Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04/04/2024, 17:13
Static task
static1
Behavioral task
behavioral1
Sample
be0cf1c3ed33b2450c3b3f90cef1d271_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
be0cf1c3ed33b2450c3b3f90cef1d271_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
be0cf1c3ed33b2450c3b3f90cef1d271_JaffaCakes118.html
-
Size
154KB
-
MD5
be0cf1c3ed33b2450c3b3f90cef1d271
-
SHA1
9a901dad6179628c88ed8c0407b1a5dea73743ef
-
SHA256
f09e76320413868bc10a7b05a5010ba48a4fee05db55a4fc81fe010bb93ded17
-
SHA512
88b2823fda425e1f9d011b5870172f7a7eef435f22e944fa1315db3576d1cbd3413b25e9d70e6eb580a256d78eefa5147ea21581d7b19402721c12bba8c88414
-
SSDEEP
3072:SmLmP18zpEQuRxcyfkMY+BES09JXAnyrZalI+YQ:S8mP18zpEQuRxBsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4744 msedge.exe 4744 msedge.exe 5636 msedge.exe 5636 msedge.exe 436 identity_helper.exe 436 identity_helper.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe 3948 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5636 wrote to memory of 1712 5636 msedge.exe 85 PID 5636 wrote to memory of 1712 5636 msedge.exe 85 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 828 5636 msedge.exe 86 PID 5636 wrote to memory of 4744 5636 msedge.exe 87 PID 5636 wrote to memory of 4744 5636 msedge.exe 87 PID 5636 wrote to memory of 4704 5636 msedge.exe 88 PID 5636 wrote to memory of 4704 5636 msedge.exe 88 PID 5636 wrote to memory of 4704 5636 msedge.exe 88 PID 5636 wrote to memory of 4704 5636 msedge.exe 88 PID 5636 wrote to memory of 4704 5636 msedge.exe 88 PID 5636 wrote to memory of 4704 5636 msedge.exe 88 PID 5636 wrote to memory of 4704 5636 msedge.exe 88 PID 5636 wrote to memory of 4704 5636 msedge.exe 88 PID 5636 wrote to memory of 4704 5636 msedge.exe 88 PID 5636 wrote to memory of 4704 5636 msedge.exe 88 PID 5636 wrote to memory of 4704 5636 msedge.exe 88 PID 5636 wrote to memory of 4704 5636 msedge.exe 88 PID 5636 wrote to memory of 4704 5636 msedge.exe 88 PID 5636 wrote to memory of 4704 5636 msedge.exe 88 PID 5636 wrote to memory of 4704 5636 msedge.exe 88 PID 5636 wrote to memory of 4704 5636 msedge.exe 88 PID 5636 wrote to memory of 4704 5636 msedge.exe 88 PID 5636 wrote to memory of 4704 5636 msedge.exe 88 PID 5636 wrote to memory of 4704 5636 msedge.exe 88 PID 5636 wrote to memory of 4704 5636 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\be0cf1c3ed33b2450c3b3f90cef1d271_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdd9c46f8,0x7ffcdd9c4708,0x7ffcdd9c47182⤵PID:1712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,11047812654012478605,12156512879458495633,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:22⤵PID:828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,11047812654012478605,12156512879458495633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,11047812654012478605,12156512879458495633,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:82⤵PID:4704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11047812654012478605,12156512879458495633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11047812654012478605,12156512879458495633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵PID:4400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,11047812654012478605,12156512879458495633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:82⤵PID:2236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,11047812654012478605,12156512879458495633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11047812654012478605,12156512879458495633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:12⤵PID:5356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11047812654012478605,12156512879458495633,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:12⤵PID:5800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11047812654012478605,12156512879458495633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:12⤵PID:2336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,11047812654012478605,12156512879458495633,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:12⤵PID:3660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,11047812654012478605,12156512879458495633,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1272 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3948
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3376
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2712
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f35bb0615bb9816f562b83304e456294
SHA11049e2bd3e1bbb4cea572467d7c4a96648659cb4
SHA25605e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71
SHA512db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1
-
Filesize
152B
MD51eb86108cb8f5a956fdf48efbd5d06fe
SHA17b2b299f753798e4891df2d9cbf30f94b39ef924
SHA2561b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40
SHA512e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\840ba9c9-dede-4247-93d2-0548a800b309.tmp
Filesize6KB
MD56abc380d30c0c7777759eb5cc288f049
SHA1a2ab57f819e36117449ed2d5d8f80492cbc258ec
SHA256aa859cdf00899e9d0b6708ae0abffb30783d0923101db1915aeb7ac2703d935a
SHA51204e4d3b4debb42c8f656ad8d554e5e381f8247661237968e6a209c37cdaeebd91d7e97481f3dedc7ecf71f05194dc3c917ddddbd678eb8a5595e5e814978b427
-
Filesize
6KB
MD518e80c224149344dd2cf9cee3dbb9c03
SHA14c3abd4788118b68c81914540976dedbbf604f3b
SHA256974cf2cefc0bde0f0cc1ca57deb838febcc65b51d7059e06963508dc34bbafeb
SHA512bce303d8746fcd20f3a82ad7ab0096b81865b9fd7fd6108960fee48d02a47ae2ce9f492d78990e535240771f8861a02356ae0572c8a74f426b10e51216b51b85
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5a5628a8dcf3174756f8c166224e98576
SHA12153b7e66f4dbd3025228fcc54997ef90e6b4618
SHA2560739a83e3cd03fce1fe4ea05889f2456008af8f63326478aeb9019975e0a3fc9
SHA512f77a60a37efa41b6f11374b71fefe33bb51469bea4ba942e9a2ae5823512fbb67865a90e1e080d37a77ed1bd87ddb2b607f38ae0057bc34e6e76272bae930ceb