Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/06/2024, 12:53 UTC

General

  • Target

    a5a220844dc3f020867a4632905c0972_JaffaCakes118.html

  • Size

    34KB

  • MD5

    a5a220844dc3f020867a4632905c0972

  • SHA1

    8508bcfe2dfc42b9dea2ccfc0570329b2b8d90a3

  • SHA256

    4d74bc54a4e52e6363a6a650339d623f9e7b0f82df6d5f7f400e3e353f5d5cd0

  • SHA512

    31dbd754d21fdeb6c035430992d289509c412a19ce6f2aabf9af6badb5a98b32981ed4d0086b18f70562b49ac353d4964460261233796125503c963de9897379

  • SSDEEP

    192:uWffb5n03GLnQjxn5Q/mnQieFNntinQOkEntSYnQTbnxnQLXCDAMw26k5195+Z6v:4Q/jE46w12JhGTRTpz7Ow

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a5a220844dc3f020867a4632905c0972_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3976
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb260146f8,0x7ffb26014708,0x7ffb26014718
      2⤵
        PID:776
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13745907908480184148,12592586145163497694,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
        2⤵
          PID:4452
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,13745907908480184148,12592586145163497694,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1080
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,13745907908480184148,12592586145163497694,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
          2⤵
            PID:2924
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13745907908480184148,12592586145163497694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
            2⤵
              PID:1620
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13745907908480184148,12592586145163497694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
              2⤵
                PID:2472
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13745907908480184148,12592586145163497694,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 /prefetch:8
                2⤵
                  PID:4604
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13745907908480184148,12592586145163497694,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1432
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13745907908480184148,12592586145163497694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
                  2⤵
                    PID:2996
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13745907908480184148,12592586145163497694,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
                    2⤵
                      PID:4504
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13745907908480184148,12592586145163497694,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:1
                      2⤵
                        PID:2604
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13745907908480184148,12592586145163497694,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4556 /prefetch:1
                        2⤵
                          PID:1360
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13745907908480184148,12592586145163497694,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2112
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:876
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:1032

                          Network

                          • flag-us
                            DNS
                            8.8.8.8.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            8.8.8.8.in-addr.arpa
                            IN PTR
                          • flag-us
                            DNS
                            8.8.8.8.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            8.8.8.8.in-addr.arpa
                            IN PTR
                          • flag-us
                            DNS
                            8.8.8.8.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            8.8.8.8.in-addr.arpa
                            IN PTR
                          • flag-us
                            DNS
                            8.8.8.8.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            8.8.8.8.in-addr.arpa
                            IN PTR
                          • flag-us
                            DNS
                            8.8.8.8.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            8.8.8.8.in-addr.arpa
                            IN PTR
                          • flag-us
                            DNS
                            cdd.net.ua
                            msedge.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            cdd.net.ua
                            IN A
                          • flag-us
                            DNS
                            cdd.net.ua
                            msedge.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            cdd.net.ua
                            IN A
                          • flag-us
                            DNS
                            cdd.net.ua
                            msedge.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            cdd.net.ua
                            IN A
                          • flag-us
                            DNS
                            cdd.net.ua
                            msedge.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            cdd.net.ua
                            IN A
                          • flag-us
                            DNS
                            cdd.net.ua
                            msedge.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            cdd.net.ua
                            IN A
                          • flag-us
                            DNS
                            cdd.net.ua
                            msedge.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            cdd.net.ua
                            IN A
                          • flag-us
                            DNS
                            cdd.net.ua
                            msedge.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            cdd.net.ua
                            IN A
                          • flag-us
                            DNS
                            cdd.net.ua
                            msedge.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            cdd.net.ua
                            IN A
                          • flag-us
                            DNS
                            cdd.net.ua
                            msedge.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            cdd.net.ua
                            IN A
                          • flag-us
                            DNS
                            cdd.net.ua
                            msedge.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            cdd.net.ua
                            IN A
                          • flag-us
                            DNS
                            cdd.net.ua
                            msedge.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            cdd.net.ua
                            IN A
                          • flag-us
                            DNS
                            cdd.net.ua
                            msedge.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            cdd.net.ua
                            IN A
                          • flag-us
                            DNS
                            cdd.net.ua
                            msedge.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            cdd.net.ua
                            IN A
                          • flag-us
                            DNS
                            cdd.net.ua
                            msedge.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            cdd.net.ua
                            IN A
                          • flag-us
                            DNS
                            cdd.net.ua
                            msedge.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            cdd.net.ua
                            IN A
                          No results found
                          • 8.8.8.8:53
                            8.8.8.8.in-addr.arpa
                            dns
                            330 B
                            5

                            DNS Request

                            8.8.8.8.in-addr.arpa

                            DNS Request

                            8.8.8.8.in-addr.arpa

                            DNS Request

                            8.8.8.8.in-addr.arpa

                            DNS Request

                            8.8.8.8.in-addr.arpa

                            DNS Request

                            8.8.8.8.in-addr.arpa

                          • 8.8.8.8:53
                            cdd.net.ua
                            dns
                            msedge.exe
                            280 B
                            5

                            DNS Request

                            cdd.net.ua

                            DNS Request

                            cdd.net.ua

                            DNS Request

                            cdd.net.ua

                            DNS Request

                            cdd.net.ua

                            DNS Request

                            cdd.net.ua

                          • 224.0.0.251:5353
                            msedge.exe
                            463 B
                            7
                          • 8.8.8.8:53
                            cdd.net.ua
                            dns
                            msedge.exe
                            280 B
                            5

                            DNS Request

                            cdd.net.ua

                            DNS Request

                            cdd.net.ua

                            DNS Request

                            cdd.net.ua

                            DNS Request

                            cdd.net.ua

                            DNS Request

                            cdd.net.ua

                          • 8.8.8.8:53
                            cdd.net.ua
                            dns
                            msedge.exe
                            280 B
                            5

                            DNS Request

                            cdd.net.ua

                            DNS Request

                            cdd.net.ua

                            DNS Request

                            cdd.net.ua

                            DNS Request

                            cdd.net.ua

                            DNS Request

                            cdd.net.ua

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            f61fa5143fe872d1d8f1e9f8dc6544f9

                            SHA1

                            df44bab94d7388fb38c63085ec4db80cfc5eb009

                            SHA256

                            284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

                            SHA512

                            971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            87f7abeb82600e1e640b843ad50fe0a1

                            SHA1

                            045bbada3f23fc59941bf7d0210fb160cb78ae87

                            SHA256

                            b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

                            SHA512

                            ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            2a536ee36f35eb96b59aec5fc30447db

                            SHA1

                            49d31242350c9e8ad0b8c5dda3782471f2a1934d

                            SHA256

                            98044e7ed581b2bd9b9686b8029c5e5e101f856e139a9d7b6826c93bf491392c

                            SHA512

                            ae86a59d33c741b01549b09b3238d60649f8dabd00efb4d884ff5fd7a35b00cabd4239a04174fa5a69091def9c5dc743624f5f79a27e88f0555c8f25f0034312

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            4e4e96371c84daf00941a0d09f7b7469

                            SHA1

                            df6aa2ade7cfd4734680e0e3b2053c3bcd449819

                            SHA256

                            b02fefb05c96f31e8c2568453529f211bef5b154f4aedc6fcb8ab2e165cd81c5

                            SHA512

                            ee87002a389e8a4e83d8346f7941ebde8695cc5874263472ed5d6407b94b11f4c2328feacf60ec3104eb9ebebd064c7d907e9ac22161629fef1260b8d9589a59

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            6752a1d65b201c13b62ea44016eb221f

                            SHA1

                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                            SHA256

                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                            SHA512

                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            8KB

                            MD5

                            5bde9f643030d5233eea416602645d08

                            SHA1

                            dfaeae17ff7b17a2c933c163440ef4579545baa9

                            SHA256

                            02b17d264a68cbd114ae1dcfa7d9e8c0494bb2d80a9daf0e0001d9b3b9e679fb

                            SHA512

                            84055207d25b976c27533dfa8f29ac4fbcaf316964fb2e228ce4fd499614af053884023c0df4ee71cc105407efa1a03a4ad9a6a2da0db4d85027699f91a9d1e0

                          We care about your privacy.

                          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.