Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/04/2024, 15:02
Static task
static1
Behavioral task
behavioral1
Sample
edb325b6f4c4a1ee4c3d126a24971822_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
edb325b6f4c4a1ee4c3d126a24971822_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
edb325b6f4c4a1ee4c3d126a24971822_JaffaCakes118.html
-
Size
14KB
-
MD5
edb325b6f4c4a1ee4c3d126a24971822
-
SHA1
7142922102ab2f22bd4e742a69fc1c4cca1fc30d
-
SHA256
e22dd1dd5242f0c57b51cb42ca57e5d82aefdac86fae1e82dae772e893ba1cf6
-
SHA512
5a92044b19f5094a10afb68c2758a602d98a8ec4e241f8239c9deab945461473d92ca33179b2687195906aa17f92e112c02814f06ed96fc03fc4ba6763e0d44f
-
SSDEEP
384:ln8uqnGDnW0qVaKcYe/VhNfuhvopAlMF6C1eGXZeiGY3yGoC2JJ4Egnad9y/YtJl:ln8vGDnHIQrEOmRW8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3268 msedge.exe 3268 msedge.exe 1352 msedge.exe 1352 msedge.exe 2292 identity_helper.exe 2292 identity_helper.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe 2340 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe 1352 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1352 wrote to memory of 3576 1352 msedge.exe 84 PID 1352 wrote to memory of 3576 1352 msedge.exe 84 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 4596 1352 msedge.exe 85 PID 1352 wrote to memory of 3268 1352 msedge.exe 86 PID 1352 wrote to memory of 3268 1352 msedge.exe 86 PID 1352 wrote to memory of 2980 1352 msedge.exe 87 PID 1352 wrote to memory of 2980 1352 msedge.exe 87 PID 1352 wrote to memory of 2980 1352 msedge.exe 87 PID 1352 wrote to memory of 2980 1352 msedge.exe 87 PID 1352 wrote to memory of 2980 1352 msedge.exe 87 PID 1352 wrote to memory of 2980 1352 msedge.exe 87 PID 1352 wrote to memory of 2980 1352 msedge.exe 87 PID 1352 wrote to memory of 2980 1352 msedge.exe 87 PID 1352 wrote to memory of 2980 1352 msedge.exe 87 PID 1352 wrote to memory of 2980 1352 msedge.exe 87 PID 1352 wrote to memory of 2980 1352 msedge.exe 87 PID 1352 wrote to memory of 2980 1352 msedge.exe 87 PID 1352 wrote to memory of 2980 1352 msedge.exe 87 PID 1352 wrote to memory of 2980 1352 msedge.exe 87 PID 1352 wrote to memory of 2980 1352 msedge.exe 87 PID 1352 wrote to memory of 2980 1352 msedge.exe 87 PID 1352 wrote to memory of 2980 1352 msedge.exe 87 PID 1352 wrote to memory of 2980 1352 msedge.exe 87 PID 1352 wrote to memory of 2980 1352 msedge.exe 87 PID 1352 wrote to memory of 2980 1352 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\edb325b6f4c4a1ee4c3d126a24971822_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffb32c46f8,0x7fffb32c4708,0x7fffb32c47182⤵PID:3576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,3897145218835233040,9232492712363991981,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:4596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,3897145218835233040,9232492712363991981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,3897145218835233040,9232492712363991981,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:82⤵PID:2980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3897145218835233040,9232492712363991981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:4184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3897145218835233040,9232492712363991981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:3704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3897145218835233040,9232492712363991981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:12⤵PID:4268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,3897145218835233040,9232492712363991981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:82⤵PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,3897145218835233040,9232492712363991981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3897145218835233040,9232492712363991981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:12⤵PID:2388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3897145218835233040,9232492712363991981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:12⤵PID:3048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3897145218835233040,9232492712363991981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:12⤵PID:4472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3897145218835233040,9232492712363991981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:12⤵PID:676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,3897145218835233040,9232492712363991981,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1896 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2340
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1812
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4240
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f35bb0615bb9816f562b83304e456294
SHA11049e2bd3e1bbb4cea572467d7c4a96648659cb4
SHA25605e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71
SHA512db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1
-
Filesize
152B
MD51eb86108cb8f5a956fdf48efbd5d06fe
SHA17b2b299f753798e4891df2d9cbf30f94b39ef924
SHA2561b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40
SHA512e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d
-
Filesize
276B
MD563e94862b42530f86676ad4d8dad984d
SHA13fd2230f79711e641c7d8bc1fc8f6d671319aec8
SHA25602bd271fbf1d8f8cfeb229ec24d7bfb1c261116853c2e66a3f5d0b3536f59a25
SHA5128f57ba1d96f3a97a7867f7eb43efd22baea3a78766fd88e87affcbc1e2e1699de833cbe9d78d22fa784ebf9602bd2006ee315ea13aebbcb79b56ec137c7a5aff
-
Filesize
6KB
MD5edd30aa9388ebe5f73fe9b2cad7c9345
SHA12d5bb2b9c6bff728ec4bb755ff8726257ccdead9
SHA25686c8f20ef5adb9cbf270ef984ce5a72aee0ddbd2a8ef0ff46932401746fdc9c6
SHA512349368f1d2ef4d5bb14a7011477290799671f00203b4deeaafbc9222069382a653b16412ee08c05c4c95a109d14d724cb2c9d97aeffcef8afb0060c15f63749a
-
Filesize
6KB
MD51adc479b7ab17323d73a75cf5d20a0c6
SHA11017f7647680fcf0f9059623a9bd0e52ee93509e
SHA256479a572bfcd7af3db370f61e7b586a582422d6ed6a0ab040f4a0842ac695c018
SHA512e99501a201506972ab79ff2cfd4f80fbf5909784362c0c2e2531fadc6dc4d8d7cfdb36ba7d6aee5ecf8429024fe6eecbc9602fb01a65da52a6b696af22fe0833
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5245f06a25fef2ba6f99011fabf386fe0
SHA15e51d10e845bd69e5e5ca5a08e1b0a884e9679ee
SHA256f61d999bb2caf7c72b7d67631d0f9720ee6eb9842e122f5a61690df5a27d1733
SHA51227c92e791b78c9ed6f16579f2718bf5aa6a290c6e3ec975110ae752b64de1f28b1407008de62a19cd9fc64ab15392dbe3c5697ffa67c165f00e3975ae3897303