Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/05/2024, 22:07

General

  • Target

    7ab415f81efb6d9c8ee95d193047eaa5_JaffaCakes118.html

  • Size

    175KB

  • MD5

    7ab415f81efb6d9c8ee95d193047eaa5

  • SHA1

    239adb5006dbb52d4a95d3a0b71195af9bd16c52

  • SHA256

    586add697db5cde2ec513cde65efaa7e2b3fbee1d0304eb33c4d39ba95774ef1

  • SHA512

    1d0b35ccd26c6c0bd49a425ee0d37391da66675ba943e331a69fd10f87ca6613c78aa1ca9be69afeb874952fadf06bb0d44139fc3b28b24ae73f11b4f599c632

  • SSDEEP

    3072:CT3IQzgmw7bmMunF4309Diq4e4pU7+WviY+9aGlwZj7h7uQbeMB+JFm:I43eiXaGld2

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7ab415f81efb6d9c8ee95d193047eaa5_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:600
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ad3946f8,0x7ff8ad394708,0x7ff8ad394718
      2⤵
        PID:4532
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
        2⤵
          PID:1256
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2856
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
          2⤵
            PID:3168
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
            2⤵
              PID:1104
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
              2⤵
                PID:3188
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
                2⤵
                  PID:3252
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
                  2⤵
                    PID:556
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
                    2⤵
                      PID:364
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
                      2⤵
                        PID:3956
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
                        2⤵
                          PID:4880
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:8
                          2⤵
                            PID:3860
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4332
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1
                            2⤵
                              PID:1796
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
                              2⤵
                                PID:4516
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
                                2⤵
                                  PID:1548
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1
                                  2⤵
                                    PID:4512
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,5566386402950693626,17392750390429718190,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5788 /prefetch:2
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4912
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:4984
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:464

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      ce4c898f8fc7601e2fbc252fdadb5115

                                      SHA1

                                      01bf06badc5da353e539c7c07527d30dccc55a91

                                      SHA256

                                      bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

                                      SHA512

                                      80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      4158365912175436289496136e7912c2

                                      SHA1

                                      813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

                                      SHA256

                                      354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

                                      SHA512

                                      74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      240B

                                      MD5

                                      01cba16162834fc18a21713aba4ef28a

                                      SHA1

                                      cb434c15fbb4fd0c5faf34cafff4e5e8f882f468

                                      SHA256

                                      c605d4d8ae6542c0da5dde62587f28dce282efc8908e716162b759ee6124be1d

                                      SHA512

                                      995f3f65b350f530964f1b105773bd1c793746b32ecba63bdaca792b7117388e9dc7f0e8461e1afeb47c68c8aa45a2ddb54851ffe0a887a5236dd98d11d21144

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      216B

                                      MD5

                                      c8d2dcfce5767d194a177b0d1edad4bd

                                      SHA1

                                      aab040dca9c45d4af798b8d431c416e7193e72d6

                                      SHA256

                                      7f4a0d11fd9516376a53917769d5dd87cbe8de757d536450acdcf7fd7bed54cb

                                      SHA512

                                      28969f689f512417106442b661069d4214d1d8feed3ce1a0ad8065073a0ec8d8ba7f0bd757f1a6278a118375b18ea80fc43932cf174d209d37df1200533d7bdc

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      2KB

                                      MD5

                                      c127e8444d5c11cc88df615c9ba94f37

                                      SHA1

                                      6d8ef4a4c0e962f33c372ade4aa5e2bea47b2f89

                                      SHA256

                                      20127e88848e3d57a757aa78a13c2d17dc3d7d32f6477567259a475209ff2db0

                                      SHA512

                                      059afc7a356c107517ac0448601cf056a3b67900df9f7231bc419116371faa95da753a359c4254ccf4e68c8476efa907edc6964e4f74be069145614d06e00b3e

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      2KB

                                      MD5

                                      315c634f42cbabd03fe47395a8753579

                                      SHA1

                                      a79fa494e873eb5610ad2976f8e005ed6cbf1dc7

                                      SHA256

                                      82427385ef27bc81bdcaade0dbacd88fa7b969bbb2dd75578ed952852d85bf47

                                      SHA512

                                      5dcd746121efbf9e1b4cdbfdcc11b917436903265d491e8f711ab048d1d225b6a11717dc35b9ddbe53f082f98fc6338b6374b06398e8151974128df6d42a07f3

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      efafd0ce3c2575e97e2d311af1377861

                                      SHA1

                                      2c838adb4b01e067f140522281b0d680c4591f5d

                                      SHA256

                                      906fac45be4a715a9bf099c83ae44afc12a788b846908ee96268c0b2a059f6ad

                                      SHA512

                                      05486ab96ecf7bfbe476ee3762719cb4d4dae57c772394ac69da1edbc167dc095f0a86a5968d8e47a3d1a820de762857c0a5ae9a03e034b2c99f2b01fee3beb1

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      d3d918224570bb484b6df95478a96cd3

                                      SHA1

                                      2c4e1d0a434fc7eb55270ed7f3fcf12b3a0f883a

                                      SHA256

                                      f041b0f77701b8e8b0942928c328d1b8be16caa6a3d3b6a7d18fb5e53202dd29

                                      SHA512

                                      ad1be671bdc49ce6a27de9040696e9ac3db646376ba6d19eab614936e36df155486252efd005c3a229302d54a5b889fa42685b8bf327dfb4afb11bfe61ac1186

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      98c5e315c09474ca4e45563b8249d050

                                      SHA1

                                      bb33799849351bcd12063859d281ce2c8e8fa6d5

                                      SHA256

                                      5711488731f4dfd3d1ee884a17b34eeb5e4e83e4917958bbffd773a08c0286db

                                      SHA512

                                      bfe6248e0ee0ee279d9ef3a6c7a173e6e4ff823c35d56e688f1db4aee3551817f59efc5c02c32e6a687b931b106c8e7780c77581ae716666cf79d28694698b2d

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      6a8d225b9949dfd41aea6fef15188bb0

                                      SHA1

                                      18429ef9f008d02f3289d2905a002c5954919823

                                      SHA256

                                      dd971ee7b4f7b0fc345ad904a04397aa1fb9a819582a2fb13bce3daa64858ebe

                                      SHA512

                                      94c95ff0f87431e975d73c1efdab83f2e98730ee9cae4ae0ec9bb4d938dd009716353caaeb31f062f02f9dc641138823833f10ebe1058e33134774f8f486444e

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      e089311dc7288b66eba0d40166a08ae6

                                      SHA1

                                      ccf4a079ee9e8486c0eb3f99303eb6f2f282edd3

                                      SHA256

                                      cd8e42b8d9ddea5a6652ff8b4d62f245fcb3864498c4e6ac2ceec781370c8ab8

                                      SHA512

                                      fa709697cb721bd909908b7b8098b45b51a4601695b9537977be66699b663bccb7adb68618b9182e395d81af877f048bfbd8dc212a45313b3e70d71ff99ec373

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      46295cac801e5d4857d09837238a6394

                                      SHA1

                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                      SHA256

                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                      SHA512

                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      206702161f94c5cd39fadd03f4014d98

                                      SHA1

                                      bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                      SHA256

                                      1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                      SHA512

                                      0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      aea8b8ae99e0604083c24e2b710d7c40

                                      SHA1

                                      51aa04cc7291a87de1b9499842cce4ab0ea7366f

                                      SHA256

                                      880541bf152eacce5fce11e620a99b45edb5e5a46daef15326c4deaa58976055

                                      SHA512

                                      0496b25827c5d2fca335e98cf218b1465d8083f098acf2739a27e0bdf6b807e78d50117f6dcfaa9a6942b1c47fdf017164f71277196936474ed76f3932c97ce9