Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/06/2024, 15:36

General

  • Target

    0e9ab75e1baec0bc2a9f9bffd16ddb12_JaffaCakes118.html

  • Size

    155KB

  • MD5

    0e9ab75e1baec0bc2a9f9bffd16ddb12

  • SHA1

    915ed90d8b3b4786d09ac7f13f4674200d7c05f5

  • SHA256

    62e310a772df7bd90f97149f2996cbf0cc5761301dbc7601e8eecf98b837ff7b

  • SHA512

    971658b75b977ff896220dbbe8b6407670efebb467e6f268e68ae06cf34a963f7feda11e537f0f0418095bd5becd4fa20ce34d675998d860e7e93b772317f132

  • SSDEEP

    3072:XUcjvG8rMdcXmNRSSSOx3wfiyHlXBuFy/dEBjLFbAWd:lrXmNRgFXBTQF

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0e9ab75e1baec0bc2a9f9bffd16ddb12_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4424
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb171146f8,0x7ffb17114708,0x7ffb17114718
      2⤵
        PID:4172
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,5589000786672022448,3737734281174468639,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
        2⤵
          PID:948
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,5589000786672022448,3737734281174468639,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:928
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,5589000786672022448,3737734281174468639,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
          2⤵
            PID:2992
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5589000786672022448,3737734281174468639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
            2⤵
              PID:1928
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5589000786672022448,3737734281174468639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
              2⤵
                PID:1716
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5589000786672022448,3737734281174468639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
                2⤵
                  PID:832
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5589000786672022448,3737734281174468639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
                  2⤵
                    PID:2340
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,5589000786672022448,3737734281174468639,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
                    2⤵
                      PID:3964
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,5589000786672022448,3737734281174468639,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3048 /prefetch:2
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3720
                  • C:\Windows\System32\CompPkgSrv.exe
                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                    1⤵
                      PID:4072
                    • C:\Windows\System32\CompPkgSrv.exe
                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                      1⤵
                        PID:484

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                        Filesize

                        152B

                        MD5

                        dabfafd78687947a9de64dd5b776d25f

                        SHA1

                        16084c74980dbad713f9d332091985808b436dea

                        SHA256

                        c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

                        SHA512

                        dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                        Filesize

                        152B

                        MD5

                        c39b3aa574c0c938c80eb263bb450311

                        SHA1

                        f4d11275b63f4f906be7a55ec6ca050c62c18c88

                        SHA256

                        66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

                        SHA512

                        eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        96B

                        MD5

                        f14d490c4a189ccf9c8ba803ef835bdb

                        SHA1

                        696ccf7368f54e72415cdbc00443c5ba004b9c9f

                        SHA256

                        1bb41d44292e1b9d19108a5de88ed06f7a5b76b9530fa3e52f9c8692cc5b9477

                        SHA512

                        35ed9003eae16640a25e658dbee5d8bb38640c99fdc920bd406280387d94f5ad70836444d6340de4cb0313d888a1672e3ed841d630aa6318886daae6b1e5557d

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        acc3a935b48bcd4ebe76d23b0a539f6e

                        SHA1

                        4863109b0639d41686ea55ebfde8eb3fe1560768

                        SHA256

                        7b993733f1b242f6efe5e180b874237a202c2d5b819a69ddc61a3de406f55305

                        SHA512

                        4a87814c2542e83d5a9fb59a2f766ffa55ce5d74f82c386a342368020f19bbdacfc4ea01b46a18874a4df9e2a3b80f9f586b61455321913aca1d14b1b1c969b3

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                        Filesize

                        5KB

                        MD5

                        70daee24446555588e6fe557d92dfc31

                        SHA1

                        6f8c6de21b4d6197648f455e4b3814915f6208d1

                        SHA256

                        12e1e48718ea9edda08efae742ea729bdec319b8db343fba4447c6c67993f1c6

                        SHA512

                        12c5081dbafffc268874dde921bce969aed79c514ea2a0bbe9175cef5b9c266053ffb05ca888cae57a7a209ad9187b4409f5a4c7ab2041699d91175d6faa8735

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        b679793c5180efb337cb3db004664115

                        SHA1

                        2fa8417295802e5baf8422b54c8afe8104f695b3

                        SHA256

                        0b8d8f36d1d8d3010aebfc9cd43239e0b30a4d36f39207c94c79988198d727f9

                        SHA512

                        a53419148aaa643f8d47445d080e18b4c86d575d652d3442bb12a1235958d10d51602373d85fe046ed529046b8abc215bd6d988f9a035402f8fe78569932189d

                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                        Filesize

                        11KB

                        MD5

                        eb9a725749b727305a3076da198800e6

                        SHA1

                        5d2ebf9a27352b05441fb89c0709b98fef4eb0e2

                        SHA256

                        b089437f3868cbdfc39e069abd36ee5092be66dc3b36ef01e05a4d44d1dfe966

                        SHA512

                        c84069e9e07a1c685e012ad2bad44d2f4c55ffac7ffbe0be87deb73caa5b8e63cb81bb5822751c9435d03d7e5bccee2e81905bd66288d918da88321113ce6f32