Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/04/2024, 18:07
Static task
static1
Behavioral task
behavioral1
Sample
e8164a6425a2cd1a4879d2c46ffe7000_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
e8164a6425a2cd1a4879d2c46ffe7000_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
e8164a6425a2cd1a4879d2c46ffe7000_JaffaCakes118.html
-
Size
83KB
-
MD5
e8164a6425a2cd1a4879d2c46ffe7000
-
SHA1
087098c692d59dc93d176f058b1895281820a24d
-
SHA256
ef0eda370bc438f8fa51f34b8edf8c4c83add6006e175db2321fefcc1058d55e
-
SHA512
e31dfd375647ec50de3f06957f0cd2c5548b075ae024d4850ef8ed7f52a869b83b5083bf06eb8d574b46f9645f9105bf7377fba33fa1c2630fcb0a05748cd853
-
SSDEEP
1536:q+t09gSw+QT0NcNtxNSNeNBNYNoNJNbNy9xQ:q+S9gSwn0NcNtxNSNeNBNYNoNJNbNyg
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5724 msedge.exe 5724 msedge.exe 2008 msedge.exe 2008 msedge.exe 3668 identity_helper.exe 3668 identity_helper.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe 5636 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2008 wrote to memory of 4560 2008 msedge.exe 85 PID 2008 wrote to memory of 4560 2008 msedge.exe 85 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5208 2008 msedge.exe 86 PID 2008 wrote to memory of 5724 2008 msedge.exe 87 PID 2008 wrote to memory of 5724 2008 msedge.exe 87 PID 2008 wrote to memory of 2240 2008 msedge.exe 88 PID 2008 wrote to memory of 2240 2008 msedge.exe 88 PID 2008 wrote to memory of 2240 2008 msedge.exe 88 PID 2008 wrote to memory of 2240 2008 msedge.exe 88 PID 2008 wrote to memory of 2240 2008 msedge.exe 88 PID 2008 wrote to memory of 2240 2008 msedge.exe 88 PID 2008 wrote to memory of 2240 2008 msedge.exe 88 PID 2008 wrote to memory of 2240 2008 msedge.exe 88 PID 2008 wrote to memory of 2240 2008 msedge.exe 88 PID 2008 wrote to memory of 2240 2008 msedge.exe 88 PID 2008 wrote to memory of 2240 2008 msedge.exe 88 PID 2008 wrote to memory of 2240 2008 msedge.exe 88 PID 2008 wrote to memory of 2240 2008 msedge.exe 88 PID 2008 wrote to memory of 2240 2008 msedge.exe 88 PID 2008 wrote to memory of 2240 2008 msedge.exe 88 PID 2008 wrote to memory of 2240 2008 msedge.exe 88 PID 2008 wrote to memory of 2240 2008 msedge.exe 88 PID 2008 wrote to memory of 2240 2008 msedge.exe 88 PID 2008 wrote to memory of 2240 2008 msedge.exe 88 PID 2008 wrote to memory of 2240 2008 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e8164a6425a2cd1a4879d2c46ffe7000_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe0,0xe4,0xd8,0xdc,0x108,0x7ffe08dc46f8,0x7ffe08dc4708,0x7ffe08dc47182⤵PID:4560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,8610375325288735021,4600121760383988946,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:22⤵PID:5208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,8610375325288735021,4600121760383988946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,8610375325288735021,4600121760383988946,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:82⤵PID:2240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8610375325288735021,4600121760383988946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:4916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8610375325288735021,4600121760383988946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:4856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8610375325288735021,4600121760383988946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:12⤵PID:3956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,8610375325288735021,4600121760383988946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:82⤵PID:2640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,8610375325288735021,4600121760383988946,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8610375325288735021,4600121760383988946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:12⤵PID:2352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8610375325288735021,4600121760383988946,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:12⤵PID:4500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8610375325288735021,4600121760383988946,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:12⤵PID:980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8610375325288735021,4600121760383988946,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:12⤵PID:2256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,8610375325288735021,4600121760383988946,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1052 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5636
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4644
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4812
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD547b2c6613360b818825d076d14c051f7
SHA17df7304568313a06540f490bf3305cb89bc03e5c
SHA25647a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac
SHA51208d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac
-
Filesize
152B
MD5e0811105475d528ab174dfdb69f935f3
SHA1dd9689f0f70a07b4e6fb29607e42d2d5faf1f516
SHA256c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c
SHA5128374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852
-
Filesize
740B
MD5dde58a1bfee0b57d09104c249bc2338f
SHA11bfaf1b9f792ca6deac80d632596375c077e7fd9
SHA2568cd7356e8ad05a94878339b9e07c6f53950bf3d27832cf2891a41c1e1c957c3b
SHA512d7f23306b75635af3f20b0813213df6eb35e42eaf1709555ff09fbf29e137d682d87240b5964cc2e47c0bb967183de9aa4088b7793346c3731b487fd8c3c99e9
-
Filesize
6KB
MD5588f1af66874805dae04b5a06874d942
SHA1dac8bcd0ab5fec273a2e2d12bcdf7f40ce5934c2
SHA2565175722971c82a45e8f31cd46cc22119cae797db2c06634eca324edaf0cae279
SHA512a967f9ebfa944c5b6592f154559727fbb5986aabef99f8d94c3195ffa3b1752c275717c6d27914ab6c062661fc07c466917dce1320c8455ac4072fe70ebe0db1
-
Filesize
6KB
MD51966a1bbfbf11453edb6ad8b0c0616ec
SHA163bedbfaf3ea08462a2ce5d3b05854d98415878d
SHA2562eccd20b64387a22eb73abe526372dde97a6ce2c66007ad8c0d3e9430a5d9434
SHA512db9535c14a8f3e5edaf8f3db90bb7fc484c4049565fe60575c7882553cf952974d2c4f3e33b7a87441b5ee5127abed88b444c0338c16bf4d758be1efb28a2832
-
Filesize
6KB
MD5e4315f8197702f5e5aa650c77576c81e
SHA126a9cd3c9064cce3be1879d89112a95064ac6e53
SHA25654e9b3ab4cb55dbecae778a7db14518e318b276ec419130fb7ad5eb6dd6fed6b
SHA512222fe6e20e95eb9e1a3aa6e6d1e4b8e3f97cc26069958ba9fc10ff0df8cfc7247f8c078e8a9ff2eb0b654ac163a586a9d7e4b3e4abfae22ceb5f45e42139419f
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5d09525581d64f4dfbd26039f60d791b2
SHA16076e4f0c6c67f1153d700204ba6ddf9078d2b56
SHA25674cfc676bf56ecd7bfba5a14c506c11942f76279ffe142be972f1e1051e106cf
SHA5121688a86c583f6a7e77e5d4cb6f83d67ec71c62ca907d232a3dcb077bd1d4e8570756e60fe9f2076024001ad7c09ea04c641e9a2455e798b4d26c57cc910b4c71