Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/09/2024, 21:35

General

  • Target

    d2e2a1dacfd8688c31ebd561f544b063_JaffaCakes118.html

  • Size

    46KB

  • MD5

    d2e2a1dacfd8688c31ebd561f544b063

  • SHA1

    2a2d7ba42da0658c1d3f05ca95beb4b84c2dba4f

  • SHA256

    5f7ad4d5b26c939065f39d4fcdea457860de7fe8a4c0a0a6290824431cbb55d2

  • SHA512

    7923e2cb3f97b690bd32ac19180b33861d84cde9021f08f14567e82771f9a807277328dcbba4b51c591ce725b3146380c1d76148d7b6f31a3360686eb6d9375a

  • SSDEEP

    768:PYruvWWl+WFGWXAIaAC1Nnh914eIaedgeP+4tReD2qHLlZ5z0i5ljeOK1fa7Yt9c:GuvWWlSWQIaAkNnhb4eIaedgePqv5ljZ

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d2e2a1dacfd8688c31ebd561f544b063_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3972
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff974b546f8,0x7ff974b54708,0x7ff974b54718
      2⤵
        PID:4036
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
        2⤵
          PID:2044
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1960
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2476 /prefetch:8
          2⤵
            PID:2564
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
            2⤵
              PID:5060
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
              2⤵
                PID:3820
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
                2⤵
                  PID:4924
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
                  2⤵
                    PID:4484
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1652
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2864 /prefetch:1
                    2⤵
                      PID:1028
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:1
                      2⤵
                        PID:4220
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2008 /prefetch:1
                        2⤵
                          PID:2680
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
                          2⤵
                            PID:5100
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,17371466708129163666,10196100249857716728,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6080 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3836
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:2704
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:1076

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              f9664c896e19205022c094d725f820b6

                              SHA1

                              f8f1baf648df755ba64b412d512446baf88c0184

                              SHA256

                              7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

                              SHA512

                              3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              847d47008dbea51cb1732d54861ba9c9

                              SHA1

                              f2099242027dccb88d6f05760b57f7c89d926c0d

                              SHA256

                              10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

                              SHA512

                              bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              96B

                              MD5

                              d2124139fab75c067770275e299fbab0

                              SHA1

                              d058af90dcee214862fde6a202a5e8476b48afb2

                              SHA256

                              4ab8a941abdde697f9962d96db33809270cccb9ec068e1f82cd557dad69be601

                              SHA512

                              e3661f1a64907ab449b2be96658c00456e2fb08a67176b342606e609b3716471a98c12f86caca2c96d9e86a9d8e59cf11244e6a824373651411fde684b3a67d9

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              709B

                              MD5

                              bbd62636780046b2f485b26d44a01a69

                              SHA1

                              e4df44a17784d906026e7426955258716493a708

                              SHA256

                              a462a622596c3b133a6cfd7ad240e297e7dd7734416d4ed7783b0228e08a7bb0

                              SHA512

                              031cfc0682359dcb598d292e9c89ddbdac2257b494703169aafbb218d20d967d72c7c102593b14a86fe6e1b1c5c253914a0a41de342e5c4bb057c06b2c99ccd7

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              2c9661527f88427596260cef0730be59

                              SHA1

                              205fbf73535f564d973b7cfa58ffb420676622f0

                              SHA256

                              37f1044bfa8acdb8202d1ccd59d6c521ded9e7d2a73cfeec21b45ac86d77e126

                              SHA512

                              bc83024b90bfb5773687a34a6c86b48d38468eabed6ff182c511dd0c62a0992e2be41868c42838590b27a9436228364fcf8b63fda5b877c6be0169ae8962595e

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              44c82bf2667033927657604a1f9e0b87

                              SHA1

                              4822c43edf08d1542c815ed8d705f2ef040253f1

                              SHA256

                              75c1d9d2d9912118b3fa3e0077b1af726201b6098225d50131a156ff3d688f18

                              SHA512

                              ac1186b3e68bd9fafa7574e8109c8cd60427d3c4d199df613eb9cb851bb2525f420afb0eeb706464ca145963cb4105c2ebc5e20f9f0c0ee5f7d24dd1f151bcd0

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              5136e75a45e20a7f424ddaacb7d39b52

                              SHA1

                              ed94e72cc2fe111660e2ec9eed04ca6fb1004cf0

                              SHA256

                              5707c5751432a4743c9a6070145d73f54c8b54b001f087afdfa5b53670510159

                              SHA512

                              cb48fb8ffa0cc100fa833349a9c09863366a8a57aea9b3ba303b1a44660243053a31780159c7c3a8d7b83c4cbb646352bf24a45733fa2e3ce33750d88f2ce60e

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              540B

                              MD5

                              8f87642dd19f6f0198994f2b966d34d5

                              SHA1

                              b569c4d304408adb019891d790ecc8b53da671c9

                              SHA256

                              f245dae70349921cccf518c31853a3bef4a41b59f22acde1e7c65b14cd73a59f

                              SHA512

                              fde18b364e026a34c5f4c3489735d14a4872bda621dda3725f4f99c4171795558e01196c6d55e788d203f8a95a97364a7ebd438319bc41cc84cd90e44ff5915b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586e74.TMP

                              Filesize

                              540B

                              MD5

                              4d04005c32c5d224741f137196a5420e

                              SHA1

                              334bd18aa6a72a986240db248b4c1df7eef53c4f

                              SHA256

                              9352eb9dd201da8ee167a8f40cac23200955cf14954ffc5142d35f958c9f1e37

                              SHA512

                              04f0e5c408d42af9105407c20ed74e0a32f5b42cf92807d2d1784c9c72dc9e4a8f044a147ab99d3d23ce7b312c85e67b651373690418c2ae89afa785a95e62e2

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              10KB

                              MD5

                              72ee9aee81bbeeaa7b177542c4affee9

                              SHA1

                              fa80fef180b31c8a97c2985aa3eb934b70fdc72a

                              SHA256

                              e6e46bd58ef1de7dba9e2c79b7bc98d065be5b9a71243b9c7bcfa2de104dab7c

                              SHA512

                              92d5957c65904ca5532cf4d1eaa2ab0807c403fb3ce3d988d1d3e428e1ce8741656ce19c2eb74bc3739dd120f5ebe846cce5e50ff1ad3f0da06ba310bebd574d