Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/06/2024, 16:55

General

  • Target

    bd5ebe327c2e4363883169092ad29d1d_JaffaCakes118.html

  • Size

    37KB

  • MD5

    bd5ebe327c2e4363883169092ad29d1d

  • SHA1

    df39536ea3f75379ed5730661745b3e7f2d8f4fd

  • SHA256

    8584d17a65ba4d4e7d133ef81a46f4995aff315994e06d952c1b789742a6753c

  • SHA512

    f00e931816542f9be2f5acf750236bf42bd1c084390906fe3d07df2cf2d081a7ec6ae49b2444475f58573ca25bca1eeae9fc6db7708421c24040923fb4412155

  • SSDEEP

    768:bFqbG1bmrsb2vbxI5Ix/g9br8z0FjEoGe101JR4JiYAX2VMqzP:bFqoKrsS1I5IxGn8z0FjEnBHZG+eP

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bd5ebe327c2e4363883169092ad29d1d_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:720
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb027646f8,0x7ffb02764708,0x7ffb02764718
      2⤵
        PID:1124
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
        2⤵
          PID:3656
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4836
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
          2⤵
            PID:4904
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
            2⤵
              PID:1632
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
              2⤵
                PID:2916
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
                2⤵
                  PID:4460
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
                  2⤵
                    PID:4608
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4564
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
                    2⤵
                      PID:4824
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
                      2⤵
                        PID:2412
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
                        2⤵
                          PID:1032
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
                          2⤵
                            PID:4960
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,3221833651639521059,3053114921779341771,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1928 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3872
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:3884
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:1248

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              477462b6ad8eaaf8d38f5e3a4daf17b0

                              SHA1

                              86174e670c44767c08a39cc2a53c09c318326201

                              SHA256

                              e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d

                              SHA512

                              a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              b704c9ca0493bd4548ac9c69dc4a4f27

                              SHA1

                              a3e5e54e630dabe55ca18a798d9f5681e0620ba7

                              SHA256

                              2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411

                              SHA512

                              69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

                              Filesize

                              23KB

                              MD5

                              df14665f460474a948ef6f3ca958f319

                              SHA1

                              78acca6b4ca9499ba20a2341060e9e62d1365a0c

                              SHA256

                              e1351a972cfc2b3cee94b36da7a2d25d94e86166685a084a7f8fc1f3e578270e

                              SHA512

                              8a6bbf19d0a305b4617604e34491fea97b0d5d88b6bc7ed635daa1fd7c580fe5aaa799eaa298c949bf4cb69d8d415c0e823b6128476008e527c130a26cf59cc2

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              120B

                              MD5

                              52671bf0905e2aaf29c8bc21596c9c5e

                              SHA1

                              25180b9eb5aa479b70e01014da5a201c8adc8a02

                              SHA256

                              698b3129b2f17642a56c664e0127a9aa89ca3e8863f8e327c149aa12e2476b26

                              SHA512

                              3611e47af582222a849311b0100ed7eab1c222ff60a7861e47acd4bcaf231bc89cab5cb7bf7a70a863c9abf53dac21af500f9e89a9e62f37aaa8c7d79edb8478

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              144B

                              MD5

                              adbd5409e3f4f934e71fd3c8bd7eb207

                              SHA1

                              5dad9aee59ea80ce67b89ee7b4cc455d07c5b33d

                              SHA256

                              b484f81225dd811a4bbcd6468cdbe08b148b9665322d04e7f43232890336ab98

                              SHA512

                              f6eb3ef569f942fbbe2f6eec9cbe1e8fc21b108cf1064478ec6f573908681e5bde52393bee390cf640f3d1da4c54e89114c6d0770527f67341980bbc2e30301c

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              111B

                              MD5

                              807419ca9a4734feaf8d8563a003b048

                              SHA1

                              a723c7d60a65886ffa068711f1e900ccc85922a6

                              SHA256

                              aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                              SHA512

                              f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              987B

                              MD5

                              caf804e91bb1224e72c2cfcb564c1f98

                              SHA1

                              dc853226b4c0e928abfac500b7ea403fe321806c

                              SHA256

                              38da88353e07dcf2e30225e0e58dbe5025d2a666e7b3f369a4a7ed0b1214c314

                              SHA512

                              93f9534325b202d6903cf32bae8d98fd936fc3724852db1414eef4856f9d8986b6a54f1090522cb28d9ad836b2082a52c799e1826174a09a93ef0de1be6cdeec

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              987B

                              MD5

                              2aa753d0494e1557442e5287e8dfaa10

                              SHA1

                              aea94c833bb021f40ab950b45d7e705efa6c980d

                              SHA256

                              93fd1244fce7e36c3879368dd0896a0b4618218b78e685cf8ba29e5f3e7d0e86

                              SHA512

                              d085bb9c3f821f5fb9a823ec8edceb7d169f73b0be6708168056ca8db25259321ba217e0ac224fb412a33e0fe3dce3566e52d8e2916c004bbd9f20bc815d55ae

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              1bc40c03dc0ffcdcee355ef947272d44

                              SHA1

                              ac2f45af1f3fdeafa12bbfd7bb6d583024db3ae8

                              SHA256

                              29e8dc886beaeffb03e42fdf38fdef3a7d6ac976e3e97b43782ffd912d08e0e5

                              SHA512

                              53a83fc9e8fe2c6f974280ca4cbef19241e86fd9dc066a2faf218c11a01bce773be780f159d494b3c7f64dc9ae8cea60ba902acd0894d2b2cead4c61edcdd40d

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              ca8f8afd7369e8c630cc82f1bc606367

                              SHA1

                              2b8d27b1026d8f3e8e99924969afb3e61b7d86c5

                              SHA256

                              cb94f606a302db8c58cd1babe4775de5406649210f5fd88659fbade5038eba9c

                              SHA512

                              1848419c383510518d520f6f73b18db1f3fb06769efd95066e4d49ab4053e1504b882acedb428fd691a9a0d64b0b0c153adc5a15ecf5b3c3033a09cdb05d9d7c

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              cf6fe6729a76fc84bb0bf0bf24c4213b

                              SHA1

                              df4e7ff8bb2523ad01ad79d9ae259843db89b51a

                              SHA256

                              f351495190b2dd472a293fde984b864b5d0a2d4e18ad0fe66ed46b4446d18a05

                              SHA512

                              fd827eff6693c0d9e480895ebd702b01ed815504584c90e274341d0b23454a3e7575b5e283689101ab6b3bc73f9d4cfd00a23f89309792539cd0bde8e527cdf7

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              11KB

                              MD5

                              ca1ad2324c47dda0c128a2a44ee28524

                              SHA1

                              ecb54e0463c48bb2d7652ff4b2937ce533ceda2c

                              SHA256

                              2594bf474a81f0d6e85a4be5ef75aa91f52fef752d0efcc80f6f985a3e2c1c20

                              SHA512

                              705ea43866a023b2f7b8814865efda12efa037244c9033af3d4c9502c78699286715ba3d1480c7da367244618387caf8836faf74af08e9d5d24552e4665fe853