Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/09/2024, 22:51

General

  • Target

    d2ff79689ece245a1af1cf45f7b5a54d_JaffaCakes118.html

  • Size

    2.8MB

  • MD5

    d2ff79689ece245a1af1cf45f7b5a54d

  • SHA1

    b4737359a4412b852514b8c8d3caf9d0016a33de

  • SHA256

    b066f1cfeb6173bb043db359c94ea68e19bdd1515cb35df19f240fc51646d59d

  • SHA512

    66858db69dd1d6f12639a353455d01327d128e3ccf1451a9488e67b974c88b7c3235735d45bf335f5195121185b543253a65f4ce7bc90aa58b4412c6b50c57c0

  • SSDEEP

    24576:bUSaQ4MbY77bJSKikgZSADswi1JHeIodVdz1Eu9M4qPzy1:bU/Qo7bIBZSQswi1JbodVdzSVzy1

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d2ff79689ece245a1af1cf45f7b5a54d_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2656
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8964d46f8,0x7ff8964d4708,0x7ff8964d4718
      2⤵
        PID:3572
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,10144962748724928736,1537533812100041760,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
        2⤵
          PID:3264
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,10144962748724928736,1537533812100041760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:840
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,10144962748724928736,1537533812100041760,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
          2⤵
            PID:3204
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10144962748724928736,1537533812100041760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
            2⤵
              PID:4496
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10144962748724928736,1537533812100041760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
              2⤵
                PID:972
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10144962748724928736,1537533812100041760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
                2⤵
                  PID:1672
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10144962748724928736,1537533812100041760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
                  2⤵
                    PID:2200
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10144962748724928736,1537533812100041760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
                    2⤵
                      PID:3168
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10144962748724928736,1537533812100041760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
                      2⤵
                        PID:2964
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10144962748724928736,1537533812100041760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
                        2⤵
                          PID:2440
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,10144962748724928736,1537533812100041760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6744 /prefetch:8
                          2⤵
                            PID:2376
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2012,10144962748724928736,1537533812100041760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6744 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1648
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10144962748724928736,1537533812100041760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
                            2⤵
                              PID:3960
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10144962748724928736,1537533812100041760,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
                              2⤵
                                PID:3348
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10144962748724928736,1537533812100041760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
                                2⤵
                                  PID:1480
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,10144962748724928736,1537533812100041760,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
                                  2⤵
                                    PID:4832
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,10144962748724928736,1537533812100041760,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4808 /prefetch:2
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4088
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:1400
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:2328

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      ff63763eedb406987ced076e36ec9acf

                                      SHA1

                                      16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

                                      SHA256

                                      8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

                                      SHA512

                                      ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      2783c40400a8912a79cfd383da731086

                                      SHA1

                                      001a131fe399c30973089e18358818090ca81789

                                      SHA256

                                      331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

                                      SHA512

                                      b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      144B

                                      MD5

                                      26ff9d2c5ee9c7ab5cea28445a22eaba

                                      SHA1

                                      bd4055e1e98663d310bb47ad48731a45be41b0c2

                                      SHA256

                                      4c624cd6b2fe0847e63fc05b93835275e890098f09b0a01c94df752b8208383d

                                      SHA512

                                      edd19fa299c401e11dceb8a769191f1e1b85226ebeeeaa51666a622b4590f3753b08e3b38e3811291973f56d32ed3ac6ab406a24488d967eee621df2930f8efa

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      168B

                                      MD5

                                      42274ea4b83428aa1b7ebe6f3b5ba035

                                      SHA1

                                      da88c1185d3c1526328a5471179c68cfc0f6234d

                                      SHA256

                                      e2d3f58105cc7f39b69e5655f09c18a027fdb6d83697bc8e543cbf75e28753b4

                                      SHA512

                                      1fea356b4ac294554fa7277e743710ab49a8b4e65a3a6e26f1c82e300a567bc312edea295fd87cd218bbb129d380a51a640540a092f2bb606e336ea994712dd0

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      1KB

                                      MD5

                                      f7f8f8bbec278877ceea0a54903b3774

                                      SHA1

                                      89dedbef7e967f1332c1a8ff003d8c803db43f3b

                                      SHA256

                                      37cc46df21e7b28870a7ce6b46826b8641bf075018d5ee0ae9a76257ddb6507f

                                      SHA512

                                      56971ee0a65ccae14af500348343816a77db3aadeb1c8ab8b3b3de30e8a5a5142926abf456a85bc4b5fddbe3dd7a9f52d5929a9bfffe01b55a27e0a20df1a608

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      111B

                                      MD5

                                      807419ca9a4734feaf8d8563a003b048

                                      SHA1

                                      a723c7d60a65886ffa068711f1e900ccc85922a6

                                      SHA256

                                      aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                                      SHA512

                                      f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      7fac5fb4c670364b6b58a1f77d90734f

                                      SHA1

                                      d65950ccb0b7b9f295fd1b0a8915f4977cd6c9f5

                                      SHA256

                                      e0f40ae8b1323d2d06d2b24b84e330d03ed7671f1e5d525b207502fac6ba467c

                                      SHA512

                                      5974bd38155c52b983f9e22bf1b9489dbc3b3bb87b295b77b94261b9602834e092de1f592e40d7f5140522908fcfb9fba49bca92f9b23fcec219f4e8d0769853

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      666e8a4f30f864486c19aa94758c79a6

                                      SHA1

                                      a025b6de42906b31ada5febaa1bfb73f0e45d23b

                                      SHA256

                                      b7bcddf96c09b8498885f755d77097600cb2a07b06735f03888ebd6497147c59

                                      SHA512

                                      db8ef565704b4e2ad1bb186cbcfc6974c6032d97b604f62c7b730d981c148b45a5a09e8181556d147db82ac610a73250aaadd66152451e716e370825fb5a0acc

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      06dfa1ec84540ea7d4242ed308b63350

                                      SHA1

                                      fb9617477fd12c018e23934630519e2e09acc2a9

                                      SHA256

                                      8b2ee9043bbaaf395d9609ccdf7c7f15ebbe16d6976e9d8eed524484cd354e82

                                      SHA512

                                      cbb7570fb109dba9d33d523539934a3e8b710ea3ea22f42c82bd5fa8792b13a46ef7f7824d8917d8c68a16bea1b36c6c78b9f80d37279c95ad2fa8ef497ba01f

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      60ec45d4d16e9ae9cc694e809d0e9adc

                                      SHA1

                                      37f6d38c12575a0999c937881811bfe5a12249bb

                                      SHA256

                                      a0815fc7ff07044604008eec6b2daa132d89549a306575d14a39fd12498550c4

                                      SHA512

                                      1cbb64493871c5266f371c74a1dcb63bb5d2c32d251825537196f521b51503a5ab469cf375b00c3c1dac4aa244f584693ab22cee0ef7e19ead97921b7503a178

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      862B

                                      MD5

                                      e6c728c232fea12e42008e2213faa5fe

                                      SHA1

                                      efa2a0d08cf8a2b050de9cd31942f65841a21b34

                                      SHA256

                                      a8a26afcd32dc89fa0d4991e902e2d766f192a14d73029979b083f976a429086

                                      SHA512

                                      c424446f8f33d5b35853e233195c88253ee6d2a8501c4012389f9c3c859cff0f9c45780624b526020d6a83584f3e330ed9a7a6e2a7d62f979273d7604b9cca1f

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587c7e.TMP

                                      Filesize

                                      862B

                                      MD5

                                      0aa9b10b551169c9bd18fe544c125708

                                      SHA1

                                      81b28ba593c4411fd8b2a1b412ff9cfab3870a17

                                      SHA256

                                      d757e1d37702d99cda2aaa5c95f4e34d6d78d861a7fe46d7f003314c50e2ae8f

                                      SHA512

                                      27ca94edce392be38667602f4f3474297fdacb4f7e256e9e859c182f5f2f6be07765dd92c15553dab481ea66676a6c25c12a95722f449ae89cb9a3a18083437c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      6752a1d65b201c13b62ea44016eb221f

                                      SHA1

                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                      SHA256

                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                      SHA512

                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      10KB

                                      MD5

                                      e5a21b17811c01b2ebf1145822531dea

                                      SHA1

                                      b7afb4833d052f02ae1d590fd3be6e22e269e1ce

                                      SHA256

                                      68741d9be40c3a8001fc77699b479a91dd45fed3a4515efa90a36607ee12ce9b

                                      SHA512

                                      e8f77b2221e4e56d1dc08ae772aa0f222b4768a8073c43146ba7f59a9aae24b8a88466af11ed4b4a77d750e12c5d50b8bf64daaf6c553b23c1fa29021f99f6d8