Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/06/2024, 14:15

General

  • Target

    95242f73b953e7905e9e2639c0f3f2e9_JaffaCakes118.html

  • Size

    301KB

  • MD5

    95242f73b953e7905e9e2639c0f3f2e9

  • SHA1

    14cc09fa4825df15f0839e2df89a9137da81f296

  • SHA256

    a63941e62904dec078048a51e0bd1fae24168cd1d8f9095d8775ff9c68eb676e

  • SHA512

    448224d100d386036bb9ebe38a3523068c496450dc18fd84f37dd628b36e4b9d3c0214500c8e4da4f61d4cd87e6acfab506d571e57875edb26530717a8445973

  • SSDEEP

    1536:ED+SbTTF1SjTmKNkltM/jVII3IbIre0U9Qmg6o6ZJLnvuYgYxc43o9dE68FmgjkV:y+SbTTFJKItCVI2lEVcPiTCH

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\95242f73b953e7905e9e2639c0f3f2e9_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff2ca46f8,0x7ffff2ca4708,0x7ffff2ca4718
      2⤵
        PID:4768
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,7729135216828561228,2766716313537754781,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
        2⤵
          PID:532
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,7729135216828561228,2766716313537754781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2248
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,7729135216828561228,2766716313537754781,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
          2⤵
            PID:3244
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7729135216828561228,2766716313537754781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
            2⤵
              PID:3712
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7729135216828561228,2766716313537754781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
              2⤵
                PID:4796
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7729135216828561228,2766716313537754781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
                2⤵
                  PID:368
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7729135216828561228,2766716313537754781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
                  2⤵
                    PID:4920
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,7729135216828561228,2766716313537754781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 /prefetch:8
                    2⤵
                      PID:3236
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,7729135216828561228,2766716313537754781,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3052
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7729135216828561228,2766716313537754781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
                      2⤵
                        PID:1136
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7729135216828561228,2766716313537754781,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
                        2⤵
                          PID:1692
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7729135216828561228,2766716313537754781,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
                          2⤵
                            PID:1324
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,7729135216828561228,2766716313537754781,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2724 /prefetch:1
                            2⤵
                              PID:1772
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,7729135216828561228,2766716313537754781,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4900 /prefetch:2
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1588
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:1320
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:2712

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                c9c4c494f8fba32d95ba2125f00586a3

                                SHA1

                                8a600205528aef7953144f1cf6f7a5115e3611de

                                SHA256

                                a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

                                SHA512

                                9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                Filesize

                                152B

                                MD5

                                4dc6fc5e708279a3310fe55d9c44743d

                                SHA1

                                a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

                                SHA256

                                a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

                                SHA512

                                5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

                                Filesize

                                23KB

                                MD5

                                e1c71f7c04be834f5587230db2ad24b3

                                SHA1

                                f3bab9cb99d9f343bf7ed3981aaa7450515d2424

                                SHA256

                                9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899

                                SHA512

                                205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                Filesize

                                144B

                                MD5

                                25b8045df65027f27bfb7da64d27645f

                                SHA1

                                85029bee7987f901d542b3ad8b628cb016569334

                                SHA256

                                36ffb0a75b21e37359499722a73ae2c75f5e3f5fd78a8c964e9451c1eac1ac24

                                SHA512

                                e90d07077ad9d6c4d8db1d526b50c9a6f79dc65ea94afb3f9554ac459e96102ec2eaf656df00f99b80c97eb4353192c4c98dbc0fa93c2613e453645a3bfad50e

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                Filesize

                                120B

                                MD5

                                727bfd5a8b16276d950d70b6eeaa385c

                                SHA1

                                8a82e087f501962688b69ed0c2d193b371066a52

                                SHA256

                                5a90fee6081f166cdd40444ebe6dc9d2dfc4890e501940571f1d1a2c9248c5be

                                SHA512

                                ebd03ba93a65cd37dd51d2eaf94fb128349325b94836fa7330ab4a29a2154d237e3eb60d3b94ce77652b2fc7abfec8d368f62647a41cd4598515cf1ae4e51bca

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                Filesize

                                1KB

                                MD5

                                07b4992859e6777f7f2877b9966eaf2a

                                SHA1

                                f864b2e6d4dc4cc6119cabbc75fcc499b4403757

                                SHA256

                                a3606c6b68b317642fa04d034bdda5cace59fbe879a2a61186b7a8046a234a03

                                SHA512

                                3d87734ca8875e91d03dcfa0fc42902627ce3c2d56431b90864d077b783d005f58dbfc7cff956685df31139b4f9b0dc944ee26fe0d807d27fbb2d5c0a0bef311

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                Filesize

                                111B

                                MD5

                                807419ca9a4734feaf8d8563a003b048

                                SHA1

                                a723c7d60a65886ffa068711f1e900ccc85922a6

                                SHA256

                                aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                                SHA512

                                f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                2799ec8e1cac0f0ea110c81bb35c704f

                                SHA1

                                c287d3922a125b7231653f2169834b81338d1bf5

                                SHA256

                                e71cae4028f993837a76acd9e77f2447103f8ffb29c59140e3b9098b74b0aa2c

                                SHA512

                                f9db32f72886753dd870c992d5301ed5613f0355a403af4f68e4e322ab598fcd72a2aee36aa5bb1b0a07222903e30e9b4972702ba3c19ac61461222e9247b560

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                e1b573d96066712480a8c9d66b17734c

                                SHA1

                                5585f3035689fbf34c004d9216b51f22dadf9fce

                                SHA256

                                d16ede81040c660b8a31bbae91afcaa6023453a1ff3af33edd4182aa63fd61e9

                                SHA512

                                c97b4e02a8378a1c2d7c584786d683875f5da3d58b40c3d89513bea0023fc944baeb896d773f0b17f16c09f0e3dcfb27651a9b767bf6bbd729c2fef3d92676e8

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                7ea7b633cfe9ce964d4adf52ce99694e

                                SHA1

                                3824fa72813b59ad36c55bc4a57af5148d207513

                                SHA256

                                2815c270ffcda5e779f1a7e1c40571fd2bf26d36fabbcb28cb30b3baf5e88c05

                                SHA512

                                1f8ce9a430e4899eabc85f59c8eadefc1ebdcc15d128b5ddb5b7bd22dace725ca4b6ac74b2729b0ccb322cfbb727fb4e475f495ed14c3eaf37f828b98cd8dfdb

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                adbdf9d4167e1de52d599673e7f744ec

                                SHA1

                                cc342b9359c7d9f19a5f43e87b32cf9fd7d1bf46

                                SHA256

                                23e13e174b2076c3507ebe0e7253aa33eb78397b229dc74311e5001de90f923d

                                SHA512

                                0ff5e7aac69ccd246472cf65c8461e33197ffb0b0678942adfc0a63df0c42fbef03f0f6bd89d6cce4cd9aee9661b4779888d13ba3cc07c6a068bc501de1582d2

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                Filesize

                                704B

                                MD5

                                b005f8fe0925944f5a3335379b800bc3

                                SHA1

                                198bbc28a01801c574db3bd1046edc6ccbea968e

                                SHA256

                                857dda53bc470e72fe21f5aac6db188bd7e249f15ed2adfc2c9f76fe550f485f

                                SHA512

                                c5d7acbf6f97bb4e5be16a296cd5d2a67e4a7d12cfdc945e96d10c515a462ae9f6164fda9d2ec4e6cd051dbd0a13871057956ad43b7d506ed96ecd7a2cda754c

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cfc3.TMP

                                Filesize

                                203B

                                MD5

                                d0055dcd49005e9bedb607a63cd9938c

                                SHA1

                                c99f379eed306618d70ae2e1ade012da64a9cb8f

                                SHA256

                                23059d29e84c2c34d534ee6c8873e7007e3eaa85862df4c6b91ce97417e897cf

                                SHA512

                                68af4653a3d672802cca6959a1aaf294c6536f54f32a9a08bf8bee99e3bae21fd7451e41643115cec5a9e4ba75e6403f214652cf3d964ddb30cc82ac3c5420cc

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                Filesize

                                16B

                                MD5

                                46295cac801e5d4857d09837238a6394

                                SHA1

                                44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                SHA256

                                0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                SHA512

                                8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                Filesize

                                16B

                                MD5

                                206702161f94c5cd39fadd03f4014d98

                                SHA1

                                bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                SHA256

                                1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                SHA512

                                0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                Filesize

                                10KB

                                MD5

                                79fc30d9d79c9c778833b7ae18a4ad58

                                SHA1

                                f4800fff3c09d6d107e7907db058219b7fefbea7

                                SHA256

                                c47a627b410acd7352a056da918551e3829c1ca26a1f3d5bd418a7683dd50ca3

                                SHA512

                                7ae1d509c7ebe9e996066c1c2f19dfc2ecb7bcf81f81cbcf9aedc86fc5017f5bce788df2504a749706ed81189903b61fab5a44c91b7910b8c534cc3d69f85d9d