Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2024, 07:06

General

  • Target

    0977488ce758275521ddafd26b1b0265_JaffaCakes118.html

  • Size

    23KB

  • MD5

    0977488ce758275521ddafd26b1b0265

  • SHA1

    08d8314694fbc89023f2938a52b6d550338959de

  • SHA256

    b5208eb24550ecba6f991bda6911b58eb1c7d21622b4e5fe53d24a7f21265680

  • SHA512

    50cc8ced91d2b4e7e476b97e0481f89c8c6da6ac8cf54dc633818883cde9ab9e13064d82fc360a5c82184da85011b88b57abce6ae79f4f8f16dc51997400600a

  • SSDEEP

    384:UMBCdDlbRSuhcx1r0unEPpz4Z0rxwiT2Iwy7p/uu2uzDlS3O+XGL9DyFmh8/7XuS:UMBCdeRx1r0QEPpzLxN9C3O+XGL9DyFD

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0977488ce758275521ddafd26b1b0265_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1964
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcff3546f8,0x7ffcff354708,0x7ffcff354718
      2⤵
        PID:1084
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
        2⤵
          PID:4532
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3376
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
          2⤵
            PID:5020
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
            2⤵
              PID:912
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
              2⤵
                PID:3780
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
                2⤵
                  PID:2652
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
                  2⤵
                    PID:4904
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
                    2⤵
                      PID:904
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5876 /prefetch:8
                      2⤵
                        PID:4192
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5876 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3164
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
                        2⤵
                          PID:3056
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
                          2⤵
                            PID:2520
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,1690329819756042707,14643451911116681884,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:216
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:4684
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:2892

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              9e3fc58a8fb86c93d19e1500b873ef6f

                              SHA1

                              c6aae5f4e26f5570db5e14bba8d5061867a33b56

                              SHA256

                              828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

                              SHA512

                              e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              27304926d60324abe74d7a4b571c35ea

                              SHA1

                              78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

                              SHA256

                              7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

                              SHA512

                              f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              192B

                              MD5

                              3294e95675c5d6393c2a243c5212a954

                              SHA1

                              27c1168e9870bddee6f625036d3c5b4ef0254406

                              SHA256

                              dce7e578c2f8516f5a2452444c7dfbf22ada0db537fd3cad0fa8d1eb3bef1e7e

                              SHA512

                              f4895179947db7558590c9210ae26338c51fb94d3ed9c3a91085fb7ee5b38dc7184126b163d3b8814ba2c2d67675b33cd6b2662113eb4592810ac143e8eb9304

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              2c643f69b665e162eaf0bc83f68c3447

                              SHA1

                              cd8a2277410c40c4dbd5dc869af8abf4a8a32c48

                              SHA256

                              56628a7e90812845b93add1849ae76c4aa95cf666a4b48740d607f0e994e4fcf

                              SHA512

                              762c7d0098f2f9ccfa1bb42aefb6b7e430f03aaaaac3204a76135fbcd19d50d4f4a13d7d3f6f03b53e26a28733d59a371b18e6e6cf627d9c7d63d0d15db37bd9

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              9579e1531ef367511532135a08b26027

                              SHA1

                              d0fcf1940a65f75e8c1a9dcefec4d09d2fe7227f

                              SHA256

                              bc933867976c321985d231d7ddf0ea5baa26fb4ec81c76c84f0fd4123fe4fac6

                              SHA512

                              6efa6fe841bb1d229931f16688637f1732f1c953f5463a635b8c429678c5706dfad590925c92661fd3ddc9d97a67881f2715b3d5cf8205ce3d7f577728d362ef

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              7KB

                              MD5

                              7aec29e8944b63d0744f31adf00ac919

                              SHA1

                              6a7efdf0e09d418f5032823410e098129a99ef7d

                              SHA256

                              fc248acaa8e71bc0f893a3ff04bdb3947dc17f043aa93db949d816303dbaf853

                              SHA512

                              d94d4fd7c8e9d47ba64bdedf2320f76e76dcb1fb062e7925710d804374ce70c6b3366bc54a7a9b440817498e23fdda24fbb040086e1f7a402697f8ef251db816

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              7KB

                              MD5

                              cf3eda2bdb5a89ee0007d89111c1bf05

                              SHA1

                              179742f01b7088f519d8aff93e3b2a1f36d04ba8

                              SHA256

                              042e9a990eb00613a528a76988d6eb82fd144b15a6022247ddcc529ec57a35c9

                              SHA512

                              bd84864e74613ee9963e239f4bf64a6792270db422c9d29846e9208a3155a6f8a0e565e22f9af23914f5932a72aa989fe09f5be459a72937c3ddd1c12cc6f119

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                              Filesize

                              536B

                              MD5

                              38570c5d31fbe874582399bdb841bcfa

                              SHA1

                              3b6bb809057e38b46234753549494ea4587d655f

                              SHA256

                              95ac2d9e03983e4ec1613e1a63f110052bf5365eb361f98ca2fc30d06760ae9b

                              SHA512

                              419af4450ddb223eebaa8ba96331d2cc0dbbfa1e15f2bdb9392434c5a4b426833d97e5d755dc93d7bc245d3214df4d3ebb1706297e1d7c2a6f7d037337158916

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58435d.TMP

                              Filesize

                              204B

                              MD5

                              81c1cf378ab59729d6865dab72c82116

                              SHA1

                              2b5266bffbcc5118df8f3ab31fbcecb16f22ee3b

                              SHA256

                              35fa8e8eab0390c5a33bd61ee310847106078a37c57bbab99ca62797ff4f9c00

                              SHA512

                              af12a304d8f9807a62fe017117df3b1d24d95ade791f14fc0d2e73d99df270216a2dde6ce9913233878e44dd83a96aaa63201e4ee76814209deaf7715e95b0bb

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              10KB

                              MD5

                              4d89e7088bfa2a2b8685f8434225cf4f

                              SHA1

                              6a87f59e7905a1c719d5b6d56b62431d6b97fff1

                              SHA256

                              d80288e3e3b7f8ddfbdcbe2279ed99946302237a8fd74e628709f91bbf817a51

                              SHA512

                              6189b505e7cefa44050af61fad3fed6eeb47a3b6494de3f60ffe2dceae43d90a1faaf17431a4df150a151a7ece8090f55e4288ccdec9da7d3619c86bc662ea41