Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/04/2024, 16:05
Static task
static1
Behavioral task
behavioral1
Sample
edd0f3e947ce6c8134dbb61fa5d615f5_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
edd0f3e947ce6c8134dbb61fa5d615f5_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
edd0f3e947ce6c8134dbb61fa5d615f5_JaffaCakes118.html
-
Size
69KB
-
MD5
edd0f3e947ce6c8134dbb61fa5d615f5
-
SHA1
bb2e46bab8600a291c465325f8646a2da9929454
-
SHA256
0050e2b2c338481a18c195bd0bad3849e87ff6b6dd913192708ac8d3099dd30f
-
SHA512
7c3f9fd1d2dd10f7e439dbc7e4fa2fb3b70abccd3497341c9ebe2a71661a4eae220652c087027f08a7e230e31577799404edc744d2b23cfdfb4577cfef65a979
-
SSDEEP
1536:tfIRIOITIwIgIlKZgNDfIwIGI5I8J7SYIRIOITIwIgIHKZgNDfIwIGI5IvJ7SBQW:tRQhVUpfipf0/+Xxm
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5032 msedge.exe 5032 msedge.exe 4920 msedge.exe 4920 msedge.exe 316 identity_helper.exe 316 identity_helper.exe 3236 msedge.exe 3236 msedge.exe 3236 msedge.exe 3236 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe 4920 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4920 wrote to memory of 3724 4920 msedge.exe 83 PID 4920 wrote to memory of 3724 4920 msedge.exe 83 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 552 4920 msedge.exe 84 PID 4920 wrote to memory of 5032 4920 msedge.exe 85 PID 4920 wrote to memory of 5032 4920 msedge.exe 85 PID 4920 wrote to memory of 2468 4920 msedge.exe 86 PID 4920 wrote to memory of 2468 4920 msedge.exe 86 PID 4920 wrote to memory of 2468 4920 msedge.exe 86 PID 4920 wrote to memory of 2468 4920 msedge.exe 86 PID 4920 wrote to memory of 2468 4920 msedge.exe 86 PID 4920 wrote to memory of 2468 4920 msedge.exe 86 PID 4920 wrote to memory of 2468 4920 msedge.exe 86 PID 4920 wrote to memory of 2468 4920 msedge.exe 86 PID 4920 wrote to memory of 2468 4920 msedge.exe 86 PID 4920 wrote to memory of 2468 4920 msedge.exe 86 PID 4920 wrote to memory of 2468 4920 msedge.exe 86 PID 4920 wrote to memory of 2468 4920 msedge.exe 86 PID 4920 wrote to memory of 2468 4920 msedge.exe 86 PID 4920 wrote to memory of 2468 4920 msedge.exe 86 PID 4920 wrote to memory of 2468 4920 msedge.exe 86 PID 4920 wrote to memory of 2468 4920 msedge.exe 86 PID 4920 wrote to memory of 2468 4920 msedge.exe 86 PID 4920 wrote to memory of 2468 4920 msedge.exe 86 PID 4920 wrote to memory of 2468 4920 msedge.exe 86 PID 4920 wrote to memory of 2468 4920 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\edd0f3e947ce6c8134dbb61fa5d615f5_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c04c46f8,0x7ff9c04c4708,0x7ff9c04c47182⤵PID:3724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,766337994468582772,7709747337405132442,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:22⤵PID:552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,766337994468582772,7709747337405132442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,766337994468582772,7709747337405132442,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:82⤵PID:2468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,766337994468582772,7709747337405132442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:4876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,766337994468582772,7709747337405132442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:2136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,766337994468582772,7709747337405132442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:82⤵PID:3236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,766337994468582772,7709747337405132442,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,766337994468582772,7709747337405132442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2320 /prefetch:12⤵PID:4716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,766337994468582772,7709747337405132442,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:12⤵PID:3088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,766337994468582772,7709747337405132442,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,766337994468582772,7709747337405132442,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:12⤵PID:4240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,766337994468582772,7709747337405132442,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4796 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3236
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4228
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3188
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c6382490b1617e93bf320fb5177da1cf
SHA12ea2e8673a0a8248ae7604b76526c62a412645cd
SHA25644792ea756da9ddb8dbcb495f0f967d2630d01c1d4793e948ff3edabccb2d8bc
SHA51292293db72a36fd518d0bb85da60e53a3d8bc1acd8baba39a82eca3bebb262d1764e52f9f68c3f860434c335be330fa90a3365be293ee64dd7f5b4baa15fcad12
-
Filesize
152B
MD547b2c6613360b818825d076d14c051f7
SHA17df7304568313a06540f490bf3305cb89bc03e5c
SHA25647a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac
SHA51208d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac
-
Filesize
152B
MD5e0811105475d528ab174dfdb69f935f3
SHA1dd9689f0f70a07b4e6fb29607e42d2d5faf1f516
SHA256c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c
SHA5128374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8fb6c324-7b00-4c70-bc6f-31496d6cbe7c.tmp
Filesize6KB
MD554b191e58be47f00258f3b349319b306
SHA18bf73ef3243fe65fd2fdf28c8ffb3f94e6bf37e6
SHA256525cb93de1a2dcdff8d051509e8032da5bc4ed542856186ffffac4b44f476303
SHA5124e715bf7013c90bfc64ad79359eb4de3ebcdf23d5fda3944039d4a38ab7e20bde1b6b6d05bdfd8c35d5595cbc2ce14b1c2867f5f8d2b18a254c52d4e975b9b3e
-
Filesize
308B
MD51989c654fd719d642508c7e12b4384ce
SHA1d05ecc36503a1d7815a23e6cbf798d4390c64746
SHA2564ee0ba8b755b84ad52a88c334ff965589e83cf554b06c936c5990045eb0c42e4
SHA5125cf8d7ede462933ee0e78ae168130bb9c050c2613389078a7b40d168493575f6ddbb50b735c713a59eb626b8324e00cf777848d525fdba4790481c5fa7cd550b
-
Filesize
6KB
MD5db5c5c987f5fa91967917754464fcebb
SHA1b897e4a629354eb07f9bffbfe246b3cfeb5f6287
SHA2561de3f538f9a51986e1709be5f4354a31f4996435653c4ec11666222754c26977
SHA512fd144260b0341872535eefa9a2b82b1e0e6fc9249e3b053e9039f699d0f2c36d91ff3d4a94d991b54609af9d89275bd26fbb5575decff89a56cbcb511b0911cb
-
Filesize
6KB
MD5f1889716d90e7ec67b72041ebbecdea9
SHA13ad482831b19937c30bbd1362f4e8ba1c224e887
SHA25632efb4b101d7950b032549148cd7a5755f882960e4c3a57bdd91b3bc04a44c45
SHA512cc0bd6d0cd94d884a827b1a7736421d709f4d8dc72af11b47d66d9ec2f0f6c82cd25d8c79f6714b15b083eedba53489a29e4a8562b15115e45876e675194f093
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389