Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2024, 21:16

General

  • Target

    3c12750ce0dbdc6f3cf0960a0907d8d9_JaffaCakes118.html

  • Size

    24KB

  • MD5

    3c12750ce0dbdc6f3cf0960a0907d8d9

  • SHA1

    56fa81fefd8d67e9160a51876ca9b27a986138fe

  • SHA256

    ab9c378a93b5140852639361dd1593350e3df620c42d243a819461cb76f50f5a

  • SHA512

    f5885767c06818ada2381098c69c7e9baa2a426b2a2935b097c2874434d39dc6c0eee7e504136b38ae78e80dfde040c7a75e59909e580fd677ad799148168ce2

  • SSDEEP

    384:SWin/SHQbWMeCjlaTR1YZgjWQpoB23GkYTvBpsBJHEuw:SSHc1eg8LaB2GkYTJpsBJHEx

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3c12750ce0dbdc6f3cf0960a0907d8d9_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccb0146f8,0x7ffccb014708,0x7ffccb014718
      2⤵
        PID:3960
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,12421242099060206453,7577583378594712523,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
        2⤵
          PID:1432
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,12421242099060206453,7577583378594712523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2232
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,12421242099060206453,7577583378594712523,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
          2⤵
            PID:2272
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12421242099060206453,7577583378594712523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
            2⤵
              PID:1560
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12421242099060206453,7577583378594712523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
              2⤵
                PID:5036
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12421242099060206453,7577583378594712523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
                2⤵
                  PID:5088
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12421242099060206453,7577583378594712523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
                  2⤵
                    PID:2756
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12421242099060206453,7577583378594712523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
                    2⤵
                      PID:3224
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12421242099060206453,7577583378594712523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
                      2⤵
                        PID:428
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12421242099060206453,7577583378594712523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
                        2⤵
                          PID:4252
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12421242099060206453,7577583378594712523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:1
                          2⤵
                            PID:3520
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,12421242099060206453,7577583378594712523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6768 /prefetch:8
                            2⤵
                              PID:1916
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,12421242099060206453,7577583378594712523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6768 /prefetch:8
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3604
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12421242099060206453,7577583378594712523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
                              2⤵
                                PID:456
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12421242099060206453,7577583378594712523,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
                                2⤵
                                  PID:4836
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12421242099060206453,7577583378594712523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
                                  2⤵
                                    PID:3116
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,12421242099060206453,7577583378594712523,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
                                    2⤵
                                      PID:852
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,12421242099060206453,7577583378594712523,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5460 /prefetch:2
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:3720
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:1048
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:1424
                                      • C:\Windows\System32\CompPkgSrv.exe
                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                        1⤵
                                          PID:3060

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                          Filesize

                                          152B

                                          MD5

                                          0a9dc42e4013fc47438e96d24beb8eff

                                          SHA1

                                          806ab26d7eae031a58484188a7eb1adab06457fc

                                          SHA256

                                          58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

                                          SHA512

                                          868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                          Filesize

                                          152B

                                          MD5

                                          61cef8e38cd95bf003f5fdd1dc37dae1

                                          SHA1

                                          11f2f79ecb349344c143eea9a0fed41891a3467f

                                          SHA256

                                          ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

                                          SHA512

                                          6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                          Filesize

                                          240B

                                          MD5

                                          b69c06a93c462214687d16dafd7effac

                                          SHA1

                                          ffbcde3e815e204e9a4e5eeefa5643619d33a303

                                          SHA256

                                          4fa11c4a217bdf767fe4a19f54ee61177b75abec482cb059a2b0903c9928a92c

                                          SHA512

                                          d8b27bd5eebb3928aeb613965c8df1a57f09e22edc4a2ca6ce316ac2368da31904e48a828120d0815704c3978a1fbc9a5db8c0fb47d186707bfdd126bbfdfaa0

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                          Filesize

                                          192B

                                          MD5

                                          bcb1d9ad43072605a560ae52c5e545bf

                                          SHA1

                                          cf4a6e7975bd9932983173fbba50679552491d99

                                          SHA256

                                          7f41032a99900b3292e3ecfb21d6a55d9d3b6cd5740e164a1109c4209d161993

                                          SHA512

                                          4687e19cc797b8677d9a35af3bd0b3f2d8f79e4fe89e57d161e99a0df0697a7a58217bd8a24f81e0afad6b5cc08cd5fcb0c0a8a147b7c5e703a5784756efe0e3

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                          Filesize

                                          1KB

                                          MD5

                                          1c092c1d1fd943600ad70841cb9f4a47

                                          SHA1

                                          58f572a5b38d8bab7ecce0e62a0b5abaa89765b8

                                          SHA256

                                          2c24827c2f548bba92df6f85f09da0e58344d60568b1f8cf46c3a8d570d2028c

                                          SHA512

                                          2a2cb269a6f09c3759cc1218d3077ab3bfb737865274dbd2b2f09e6a4eb5c88eabe114d981a78dcc98bd1319b1e74abfdfc7a3b8c327b39f36fcef210be27e95

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                          Filesize

                                          1KB

                                          MD5

                                          8ddcfa3fd31230766f4c9bdc721c5a86

                                          SHA1

                                          60b82eff06da232cdfdc586b628b952f80ca93fa

                                          SHA256

                                          edf8b1e50163523848e59ac65dcd7c228567b450e6c12a2372379024859742f4

                                          SHA512

                                          a9816f302eb9b332ed1d174fa1df32b7421c6de0a36e201e437c19b3560eea30c41d60b7ff6171a0bcf57830708cb97e4d15817ffaa1e2dc64ea6868adc03da1

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          04142356fad0e5cba7301c98f6cf7e7c

                                          SHA1

                                          0dd71bbb30b6be59b489515f2e1ddeb3d4bae275

                                          SHA256

                                          2d7a957259c9250d48adb8465a02a28d5bd33cd290c464c42c3798a4347c53eb

                                          SHA512

                                          c474aac7074734cad504b8807bee52e4bb2bf006dbdf4c109f080868df64c55f481a5a5e7dc08a83982ab7f74cbdd5226866e2beb1c6d9585f1d58d31b812a6d

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          7KB

                                          MD5

                                          c3bedee71593ff36ccb5904ae5352d6e

                                          SHA1

                                          b74c3b48976f0b83695e0ab3e3c3829530472371

                                          SHA256

                                          63d6cf7417b042ffba9af65eec37ecf459e14107f10e013b7f1f993e6a992d2b

                                          SHA512

                                          0786fdbf0b863dbc937b408caaab7ca5e27d669c54ce502cea14d77a2e494f2b45fe586c716e7e173dbcd1973fc3e45634c26d79ddb1149433e882c853a0dc69

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          7KB

                                          MD5

                                          05fa9a456f77dfdb5522a44f7600f2f0

                                          SHA1

                                          499f5c3bce471e47cfeda0ae56f1d9493bf788c2

                                          SHA256

                                          30d53ab3da8fc5a6d0526d5b9bf45f6e1a6b298564e3c07d70a33337fdb5bd64

                                          SHA512

                                          c872d8ab23212ecdb6d6585ec062094a9e6269cadf6370d984a6db3ed6eef368a7c7e828db90ba0fe6c7a3d33db7597d6de81704cbaec0b21e8fef0d6727ed2e

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                          Filesize

                                          870B

                                          MD5

                                          05457faf15438026b7f5f292e54108e9

                                          SHA1

                                          402126ac47c74c736875de55bb048804717f5186

                                          SHA256

                                          136badebb9cdf1b6269a7c10743282cca22668a7c4cfc2d435b8d2aa96b2fb8e

                                          SHA512

                                          d408299e01a01d4f30c31704fafa96fab36485c97afeca860932378f84cdc9614697b9cf84fd9b25fa4f48e2c2e278697586a875542b7ad3a880ce92b29b2701

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582362.TMP

                                          Filesize

                                          870B

                                          MD5

                                          92e4599a2e5c85069ce8f4a58bcb2c77

                                          SHA1

                                          3069faf2d45268ddd7e5694ccfbe1cef29dda7cf

                                          SHA256

                                          63d053902daf31aca0337b0b2f0178eb6491d5e1dee4a07324876fa5a69c8fc9

                                          SHA512

                                          bb7bcd21985db8aedd483d810219255b2b5ecce7d15fc23b6cb3177d9e914d34a1a409da9e15870c4faf3a24b99a53026df26a1f66f8f9c7611edf590c135758

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                          Filesize

                                          16B

                                          MD5

                                          6752a1d65b201c13b62ea44016eb221f

                                          SHA1

                                          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                          SHA256

                                          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                          SHA512

                                          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                          Filesize

                                          10KB

                                          MD5

                                          80be61ae12d2dc8020b905c2a2976c46

                                          SHA1

                                          f1e349a246a2cbd98693dede9445bb63a09ea152

                                          SHA256

                                          bbbaadd0fde1d0702fd672290e94ee6614cc635ca1ff4fbba1efc3feb58d1b40

                                          SHA512

                                          815bdee5e523e104f9f9dff553a61b07ed13123e1fa34af6f8ce4f04bdfeb6abf6add20e271195a5c62aaf34273275e8512ef509551fc531e28d0895cf215397