Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/05/2024, 17:21

General

  • Target

    84e30d5ecff15c16a5a46dbc8284e2fe_JaffaCakes118.html

  • Size

    55KB

  • MD5

    84e30d5ecff15c16a5a46dbc8284e2fe

  • SHA1

    2f1e8335e50025582d76d790373e14b23fb1c9f5

  • SHA256

    fd7c3426c0be034cce07b55b5bd7fb4631141dbe652bcb98d303141fe0143e29

  • SHA512

    742d3171d88c9d982ca7bc8d064aa98688775ffbabed8cf783798e3cbaba11f4b70be4cdc226e5380dc4f089abf988b04eb481bfcde758c3e2514ae2fe943857

  • SSDEEP

    768:+aB/FJboPdTI02uN7gWsHinOdB/ZqB+vMzlUpNcjD0:t/FJboPdTI0XpcHMevMzlUpNcjD0

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\84e30d5ecff15c16a5a46dbc8284e2fe_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1052
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb166d46f8,0x7ffb166d4708,0x7ffb166d4718
      2⤵
        PID:2040
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,1698891700754831918,18002105687037216983,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
        2⤵
          PID:2600
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,1698891700754831918,18002105687037216983,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2888
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,1698891700754831918,18002105687037216983,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
          2⤵
            PID:4552
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1698891700754831918,18002105687037216983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
            2⤵
              PID:552
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1698891700754831918,18002105687037216983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
              2⤵
                PID:2028
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1698891700754831918,18002105687037216983,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1460 /prefetch:1
                2⤵
                  PID:4704
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,1698891700754831918,18002105687037216983,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 /prefetch:2
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1048
              • C:\Windows\System32\CompPkgSrv.exe
                C:\Windows\System32\CompPkgSrv.exe -Embedding
                1⤵
                  PID:3416
                • C:\Windows\System32\CompPkgSrv.exe
                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                  1⤵
                    PID:900

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                    Filesize

                    152B

                    MD5

                    c9c4c494f8fba32d95ba2125f00586a3

                    SHA1

                    8a600205528aef7953144f1cf6f7a5115e3611de

                    SHA256

                    a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

                    SHA512

                    9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                    Filesize

                    152B

                    MD5

                    4dc6fc5e708279a3310fe55d9c44743d

                    SHA1

                    a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

                    SHA256

                    a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

                    SHA512

                    5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

                    Filesize

                    22KB

                    MD5

                    5e74c6d871232d6fe5d88711ece1408b

                    SHA1

                    1a5d3ac31e833df4c091f14c94a2ecd1c6294875

                    SHA256

                    bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

                    SHA512

                    9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                    Filesize

                    120B

                    MD5

                    1240f68611c793b3ae781a24c46baafa

                    SHA1

                    ed91fe8db762839eea17788c7abdb365578b0d4a

                    SHA256

                    521e2c768cedeedce6029a824f924b56858d6163ab4585df73ba90853ecf9a38

                    SHA512

                    1437bb092d9bbbee2f495c0a6757df1e91c1e8230c4a1fcfe335d2164945077a5ab1673103a400f5a054118d2bad8ab21cacaa682889348fed3c1ae356db03dd

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                    Filesize

                    531B

                    MD5

                    7530e914c8cd1155efabffca1cf202a0

                    SHA1

                    8e41a3b2516174ca42462e7ed0d2aa9da55754d6

                    SHA256

                    269a7db3fff35f5dc84c6d1292ae9fb036be67ec319fd717acf853a3e2b35536

                    SHA512

                    53136e20614e2aff350e1e92e0381381da606643886fc6c3e4783266418b988f756ec9fc7ec98d62b2dfe11cc9ac06bafea1803a6c237189916cbbd6a3592865

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                    Filesize

                    5KB

                    MD5

                    41687d6e2fb03b2c3a929851f7627dcd

                    SHA1

                    2fd46401822aaf5ff475cb9b6d2c702b10bb43e9

                    SHA256

                    100f2f9d04223eb41b1ce8c5c510759ed8204f1fc4420675ac6af22bdf4f2e1b

                    SHA512

                    5a32d47a4642e7f1e2239af479a8a01b3d3522752d2533cdd020e6cb5f33a321e16727495370fdbc6ac46fff90d4a72e39ef7c9a6fb2a77b0df036e8d38db582

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                    Filesize

                    6KB

                    MD5

                    1200b79d3fa0fec38041b9f414e1600a

                    SHA1

                    e2ad0eb76fdf995f8ec8316b3dc14a890a843eda

                    SHA256

                    777d431a92b853fbb54056950abdc1e7cf4b67e3ae5a07c5d18d42a84de91a9a

                    SHA512

                    839b7991b55eaa9a1c19b2273727e2fbb827e3c771a048e3f7f824ead2a90043a2b39e279449634cbec090000636e0022bd063e2ca3eb598fde5d174245531ae

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                    Filesize

                    704B

                    MD5

                    7d514e65961d3d121fd1e4762b17b3fb

                    SHA1

                    f865a662b059cfd2eeb469d13a4a1bd016e3a154

                    SHA256

                    7f540d47ac44a668ff7e7b541753b96dddcf292be166e6fad02087924dfe4c9c

                    SHA512

                    1d610d9ca2473128f416212f160d9a7a90c60d62535bea3b8a33b94a19e9349fbc1da560c9d5345bffa859874b98cb6a4e4d0a4c321ebe73455ad7c411be0b3d

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                    Filesize

                    370B

                    MD5

                    8c189520380c92cc14888fb59b91e2dc

                    SHA1

                    5ee5faf8d295ce130461d1da26ed7c46136ec3b6

                    SHA256

                    66b044a49183c0fc820a5ca30add7daff8c3cb7c9e8c2f94194fdfee935e5607

                    SHA512

                    2318521781a54530e2189e1c8d5f8f32096bbba703074be1d4d90c269c92e82da335cc6b2a2bb933d370fc61d1d65d93aea8957f0af7b47c52a8c3b73d62d82f

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583728.TMP

                    Filesize

                    203B

                    MD5

                    b2ead8b06775db82f7b2222036f80c6c

                    SHA1

                    fe1e23700b8ee5fbf46b0ca99385b2a0cc0516dc

                    SHA256

                    c711110d18a0460f9b37634306b6be4209251127fc16ea4f197207def35809b7

                    SHA512

                    65f49a7c3acb02a144d0018031af4ea2eddc4ef9b6ab4576ca1e4e94c57e9be9589f7fa76f50ec93b77687980d18c18df13a096a5bd7251557b0218bbb37d342

                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                    Filesize

                    10KB

                    MD5

                    a38f84a5c4d339b8e51a7d9446cfc38a

                    SHA1

                    65b393c4a89f9feeadfb3da0175eb3f96d31e32b

                    SHA256

                    4d6022ca30dd454369681eab17579f1b524897c431d8b3d59cae45dfa2fad2bf

                    SHA512

                    cbc79685e0df28128c00916a89169c9d1dc10d92aa6331bd4e1236e3924fdab716e8ef73e4f4fb636f673990d14625ec710063e2410e2b7ca5b6adf5e770be40