Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240910-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/09/2024, 06:44

General

  • Target

    dc01daffb524955f1540931f30b4255e_JaffaCakes118.html

  • Size

    74KB

  • MD5

    dc01daffb524955f1540931f30b4255e

  • SHA1

    55cfd433d1ed531825013a78934a0838f3794ca5

  • SHA256

    41b38b44eebba219296522dbcd93f19936d84b55a4677a863f5c3c4067c1116c

  • SHA512

    1867a4dcf00e63f3bcddd5d692b3d3c34a7317c55352355193b095528487ff29d6eeb2f739b61726f35c551337cf3340e4d846f0b8d6b01e1201edee0a1b81fe

  • SSDEEP

    768:X5t76EJjFDAxIAXfRDP5BQuCax7178pUaFD+8zIjwOkDchN28+rTv/icsEic:X5NpAxXfVBBLCy17mj4jhhN2Vvv/i5EF

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dc01daffb524955f1540931f30b4255e_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2504
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9eb2046f8,0x7ff9eb204708,0x7ff9eb204718
      2⤵
        PID:2644
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,16758675266050816386,8217245052374064513,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
        2⤵
          PID:1068
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,16758675266050816386,8217245052374064513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4848
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,16758675266050816386,8217245052374064513,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
          2⤵
            PID:3676
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16758675266050816386,8217245052374064513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
            2⤵
              PID:3592
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16758675266050816386,8217245052374064513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
              2⤵
                PID:5096
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2100,16758675266050816386,8217245052374064513,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2840 /prefetch:8
                2⤵
                  PID:4992
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16758675266050816386,8217245052374064513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1800 /prefetch:1
                  2⤵
                    PID:1400
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16758675266050816386,8217245052374064513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1888 /prefetch:1
                    2⤵
                      PID:3536
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,16758675266050816386,8217245052374064513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6124 /prefetch:8
                      2⤵
                        PID:460
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,16758675266050816386,8217245052374064513,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6124 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4304
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16758675266050816386,8217245052374064513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
                        2⤵
                          PID:2336
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16758675266050816386,8217245052374064513,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
                          2⤵
                            PID:2072
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16758675266050816386,8217245052374064513,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
                            2⤵
                              PID:5104
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16758675266050816386,8217245052374064513,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
                              2⤵
                                PID:5092
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,16758675266050816386,8217245052374064513,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4832 /prefetch:2
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4700
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:4252
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:2136
                                • C:\Windows\system32\AUDIODG.EXE
                                  C:\Windows\system32\AUDIODG.EXE 0x2f8 0x4a4
                                  1⤵
                                    PID:3312
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:2336

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      7006aacd11b992cd29fca21e619e86ea

                                      SHA1

                                      f224b726a114d4c73d7379236739d5fbb8e7f7b7

                                      SHA256

                                      3c434b96841d5a0fa0a04a6b503c3c4d46f1c4e3a1be77853175e5680e182814

                                      SHA512

                                      6de169882c0e01217c4ca01f6ead8e5ebb316a77558e51cd862532dbf9147d9e267f8db667ff6e9fa33164243724f5e437cb882392382f3cae1072dadb762c1d

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      b80cf20d9e8cf6a579981bfaab1bdce2

                                      SHA1

                                      171a886be3a882bd04206295ce7f1db5b8b7035e

                                      SHA256

                                      10d995b136b604440ac4033b2222543975779068a321d7bddf675d0cb2a4c2b1

                                      SHA512

                                      0233b34866be1afd214a1c8a9dcf8328d16246b3a5ef142295333547b4cfdc787c8627439a2ca03c20cb49107f7428d39696143b71f56b7f1f05029b3a14376a

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      216B

                                      MD5

                                      2e5999e28f0bc63967928c1f80b9a2aa

                                      SHA1

                                      e3adac76eb790dca219eff669e0d50bfd32023cf

                                      SHA256

                                      e32afbfcd72d24e159199bb1380ef1a63a3b9d5d0ad2a3a842c1092bf9f99148

                                      SHA512

                                      f773b4b6a3f02a8f777d276949410faf7ace320e55694a9abdb80c327da5435a494347e912f113b1d7b7eb12ddcd9c57d0001d90f3159379f7ba6eb4b33f6ac0

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      3KB

                                      MD5

                                      c105228de74c1692023d6e44d2a98958

                                      SHA1

                                      cebc6a5a298d1f35955eec0e811c63e6b1fdbb69

                                      SHA256

                                      ae670fb33e0ad82d66e27cdb50351b232bd1299b90151f90b5d09be70556ac98

                                      SHA512

                                      584d54b46896506d51388d229a6ea64658c62aec215e38b89f8f2d74fa92b134ef122fa3e78b05d1a7b076009bb889fc24ab14a98aff1168c4893e44b4ef7e86

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      3KB

                                      MD5

                                      2b7f0efc13c47113ddbebea627d7fc35

                                      SHA1

                                      cd5f3e99d8666e6340341b8303edbe2f54802031

                                      SHA256

                                      f6e6e8977e5bd66100689b758f749474f7264e1b016edaa17d45a8049a7be920

                                      SHA512

                                      17c2153a66d9847a1e806695f9a5a6ec47f539b26ea412755a832464ae9ed52c4150e06e2c00ffb36093df9f544424d7ecf7e6390afd943c9e7f02d8c81bda82

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      ab2a1a062c3c44d5f6a044d668e55891

                                      SHA1

                                      2436cd49f54e22afdcea84579926f426656e98ac

                                      SHA256

                                      105bf0613c79d44027259d4cf8667b18a3c20130f359f41337611790835f6db5

                                      SHA512

                                      ccfd3e30be977b1e0b6c8608b219c64e79980eb6fd95cb674352c74b7fdd5d88df60600d2589da58dbf2abbb173b855978358b252206978f122b72259bfb8a86

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      fba25a112530dfc41cc057ed0140bd67

                                      SHA1

                                      c501ebd52e65dbd0814a78a5bceb3f8a75d2cbf3

                                      SHA256

                                      e5da04878720ab215d790eed9da12c57c8e28f1d7c065968bfb37ecb3b1f89c5

                                      SHA512

                                      3dd29442dca3f9e83e98ee68e0a545b7028c8b2ff2dd8783c5ce836b4c3d695d4aee40ce690193213c8f16cc13ea5c223fa9d58b2a8c0d7d1359ae721fc1b6f5

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      2KB

                                      MD5

                                      4e4ad2fc0b51f95a04db437ced56caf4

                                      SHA1

                                      eb0ea086e8b02dcb7a218958a0f1ef97b583e0ca

                                      SHA256

                                      858468a8a4a6e15173a49617509e7d07a3ec1437802ff737b33d00f341b48fec

                                      SHA512

                                      cf63c3427e3fe8e6ceec7c0e935ff3a1581d333af2b1b35842d027a15a39d2f85c12cb400ba24a20304f681fde3d2b9ac20db1ca4f518755adb3ab3ba693b0a5

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      2KB

                                      MD5

                                      f3efa44e2202288de7511948e9ce4e69

                                      SHA1

                                      229e160a6fdd5d0ee4ef5292404709a9784ae9b2

                                      SHA256

                                      8284a6e5a819dc45b9fcca74fbdc9dbed8fb9d796d84698a3f513c835a699853

                                      SHA512

                                      4662267ac2705d23afc4b61d2337b0dd8dad72a23d72695194f548fafe0d989fad736bed96eadaa05b85e5af9f051ddfa591497d22b2a3d9c387d61ddbdc080d

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585927.TMP

                                      Filesize

                                      1KB

                                      MD5

                                      7a0be7f83b5d73d74ee268b6eec4efa7

                                      SHA1

                                      d4013614a5918b3b788694a50ba550cd3cc8df3a

                                      SHA256

                                      419b25b44da3f6e9f87b482129c72ade042bc4a2dd6fb3a97c223cc401ee17ff

                                      SHA512

                                      d68ef28ee29788659e2c99ed79e2d686505e0e3cf6133f67ff380e86a67cedae1690a0dc3158fb6498fcc66d5775091504c071ae926245aa81c971998ccc7d0f

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      46295cac801e5d4857d09837238a6394

                                      SHA1

                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                      SHA256

                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                      SHA512

                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      206702161f94c5cd39fadd03f4014d98

                                      SHA1

                                      bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                      SHA256

                                      1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                      SHA512

                                      0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      10KB

                                      MD5

                                      0e0eff080527bd2dd4262d31cef2d79c

                                      SHA1

                                      bc4e81917e43dca82306a960df2c3f23c3de74c7

                                      SHA256

                                      76eb78cd7c1b9db95e94e215b72552e016e52001de56d675c92dc115e5014617

                                      SHA512

                                      893bded1a5e24fe8dde6795f4c74f3af35e6c182743b9ca05b466411dc189b1dc636adc294c826c8574b8723c9f021368ac32d13d1c3e8afb9d7e7ac2ec2ef4a