PID:3528
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4628
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:8
          2⤵
            PID:5788
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
            2⤵
              PID:1620
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
              2⤵
                PID:5432
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2252 /prefetch:1
                2⤵
                  PID:3632
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
                  2⤵
                    PID:3092
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
                    2⤵
                      PID:4544
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3084
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
                      2⤵
                        PID:4352
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
                        2⤵
                          PID:948
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
                          2⤵
                            PID:4388
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2640 /prefetch:1
                            2⤵
                              PID:3080
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,2369613876320185167,15386732173919383817,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4792 /prefetch:2
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5664
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:5212
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:1232

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                a8e767fd33edd97d306efb6905f93252

                                SHA1

                                a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

                                SHA256

                                c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

                                SHA512

                                07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                439b5e04ca18c7fb02cf406e6eb24167

                                SHA1

                                e0c5bb6216903934726e3570b7d63295b9d28987

                                SHA256

                                247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

                                SHA512

                                d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                Filesize

                                168B

                                MD5

                                472f3d5272e578332a10e78c978181c9

                                SHA1

                                815a07e68bfa186cba13765eee04d8971faabd2c

                                SHA256

                                7df36b7ec6e9bbeeb9cd78e25e5cee2342cb5932c0b49c8a3b43a76a29733cc1

                                SHA512

                                f863e01a9852513dc735c8f80d0904f864d3a1a4ff79bf0f764abe9efd327301270a4bf637f19627109e4e0dae586a2c211b6476e48b7117e577ca5a318392e4

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                Filesize

                                338B

                                MD5

                                db12fea3fea42b700f86340887feeecb

                                SHA1

                                62a01ba2e34809b43accf4f69c6baa71e44c05b6

                                SHA256

                                47f8a9e5483a71a21c635a36943dd29a4d1e28b618ec38e7c550ffab3048bc5e

                                SHA512

                                0a06b50bb744fd4bacca01e1185a2274b85e356c0111000b580d44e469f045ed6836b9ae5c208b3e4b02bd0a4ab090eaf2abeb497aecf4f75309db9a8b02a1b4

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                6f008c98c9d51ba2eab2cfde48bf4d71

                                SHA1

                                9bf180b4c9074068c76897504a4807148279bd04

                                SHA256

                                60fb5f63fa6bf2b9e55538df843c3e8fa50e06d3ea2cb42dba2ee3030f6e23ec

                                SHA512

                                6d5eabc972280e9954ca60baa9bb69a1d50d54a6ec9ddd30155d9ca8c88ebe117c6e840c2611626cb38b6642d22398b36705a482221bb8012a8c8db480e73cf6

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                7d52a7a72dcc7452c340311f2889ee56

                                SHA1

                                fcbcf133fa6a627c27dd2d584b538c62f7057de1

                                SHA256

                                7e5f0aeb072518a08b5189c04ca5a53cb346a8deaff354df9c850ed40229e3cb

                                SHA512

                                63d0b35a214d8b5f9d4bbf4cf33d2c316537479baef60a1e0fe91505ead1287efecc041a3cec024a6ca7c6d358d088a90303f66e50b138efaa73956021af97b3

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                Filesize

                                371B

                                MD5

                                6d4bd49571a556c1178c471318566059

                                SHA1

                                f6717ca862e6ed3a3811e79157c7fcccf58e46bc

                                SHA256

                                8e66053c7a92e2a6ba127220fea62be17ad0fa797685cd3a9387bb21c8fd3cea

                                SHA512

                                877ae9ccfc930f38ea6f0f224bf69f0205fabc6278c46d5a3ab8f4a03d5afa013ab72784b63b32e8304d96e48549e9234a84088e63f574931d44d722c188bfd8

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581ae6.TMP

                                Filesize

                                371B

                                MD5

                                95ffbe44c6f1969d0fa76a60a7522c4d

                                SHA1

                                fd01ef333b6ed8e4cefc99424fe9a4b96111706e

                                SHA256

                                520848431b130d8c4db7c84908f40caa928a84d64d8c5ac4b9760d4a1cacf9b2

                                SHA512

                                e56285fa4fa7c02c2c492327097218844cbc9fd22a08338509f7c1d9745673951c170674bf4254f6435a0d7caec521dc66bc4619879306f5bdcda166c339f023

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d7f7c785-29e0-4670-ad61-02cd0847d74e.tmp

                                Filesize

                                6KB

                                MD5

                                08de874438dcebfa4017cc6e5ed8219b

                                SHA1

                                06c24dc91621bd2ead8208772b10f824656123d0

                                SHA256

                                793c43260086110e121dc27456d6cbe26f6af2b2fcc14a6a16f5fbf51036262d

                                SHA512

                                4db5d4c3ead74ac956dd54da6d14605edf996d213762efdc2b69cafbc6db246eccb09a596b7c3cb9d625790715bc636fbf987c449238493e641082c9308ac573

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                Filesize

                                16B

                                MD5

                                6752a1d65b201c13b62ea44016eb221f

                                SHA1

                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                SHA256

                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                SHA512

                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                Filesize

                                11KB

                                MD5

                                d5c6551c31bc54f2acab694df3997826

                                SHA1

                                024e03bc3c7386375f3a47ea0112386ac94b5887

                                SHA256

                                2d017270b1362a2b8bc7b5f692b4b96d4ebcd5b159963b67d5cbc79b2ea402a8

                                SHA512

                                6f52570174ea9d38246b437c7a4f3b37e9ea501a1b58aa62d337df9d90e1858efede2823a1277ef2805d9d5156c0166ae424ff510df5c0221b4f9c9462854e5a