Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2024, 02:29

General

  • Target

    70949adc6ba1d663678e83c1cd946bd1_JaffaCakes118.html

  • Size

    72KB

  • MD5

    70949adc6ba1d663678e83c1cd946bd1

  • SHA1

    f52c63f2a64cc6a403ad25be45ee659375c84b4e

  • SHA256

    182674e4939e6e6f0cc42defd3b9ddba88fc94dd5e25991c62faee5dab22621b

  • SHA512

    7d838d66f7bed376aec1eaf9517fd818248c844c13b5e510a7b2195b2f822ab5f9485f0b0d04eff4fd9e426693d0f013d7b1d1776f7fc290d1fb0aa25864f4be

  • SSDEEP

    1536:O4R5spj3eGzR0m0OKwyrPkoVdohR7Q3+Sz:O4R5spj3eIumjK9rPkoVdoR7Q3+Sz

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\70949adc6ba1d663678e83c1cd946bd1_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4628
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9903a46f8,0x7ff9903a4708,0x7ff9903a4718
      2⤵
        PID:1232
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
        2⤵
          PID:996
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4380
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
          2⤵
            PID:4956
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
            2⤵
              PID:2032
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
              2⤵
                PID:1872
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
                2⤵
                  PID:1172
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
                  2⤵
                    PID:116
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
                    2⤵
                      PID:724
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 /prefetch:8
                      2⤵
                        PID:2868
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4436
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
                        2⤵
                          PID:1644
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
                          2⤵
                            PID:3616
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
                            2⤵
                              PID:1444
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
                              2⤵
                                PID:4828
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,17263273266623382348,14977383951185731823,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4584
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:4080
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:4944

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  56641592f6e69f5f5fb06f2319384490

                                  SHA1

                                  6a86be42e2c6d26b7830ad9f4e2627995fd91069

                                  SHA256

                                  02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

                                  SHA512

                                  c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                  Filesize

                                  152B

                                  MD5

                                  612a6c4247ef652299b376221c984213

                                  SHA1

                                  d306f3b16bde39708aa862aee372345feb559750

                                  SHA256

                                  9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

                                  SHA512

                                  34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

                                  Filesize

                                  44KB

                                  MD5

                                  88477d32f888c2b8a3f3d98deb460b3d

                                  SHA1

                                  1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

                                  SHA256

                                  1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

                                  SHA512

                                  e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  216B

                                  MD5

                                  4e4345ffc91248d8197236b46f5cb432

                                  SHA1

                                  c27561b280eca306caf7b3f3fdc1662983b1629d

                                  SHA256

                                  c8206283bf10612cf18e831d469f72341ceaf305da115570571052dc86843a47

                                  SHA512

                                  f3100f0556c1bc8f89e4f228b7f7bb1fb5696fa11b2788174f5f3200d5fcfe960de5f9945783bdb815157f7663d119f3534daed7b39aa4fe3d3de90ff4dbd74f

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  240B

                                  MD5

                                  75d8b719a1964aed8aaf1d41eafa3f30

                                  SHA1

                                  02f30b0c974f234b215c2c75ad488a7d4e138773

                                  SHA256

                                  6e686c0e8a381655c6c9a7a794d80f5a0bd375cae08ed006e35cb8970c63a5de

                                  SHA512

                                  e86d45fbd17710c5af6072a9c4ff51d44505d76634ab7c867b19331d434604203c8d107323799b39b5fff924dc85fd51fc4ca5c58a45db1b682bd737fee6a355

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                  Filesize

                                  1KB

                                  MD5

                                  e5c7b6bd086d64cf662364d850dc1f90

                                  SHA1

                                  e85556c008ce44ec3e8b22a79ea3442ef4513bba

                                  SHA256

                                  6c37790830c33b15d31376ffba212a6270676bcdd6ec50efcceef6efa138641a

                                  SHA512

                                  956ba9fc15846f079de493b454b786ff93ecc322e144a4c1925ff8e2569bd00a818a09442f0116c35e3894e109faa2a95e297d3d424b34b02ec981c208967a6c

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  5KB

                                  MD5

                                  056c00d3743990840793bb5dd11cff17

                                  SHA1

                                  6162141565a54a32001435e72461afeffe153c3a

                                  SHA256

                                  81bef5785b34f4d8bb24944d7418d6f6b865b47d5d172e6e6c1ef32087a27ca8

                                  SHA512

                                  442b62dcf4c078f017b84b2ab395f2b3b50c220814fc75b7d3857ccab20542dc831645aaf4148ea9976c253eb28a77b44a33dda26b363ddceb7daebfaf759c3f

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  7KB

                                  MD5

                                  471296f8d441520e539e5e6b2590c2b5

                                  SHA1

                                  0bd2b7f6714b90b284dcf9702243cdc72ae2d859

                                  SHA256

                                  6f5a1ba06cca532dbce380a876ddbd4f3e14d1767c82a20140f63730f1d14b8f

                                  SHA512

                                  b1ca78198620792bf05f9b29b9d4d82a1e742e4f6575e6662292acd3dbf8caa427187111b0125688b10c86c2617007ada66d6c19fced8a9bda43601b9e9f92aa

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  7KB

                                  MD5

                                  cd1ee45cce160958888165939b50c1be

                                  SHA1

                                  4df94a42cc631c1b58b380e3b347047305c987e0

                                  SHA256

                                  6f35beabc0e5d0da6b7a78f1f45bc969fef5916ddfb3f65b0878a51b3bcff044

                                  SHA512

                                  e542f59fbb65665f57897726aacf0b7917c5850090040c6e89221f0b39e8ffc4972c53d2f4bbc89966b0d36766d1d797d3fa396a43059ec9aadefae12f019fea

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                  Filesize

                                  7KB

                                  MD5

                                  0877425ced00c41ad36d2d9f1b99fdd4

                                  SHA1

                                  2455dfeca55a8a8af6aa3529c5b3d25f1265f05e

                                  SHA256

                                  99bb5c036b475b5047a8b24da1df6cc796a2ffed76a7af506ab454541309c85d

                                  SHA512

                                  b9e2e5344651705693f3c1d3647975ea6c92daf8aeb194b721bb0aa6753a8812f1d2c5cb987e388ffd5b06376e7000c8089e6e7967bad5a6798653e01731a2d8

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                  Filesize

                                  16B

                                  MD5

                                  6752a1d65b201c13b62ea44016eb221f

                                  SHA1

                                  58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                  SHA256

                                  0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                  SHA512

                                  9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                  Filesize

                                  11KB

                                  MD5

                                  87cf3ed699d3a9601bd60c58ba65d6fc

                                  SHA1

                                  e449b233d25ba0d3e00e7f789d113f21b62a8c69

                                  SHA256

                                  aabbb615239a714a44d53fa0d8ed7e810590c4d250f4c953009afcc058c34d45

                                  SHA512

                                  b5593236c9b82e3a3ad30b2c5e938312a0adac8c8af4a78a0f30ad66837d31a8a8c97d146fae263886a70fbf2d1b8015007c3183c740d2d53b642ae8ac1761a1