Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2024, 14:22
Static task
static1
Behavioral task
behavioral1
Sample
d632a3f63946db705395c5642b2d62fe_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d632a3f63946db705395c5642b2d62fe_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
d632a3f63946db705395c5642b2d62fe_JaffaCakes118.html
-
Size
48KB
-
MD5
d632a3f63946db705395c5642b2d62fe
-
SHA1
380bdd60665be00d9b742e1f34af68d64e458810
-
SHA256
5cbac17939c0ce92723ce3846ad701b9987944fa9ea3725c4ceeae35f885ee64
-
SHA512
a6b2d5c8ffa3c12e4c1fa0c381602184104f89c3e25f1ece64b1b64a55434c4f3e3f843e14fcb88be4facd8cddc18b34ab0db5c68bdb0ac3a7a0230e06bebaab
-
SSDEEP
1536:mQwQFsI/C1mBcdAvj664UIgvy/VE/A30dFLpgsEP6/:sOx
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1416 msedge.exe 1416 msedge.exe 1920 msedge.exe 1920 msedge.exe 2644 identity_helper.exe 2644 identity_helper.exe 616 msedge.exe 616 msedge.exe 616 msedge.exe 616 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe 1920 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1920 wrote to memory of 3068 1920 msedge.exe 85 PID 1920 wrote to memory of 3068 1920 msedge.exe 85 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 4644 1920 msedge.exe 87 PID 1920 wrote to memory of 1416 1920 msedge.exe 88 PID 1920 wrote to memory of 1416 1920 msedge.exe 88 PID 1920 wrote to memory of 3960 1920 msedge.exe 89 PID 1920 wrote to memory of 3960 1920 msedge.exe 89 PID 1920 wrote to memory of 3960 1920 msedge.exe 89 PID 1920 wrote to memory of 3960 1920 msedge.exe 89 PID 1920 wrote to memory of 3960 1920 msedge.exe 89 PID 1920 wrote to memory of 3960 1920 msedge.exe 89 PID 1920 wrote to memory of 3960 1920 msedge.exe 89 PID 1920 wrote to memory of 3960 1920 msedge.exe 89 PID 1920 wrote to memory of 3960 1920 msedge.exe 89 PID 1920 wrote to memory of 3960 1920 msedge.exe 89 PID 1920 wrote to memory of 3960 1920 msedge.exe 89 PID 1920 wrote to memory of 3960 1920 msedge.exe 89 PID 1920 wrote to memory of 3960 1920 msedge.exe 89 PID 1920 wrote to memory of 3960 1920 msedge.exe 89 PID 1920 wrote to memory of 3960 1920 msedge.exe 89 PID 1920 wrote to memory of 3960 1920 msedge.exe 89 PID 1920 wrote to memory of 3960 1920 msedge.exe 89 PID 1920 wrote to memory of 3960 1920 msedge.exe 89 PID 1920 wrote to memory of 3960 1920 msedge.exe 89 PID 1920 wrote to memory of 3960 1920 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d632a3f63946db705395c5642b2d62fe_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf38846f8,0x7ffdf3884708,0x7ffdf38847182⤵PID:3068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,13619680403178640835,10045117792425910971,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:4644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,13619680403178640835,10045117792425910971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,13619680403178640835,10045117792425910971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:82⤵PID:3960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13619680403178640835,10045117792425910971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:2608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13619680403178640835,10045117792425910971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:1684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,13619680403178640835,10045117792425910971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:82⤵PID:2144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,13619680403178640835,10045117792425910971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13619680403178640835,10045117792425910971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:12⤵PID:3664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13619680403178640835,10045117792425910971,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:12⤵PID:3856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13619680403178640835,10045117792425910971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:12⤵PID:3452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,13619680403178640835,10045117792425910971,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:12⤵PID:4264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,13619680403178640835,10045117792425910971,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4648 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:616
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1760
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2800
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5fd7944a4ff1be37517983ffaf5700b11
SHA1c4287796d78e00969af85b7e16a2d04230961240
SHA256b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74
SHA51228c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b
-
Filesize
152B
MD5a774512b00820b61a51258335097b2c9
SHA138c28d1ea3907a1af6c0443255ab610dd9285095
SHA25601946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4
SHA512ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1
-
Filesize
6KB
MD5faa92ef8f4e2fc7db05d2a8feb7a72b4
SHA18fbf2b0b71a8bf2e0c97da6222ac208f90ef85a0
SHA256c1b741ffedb73ddf8c349ca248a93638ea5f8e542c09f0bb59c3eb499c570c48
SHA5125accb0606362cc108150b411e093172d90c2245ec6ab8f9115d5be6bb6536f2a7bb3883adf1b5ba70633425e9c6df36ceeeff1108feb392fc310211b68e78513
-
Filesize
6KB
MD5b5785af2e5ddaaa77ea0f5d0c89d8a38
SHA19ac825c2a00ffddcf2f60fd582d592f6374a27bf
SHA2561a8baaded2f98d39f3e9814808340073b66ddb7f53614854f399361350fc1561
SHA5126fa3dac7547b006c623f5018a7558a858566bc44c2ee4eb9c719de916b29a9d07b2bb43764c88e5742041c7c3b3855282435fbc59e2f2dfad6383add5d16b581
-
Filesize
6KB
MD5da7dcdfbb32d0fecedccc4c34cf2a064
SHA1a819f4bc3a8b634ad876bac5c7266fb662c80f57
SHA256ed42b34e89d3ce0ed3348f741829df2aa5d3d504a2979e095356bb921ca810bb
SHA5125e3e610320f9e543556bf1959088578d375631e607e961a25a7b041accbdde98f607dc2bc71a6959ef8b18ae2cd20ea5bcae49473aeb598f11a5f4dd7041c677
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5e730d77cfbf9ff1070255dba17ef9239
SHA19121eaaea94a38a50cbfe392bfd52b8d9a3648a9
SHA256abfdca79d078c96541fd00dbeeef679a417b5a28ad12e0cb564ca53f43b23685
SHA51253ef94e76fab521d977f4c249f8bf2d9af2ac77315b3ac1bcccf1b28db942f5fa94944a4a171d2566a744060d4ad4d5e6ae6c1083e1cf80ec5441ac65896bba8