Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/06/2024, 04:07

General

  • Target

    149f354af47e620ff92fce8f70a4e2d2_JaffaCakes118.html

  • Size

    19KB

  • MD5

    149f354af47e620ff92fce8f70a4e2d2

  • SHA1

    a0ca37966cf90467050f53c5e9cd96ac604c8a70

  • SHA256

    5aac23352bca61132ebf34bb070adf9ce5eb548a20df78afe297a8e4708099b9

  • SHA512

    c85e64cfa9666da1668a94c08b5a7399e22f2d434bdc032517675431bae70c57175873c33a7c8cfb27cdd80db20b9d182b4551c94d0263022f067d8126627336

  • SSDEEP

    384:HY7u6lKvo0lAtsdg6KrIaYj/aITHoZllFca+iYI8L:3lMtkSvuL

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\149f354af47e620ff92fce8f70a4e2d2_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2884
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a47946f8,0x7ff8a4794708,0x7ff8a4794718
      2⤵
        PID:3824
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,1578583779448492344,12473217516738323100,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:2
        2⤵
          PID:3368
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,1578583779448492344,12473217516738323100,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3956
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,1578583779448492344,12473217516738323100,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2484 /prefetch:8
          2⤵
            PID:4624
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1578583779448492344,12473217516738323100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
            2⤵
              PID:4984
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1578583779448492344,12473217516738323100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
              2⤵
                PID:1404
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1578583779448492344,12473217516738323100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
                2⤵
                  PID:4604
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,1578583779448492344,12473217516738323100,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
                  2⤵
                    PID:4928
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,1578583779448492344,12473217516738323100,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5372 /prefetch:2
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:412
                • C:\Windows\System32\CompPkgSrv.exe
                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                  1⤵
                    PID:3288
                  • C:\Windows\System32\CompPkgSrv.exe
                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                    1⤵
                      PID:3724

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                      Filesize

                      152B

                      MD5

                      a8e767fd33edd97d306efb6905f93252

                      SHA1

                      a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

                      SHA256

                      c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

                      SHA512

                      07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                      Filesize

                      152B

                      MD5

                      439b5e04ca18c7fb02cf406e6eb24167

                      SHA1

                      e0c5bb6216903934726e3570b7d63295b9d28987

                      SHA256

                      247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

                      SHA512

                      d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                      Filesize

                      120B

                      MD5

                      dcd5aa3db08753a96b4b4b3b8aa2dfa1

                      SHA1

                      bcce3d76a3cb46d9a54486536b00cb32897174ed

                      SHA256

                      51f6e9b7ccfdd12d44adddc3cec83d474de979006783fa3acf35026b9e5861d5

                      SHA512

                      dce05c1601a219f7e46242826a239997d9d3d0c742ef10dc46c9c4da05a2fe2f4a5b2fcb5933f5840ccf067b82f6ad8c387a0e84b4e1a88b00595a4b4a419fba

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                      Filesize

                      111B

                      MD5

                      807419ca9a4734feaf8d8563a003b048

                      SHA1

                      a723c7d60a65886ffa068711f1e900ccc85922a6

                      SHA256

                      aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                      SHA512

                      f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                      Filesize

                      111B

                      MD5

                      285252a2f6327d41eab203dc2f402c67

                      SHA1

                      acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                      SHA256

                      5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                      SHA512

                      11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                      Filesize

                      408B

                      MD5

                      7c86a817a3e54854596f78da9cfae40b

                      SHA1

                      25f4739037993a67b46a53e7ba7b1ae4b37f57c7

                      SHA256

                      7200d3235d085b23368834b50e326008f6b2321d2810d702ed6406b1242f605f

                      SHA512

                      09429ae2d10a18acb1956f7d060c5c846ddced4456c66ad2fc915fd70672d56cc1e78f07d0420d5daa3e9f21c9dc0d9cbadc33b188bfa703598b73d877deeeca

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                      Filesize

                      5KB

                      MD5

                      54be9ff266e9973625d1d282f737f904

                      SHA1

                      b5ede55a7c9fd7381ba6242c09fd3254eb0d4a64

                      SHA256

                      9b5a31bc96ef9c1336e904c196a4f8914c9430b26413cc704910a67fdf0d7b22

                      SHA512

                      3536ae53c72175d841354849b1944283733f0b24d6ce3c801c94163b8f1d3ae05af7a1dd03353a2195c4586b2e23839c67394ddb0f775a5da121a5da4f08b786

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                      Filesize

                      6KB

                      MD5

                      fb4945e622c0c452b9c99a38ec43acdc

                      SHA1

                      997f6bef1d7753712beec783480db19a7bd85110

                      SHA256

                      0030647bc481c0f597f60aa55bcc38a5244e1b0f6f421851bd547aa254ac4901

                      SHA512

                      09281984babc289d0ab0d8e9c5500d25090be6402dfc26247d382a47ff42f9a4d1eed719ab5002c02cb55f0571c37ff897ef6b00849ffe834b1e446f00110db1

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                      Filesize

                      10KB

                      MD5

                      2a3f257691b92e2c565adf6da1bdbdad

                      SHA1

                      028129d6121b0d844a1132c68668e608fc3aa9c3

                      SHA256

                      cdc57a1730200acf3a2752f4343e30d0c0675dce6fb09338f8ffce7398b18d1a

                      SHA512

                      6945e74a844b7b791afa0e7652873b5a5020bbb380feeae9c3d99f53cc02c9b628f2e78063856e689c31742b5d0fe2e97a2045d4304de556e6f84f9cb58c6ac5