Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/07/2024, 18:35

General

  • Target

    2d658e5b73da2fc484c9a740a33bbb73_JaffaCakes118.html

  • Size

    131KB

  • MD5

    2d658e5b73da2fc484c9a740a33bbb73

  • SHA1

    afdee833372d9c0ef347df42904ec262862e74d0

  • SHA256

    f3074466f0935b0ea3e3ac2a35a0858ea032b490f2aae69a12023b4dbc83a85f

  • SHA512

    c0fb1e2fe9c8e29a1d95a9ee3fa3a47a125216ecf477a27e52893976ae2609a0f3d20d6df49813c58ef717671bab2dc0f1e925270d281fd435b162d6dd703742

  • SSDEEP

    3072:DqLwvRZzSG3eGza5krCO0/V/8rnOL55ShutTmdzSmO20TdtFdnRLcV22wOoS/0IT:DqLaRZWr5krCO0/V/8rnOL55ShutT0SO

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2d658e5b73da2fc484c9a740a33bbb73_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5008
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe7ed46f8,0x7fffe7ed4708,0x7fffe7ed4718
      2⤵
        PID:4408
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
        2⤵
          PID:4884
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:556
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
          2⤵
            PID:3556
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
            2⤵
              PID:2984
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
              2⤵
                PID:3488
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
                2⤵
                  PID:4612
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1720 /prefetch:1
                  2⤵
                    PID:1792
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1428 /prefetch:1
                    2⤵
                      PID:3128
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
                      2⤵
                        PID:2980
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:808
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
                        2⤵
                          PID:2716
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
                          2⤵
                            PID:2340
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,7622627555584792310,16170898703626883126,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6084 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4208
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:2052
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:4668

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              e81c757cdb64c4fd5c91e6ade1a16308

                              SHA1

                              19dc7ff5e8551a2b08874131d962b697bb84ad9b

                              SHA256

                              82141d451d07bdb68991f33c59129214dd6d3d10158aeb7a1dc81efbc5fb12b3

                              SHA512

                              ba8de0b3b04fec5a96d361459dde0941b1b70f5be231fdec94806efa3ecf1e8faf8e27b1800fa606dc4a82e29d4cf5109b94109e5ad242ddf9f4671e2acbcfbd

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              2e57ec8bd99545e47a55d581964d0549

                              SHA1

                              bd7055ea7df7696298a94dedfc91136e3b530db8

                              SHA256

                              a50ba35608edc2f3360cc71be0d4b29bba0e3382d1f08f24df5322ce2ad2443c

                              SHA512

                              6b9b73d983c472149629c842e16e4f7c2f8a0a3bb6dd64837ef647db810ef1beb3a02b15dc1eec2c5de8aee6b3ca195c7d26c432705061c5b0ec7841a5bbf106

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

                              Filesize

                              21KB

                              MD5

                              549baced2c151db8a02c3419aa5c01be

                              SHA1

                              1f36a9716da201c5e45c1cc23c349bbaae44a3c9

                              SHA256

                              11938f83bd463e29316808f3e118440f718f1c7a0761bc860171255a96cbefca

                              SHA512

                              12c40a66af58d9436d7c3361de906077402cfeded97361c81d9900d69d405b5ab002ac36aad3f8152c6083e00755442bd1bcd1766af26c097638051dfe1aa9d0

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

                              Filesize

                              45KB

                              MD5

                              94019c00785285cd78d6da8a1bdeaf80

                              SHA1

                              33ba11bbe8c91eca17a84c3dcae4667638a61b57

                              SHA256

                              2ea5a487d117c082ab04c8b2d979adc04c18f496af90ef2caf9910d9902ef8a9

                              SHA512

                              b58d23d9333290e203ee3191cbcca4686ae1f9b4c135ee8a8e0f014e7db4efdcffe6aa82b502b2d8e63bde705895a04726d799a4c6b0e22783b6925b4d297d70

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              144B

                              MD5

                              f887df65a3675344174544fbed704c07

                              SHA1

                              726d6563ae033e55e6aaff172ffa2a347708d06d

                              SHA256

                              93322ec2f95aef9e0ea3486589b80b4d16e90d4aa89bfcc31df37721e1eb3bce

                              SHA512

                              9acbc169c0f776b740ef1800d3b45888699656b54ed741d81e60f219a67d5f55a04f5d7d4928314c63e53e73f565597e7aad42e9da79f37a4c2b1305d939bbdf

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              2KB

                              MD5

                              4a21a6d58ee7ee87e638d1d3e1dd7bad

                              SHA1

                              c44935f647d0415e7b4ccc666248fb436f323418

                              SHA256

                              b422a04db6b62a73f404319b3e509b5f763735c30692892ec70a260929fe468c

                              SHA512

                              737cc6855c531fb6d76defa2710669b77eb61c3dd81cb1ccf206605cb1e3331abef7853f7cfca25b0fc6fa27d0dcc45247f652ded3b96f1b99046c09b78703be

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              2KB

                              MD5

                              e7020f394b821137772d6541245428ca

                              SHA1

                              cef1eb2fbdafee9d4d89c84b2c92e2a818007f1c

                              SHA256

                              c4eab851734073f481b84876f6cdeeb67f5c0fb14e81976b4e6d6babda9b207b

                              SHA512

                              bef13f1190659143a745649d396accdf65fdefe23241fdd4aeafb054f3705f7075de9f1adc95e808185e9ed48c3aa7dda005abaf4a824272c6c38dcbf1d7d7ac

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              7419a1e3088f67858d04f7b96b36a3a3

                              SHA1

                              a9a69827546fefae129a91604513c0d73b7b5adb

                              SHA256

                              2a899b7a21142dcf358f672bf66e995748e1078debe5db8ff84cc027f56f8ebc

                              SHA512

                              addb5ca93e116c84b119790424476d03d8115f2427d057f1a4e00b17a65ae78e54cf04a80d95288237ec30dffa726a40cdc418e49ce2fc04521e9dae77f5ec1a

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              7KB

                              MD5

                              aa5c7fde7221487e11dccb81d545b302

                              SHA1

                              a7d61a70b43d4ba3655669025622ec9e4fbe1568

                              SHA256

                              2ef106b4b22474bc6323df5cbc932d7518c2f7830f7f0c592f80adbca717a587

                              SHA512

                              4d2a1d9fe05b3b3258cd6fd3f6f40611eeec49b85bf70ffa9b45aa13255a4649062205e26b9eadc7b27cbdbebe206893689203d8d24369fcfc29ab4001278c8f

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              a9523dd654dc6c2552b7b1053874aa31

                              SHA1

                              54d74a6505cb6b65bacbe623c388dd26aaf22177

                              SHA256

                              d52b79ebc86f44a6e81bf981e71ddecc8b3f461a817ffcf654c9877321c31b80

                              SHA512

                              2e912ee663ad8dbdfc80e6a1ee4e876f09043831bfc313f5b33f03a1a38f8e76f261050421d61807b52352a227aeb69aebb82d6ab9ecf88b84253f75441e3657

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              7KB

                              MD5

                              f159990aa92fced23f2ac06691bd2c58

                              SHA1

                              4bff1bf71426b368569df82c59097e8430bd8f37

                              SHA256

                              6e776c46abe14c9578f6b6b782600fbd00dfdebac266559cf938a0437dfd2607

                              SHA512

                              4d73566d298d2e04588425c8a2402bf48c25e1caa15dad39b5fc6f5073dd94a0de7a9d697d6c5240b413f2e3162321270a35a7d5bb125d536596c6bd52f31d50

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              370B

                              MD5

                              51d04326f8f40fdcc2af4bc0700da6c6

                              SHA1

                              64736f2dac0e16219accf4ddf51bd92ec7905c0d

                              SHA256

                              3253b8c085a5e8e84b11b2b91bb1c6c7c99cc8bf1e8eeff379a1677d1c3f36c6

                              SHA512

                              021339de355d24d122f29e17af0768b4b0eb301755cf5519172f2db7b2ca3c28dc2d0d5694cfb3bcbc2b4280ec3528541e353ca690db19207565d176e180e8ff

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d7cd.TMP

                              Filesize

                              203B

                              MD5

                              bb5372951d8d931788b9035cc98ca6bc

                              SHA1

                              b2c2d162f93f09c15785aa9045ea39aa5e5521f7

                              SHA256

                              5bcbeada0f17cbbce8cc3937f94991ff371311b1f833b8b26800a5a1ad5dac79

                              SHA512

                              6d3a9d2571cab8e5798f72f561ff5237f0a8945f618906e95d7edf415bf0ac2fc118679d1e929658d8ef01a5f00ff45cfff783a515310ee03362f8d5f9fc9a17

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              206702161f94c5cd39fadd03f4014d98

                              SHA1

                              bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                              SHA256

                              1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                              SHA512

                              0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              46295cac801e5d4857d09837238a6394

                              SHA1

                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                              SHA256

                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                              SHA512

                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              11KB

                              MD5

                              34fbd9a2617141298ebb8ed92427ce8d

                              SHA1

                              9cbf5a9443fd48313c637a4b968193a4234f598f

                              SHA256

                              13eb1f81be408dbfc46c3fcd03bbc07ecb944d8ff89cc850f5a8452ec1786537

                              SHA512

                              fbb2451032349fad0529726d30aed8d603726f1976b9a20df759661ff3b1189dda8230cddb0d460453ee4bcbfb89e9885f66d0c78a46217b065e4c0012d624ef