Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240910-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/09/2024, 13:55

General

  • Target

    f6280ef2a2513e0c0a376710dfcc63a4_JaffaCakes118.html

  • Size

    137KB

  • MD5

    f6280ef2a2513e0c0a376710dfcc63a4

  • SHA1

    2bd712d7b4c33cf1807ecd919c1e512d728ca342

  • SHA256

    5486a9e9bbe3781c5f13be9178c1315a2d56c2c2541b3adf24e7b668e1d1e63a

  • SHA512

    b5676a920d73eae2dc46ebafc6223d77a522d7dec6d396cba85f1b60090c934de96c38abc4b37b4abbfc1c7916b3d3de6d82475b69bdd586b2d8f594775efda4

  • SSDEEP

    3072:f+ZIw1fPuQj4x+6W2QU88zuHHWay6DW4K3bG2:WZIwVPuQNH2aO

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f6280ef2a2513e0c0a376710dfcc63a4_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2308
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7e6f46f8,0x7ffa7e6f4708,0x7ffa7e6f4718
      2⤵
        PID:908
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,17611454207998660710,12958762249569953204,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
        2⤵
          PID:4404
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,17611454207998660710,12958762249569953204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2584 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4440
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,17611454207998660710,12958762249569953204,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
          2⤵
            PID:1544
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17611454207998660710,12958762249569953204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
            2⤵
              PID:4796
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17611454207998660710,12958762249569953204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
              2⤵
                PID:4316
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,17611454207998660710,12958762249569953204,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1308 /prefetch:2
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:4548
            • C:\Windows\System32\CompPkgSrv.exe
              C:\Windows\System32\CompPkgSrv.exe -Embedding
              1⤵
                PID:3900
              • C:\Windows\System32\CompPkgSrv.exe
                C:\Windows\System32\CompPkgSrv.exe -Embedding
                1⤵
                  PID:2576

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                  Filesize

                  152B

                  MD5

                  7006aacd11b992cd29fca21e619e86ea

                  SHA1

                  f224b726a114d4c73d7379236739d5fbb8e7f7b7

                  SHA256

                  3c434b96841d5a0fa0a04a6b503c3c4d46f1c4e3a1be77853175e5680e182814

                  SHA512

                  6de169882c0e01217c4ca01f6ead8e5ebb316a77558e51cd862532dbf9147d9e267f8db667ff6e9fa33164243724f5e437cb882392382f3cae1072dadb762c1d

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                  Filesize

                  152B

                  MD5

                  b80cf20d9e8cf6a579981bfaab1bdce2

                  SHA1

                  171a886be3a882bd04206295ce7f1db5b8b7035e

                  SHA256

                  10d995b136b604440ac4033b2222543975779068a321d7bddf675d0cb2a4c2b1

                  SHA512

                  0233b34866be1afd214a1c8a9dcf8328d16246b3a5ef142295333547b4cfdc787c8627439a2ca03c20cb49107f7428d39696143b71f56b7f1f05029b3a14376a

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                  Filesize

                  111B

                  MD5

                  285252a2f6327d41eab203dc2f402c67

                  SHA1

                  acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                  SHA256

                  5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                  SHA512

                  11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                  Filesize

                  2KB

                  MD5

                  0aaf5c5ac721c28d6a75fb4549cea721

                  SHA1

                  e83008539ee597dba78ce38070d838c2a427273f

                  SHA256

                  55e19a57ab35593540a2d42837a20ba3f8f3285ddef5e696672a927127812db2

                  SHA512

                  1dad08aa2ba67c4a855d40b50937e3ba502db582747546ef60b92d707ceb2ec4779a29033a8f917990508bab662c7c979e5979eb82eccd4d247339e997e275d3

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                  Filesize

                  5KB

                  MD5

                  ece41c308cf3ce3da757357eede89d46

                  SHA1

                  36502f621f9b638c9730a2a563c8e5c24a3fac34

                  SHA256

                  7352391d1bfbd2c8e46814c49679c053aeb7e9667abd986f7213f8a76e144b85

                  SHA512

                  b2b6a53fcde9630c2d28a70255c49b0695c720bd5f7013e3b5b1aeeffeea6bfb0ed771b6ad50a70b9e467ba838dc4d76184e0f7df46f38923244b4c26fedaefe

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                  Filesize

                  6KB

                  MD5

                  e543c4015a00c60589265b65c687383a

                  SHA1

                  a8af1bffe50b13d2bca0611a708715415841251d

                  SHA256

                  4d5411e3533fbae1e10d9bd7a6605123adeaf0dc875603a3448d56edb6b02cd1

                  SHA512

                  c8f667e9bddf13356e7af60d302d3fe77bd2979e0308c0c2394bfb0c61bf3ea8fc4bbdf9f31a141ebc1a54e8091e5d47b8a30dc25ed6182e182e1cfef95a9a65

                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                  Filesize

                  10KB

                  MD5

                  cda5f43f69cafecc2cf9210a93c4d140

                  SHA1

                  5300dfcf7d53e49d1b73643cb13695bb88bd0b2c

                  SHA256

                  79f7f45008a379b876fa701e783c817c10d7888f489fc94007673e7115a4cc4b

                  SHA512

                  1a3c8f5b82cee3a1ce96a24facde33a7d3be04305268500401cb9ce2bdc182cb98eb7bc5e0d12b514645e5975753ce5ce94fdd2e250241682923ce4b19dafca2