Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/09/2024, 22:01

General

  • Target

    fafac6d4a2601d61a605875f47a955e8_JaffaCakes118.html

  • Size

    63KB

  • MD5

    fafac6d4a2601d61a605875f47a955e8

  • SHA1

    ecbe7dcf11e2cf6b366484fe300f68db15b6e4cc

  • SHA256

    df9e4ce03073d0fe02a2a830ff3aaa017e72e8d8b402c814e2b264c50c6faef4

  • SHA512

    2d8696c0f640fb4fa7137e7654d1792c7ea2861cda1464575a87ac3e39ab136a2c250077796e020142cfcd3a652a07c921ace4bc5e21ec56f8661162e7ed1b4f

  • SSDEEP

    1536:1sc2i/juqQhtmEcJOvlanTK/5BSbIFe6WErUJ2EweXGMUgL43np1wSf:1p2iKxcJyg+/5BSZXGM0np1wSf

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fafac6d4a2601d61a605875f47a955e8_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3300
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f8b946f8,0x7ff8f8b94708,0x7ff8f8b94718
      2⤵
        PID:1832
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,15087469688451981897,15465029351531451799,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
        2⤵
          PID:1132
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,15087469688451981897,15465029351531451799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2552 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2988
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,15087469688451981897,15465029351531451799,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:8
          2⤵
            PID:1168
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15087469688451981897,15465029351531451799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
            2⤵
              PID:3924
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15087469688451981897,15465029351531451799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
              2⤵
                PID:4504
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15087469688451981897,15465029351531451799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
                2⤵
                  PID:4532
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15087469688451981897,15465029351531451799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
                  2⤵
                    PID:1844
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15087469688451981897,15465029351531451799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
                    2⤵
                      PID:2304
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15087469688451981897,15465029351531451799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
                      2⤵
                        PID:4728
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15087469688451981897,15465029351531451799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
                        2⤵
                          PID:4180
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,15087469688451981897,15465029351531451799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2980 /prefetch:8
                          2⤵
                            PID:532
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,15087469688451981897,15465029351531451799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2980 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2044
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15087469688451981897,15465029351531451799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
                            2⤵
                              PID:3152
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15087469688451981897,15465029351531451799,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2652 /prefetch:1
                              2⤵
                                PID:5084
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15087469688451981897,15465029351531451799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
                                2⤵
                                  PID:1536
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15087469688451981897,15465029351531451799,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
                                  2⤵
                                    PID:1244
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,15087469688451981897,15465029351531451799,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5688 /prefetch:2
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:1108
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:2012
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:680

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      ff63763eedb406987ced076e36ec9acf

                                      SHA1

                                      16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

                                      SHA256

                                      8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

                                      SHA512

                                      ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      2783c40400a8912a79cfd383da731086

                                      SHA1

                                      001a131fe399c30973089e18358818090ca81789

                                      SHA256

                                      331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

                                      SHA512

                                      b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

                                      Filesize

                                      23KB

                                      MD5

                                      2f24e0f5d2c2997a89fb4a8d943c141f

                                      SHA1

                                      99515bde1a5bf72105116ac902ccf3db1dd3df29

                                      SHA256

                                      60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

                                      SHA512

                                      0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      192B

                                      MD5

                                      65afd41fd6e32209127922707dc6998c

                                      SHA1

                                      d1ddc95c7ca7f3f6870b6ebbaef87f90c5a10ca7

                                      SHA256

                                      9a08597a458e91d744266f05761369baa3e6edc0ef4e5e06da08e552d69cb45c

                                      SHA512

                                      bfecd181836db2c98c6c045301d84e6c9b17b3e017d4de148459add27eb5c1b1bb465ac7673123397e4d1c306473dfe6a897807986e62502947425be3ec8bca1

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      168B

                                      MD5

                                      8765641f592b2ecb06bf697b6d6f8c01

                                      SHA1

                                      666dc0b03be72db9a72d5dfca93dcf4b62fa09d5

                                      SHA256

                                      542fe02e52d8bb89c8e2f21b629a087ebce8ec90a1d099d8869064400da7fdd0

                                      SHA512

                                      08d3eaed38b210b31b427d8fd2da828e8c9427c27498772e7d4fb530915b7448061dd157f9620112897cddca8fc5ab476306d6ac2ac627018a2cbda742d8a443

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      1KB

                                      MD5

                                      8d51c95839c4d9abf4dda0c9a930e632

                                      SHA1

                                      fa6faf330e0d5ca88c12dd2af2a4a706db7e4e06

                                      SHA256

                                      b038906aeff02a56db5f3b0d40fe69e808c3c6d8c82f4429be624980dbea24f8

                                      SHA512

                                      634ee13076d582752f6326eb832d6bb7c1965ecf949fe1e99ca546ff5ada68a8f75a5060b6fcd1ab34407877974dae7557026f89db616508d707623363480f08

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      2KB

                                      MD5

                                      3c2c7c4aa0212ff78bc818fe7866dec0

                                      SHA1

                                      22c870e5eb36efd0944e52703a3aac7d0229cf17

                                      SHA256

                                      54d38a701410f7e1b4dfcb7a1f6309f68a52805c876848c479aea7eab3a0ec28

                                      SHA512

                                      42ce997e57e73a63ac9dc0f341b2d77f00681bdd16d591f4e9f760bd8b0fd7404ded92b5157ffa39992dbc50b2c88ebd919d03f8a0914e84699af0ebd8dcb640

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      e8e83f96cd472e85ae1314b78ce9dc10

                                      SHA1

                                      cf22d36bb47a9d84b2e8b01352fea8dbd04ac2e1

                                      SHA256

                                      59e547d00e90f3b4ede93b11c59ff408ac4a7c8644fcb1d5bf7a989ae4480e20

                                      SHA512

                                      49d2df0c0f8c184b4a3af6716a81b560bc1074628daa96a39b26b2b7bce97011acb2d0b794de5b8b3b40cc5e402961c0ddb98630902af7fa831285c71ee85174

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      713a935f84d62d423ae436342f3fbc4d

                                      SHA1

                                      91d87fda9a1c9eae8d253db564a6f8c4a5431cfe

                                      SHA256

                                      ea59dab02be9025f6d2598cff69aa52cf678aac00fd6a9d1e057f22ff8c54256

                                      SHA512

                                      14dbcf9b2cc8392019316ca8e3d7d488197178b150463fb60f78db96f302219b358e8cedc6a3794b160ca3d483a455552bf8e951b8b61ae63decab0a36c2687c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      ef2be1a4dbef536d1ba1c23156b188da

                                      SHA1

                                      0eca3b4f932a59b761b9d7ca0ccee3f999f8cd04

                                      SHA256

                                      7a1b822616db664a4d09fe1908b84f14e432957ddbb4afcca12681cf9b40ebae

                                      SHA512

                                      5a6dc14736a77bb9c18e7122d2b8273106ea47b51db16ba7669477c6cbd51ac0073d25944d12ff27c6dd73d012271dc64285ae586bce3fadac2325af25635500

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      2a085cbf4f279498d15eda772a251313

                                      SHA1

                                      83f6e24b397e2afdb1976f2a14ca2e2ff0095373

                                      SHA256

                                      357ca369bcdb87ed72fcc7b8bc97756f0f36f36c6cfa717fd3698e6e34196aef

                                      SHA512

                                      7dd7fcebfecc9f9861e93c96b58bf9ad9e747daa1748022c0cafe179fda1af88cebe9a9e2c4217121dfefbd8ce0587c4b64385a354159117a2c0b6035b7fe8c2

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      4f681f238a736ae3856e17e4eabcdfdb

                                      SHA1

                                      649e8b6e278d5de5b2d919ecd3c9d69adf12b515

                                      SHA256

                                      2f41568fa5ef0a5b5f21295c524d10a8c4595b76403d9f894022c36816b21102

                                      SHA512

                                      6a105dbe22fbad646d1d334d6262a5ec3745e45122d2fa6758cbd51f5a1c7cef6c32ea3c5a676fed2c0993b1c8dfe457c290971f5f40efe8b3c549e51fc84cdb

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      6752a1d65b201c13b62ea44016eb221f

                                      SHA1

                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                      SHA256

                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                      SHA512

                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      10KB

                                      MD5

                                      4b5ecce4047fd02b6cb2869d99f516ba

                                      SHA1

                                      ffbd1da40486da0d0fb2410f08320a0e34dcacf0

                                      SHA256

                                      9bc742e0045dc28cd00a91a8615e27719ca9c1006ba66b77af565b46998408a6

                                      SHA512

                                      f4b1e847d44e424d9dc36610e4b53371616becf918be9e3ae5680588157f6cbef708ffe3b826bcaa41963c46c50b4187f98706e50437f343710ae0f65c438a1d