Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 23:58
Static task
static1
Behavioral task
behavioral1
Sample
01f4de5abd4c100d6bd51f2e28219ac1_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
01f4de5abd4c100d6bd51f2e28219ac1_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
01f4de5abd4c100d6bd51f2e28219ac1_JaffaCakes118.html
-
Size
140KB
-
MD5
01f4de5abd4c100d6bd51f2e28219ac1
-
SHA1
56b5003a6a39e4dc74cd0c8b55b3960660f778c7
-
SHA256
5ed868c142d33708faaf74ecce063c143947243f06397dcc378a33cfe8c31868
-
SHA512
55b768bab5d31d04023413f1334726a8ebefd97725b46f5a5d0744a21dde61afe09289287adbe9e844159f5fc4309196d3cfafb290fef0b770b1de6a3a98c3b7
-
SSDEEP
3072:sc9kZMS6GRqlD1iGrtoe8gH30F8ZmvmXvQzJe46L1BJ:sVzRqlxogH2vmfQu
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4744 msedge.exe 4744 msedge.exe 2948 msedge.exe 2948 msedge.exe 952 identity_helper.exe 952 identity_helper.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe 3544 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe 2948 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2948 wrote to memory of 3004 2948 msedge.exe 85 PID 2948 wrote to memory of 3004 2948 msedge.exe 85 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4484 2948 msedge.exe 86 PID 2948 wrote to memory of 4744 2948 msedge.exe 87 PID 2948 wrote to memory of 4744 2948 msedge.exe 87 PID 2948 wrote to memory of 2060 2948 msedge.exe 88 PID 2948 wrote to memory of 2060 2948 msedge.exe 88 PID 2948 wrote to memory of 2060 2948 msedge.exe 88 PID 2948 wrote to memory of 2060 2948 msedge.exe 88 PID 2948 wrote to memory of 2060 2948 msedge.exe 88 PID 2948 wrote to memory of 2060 2948 msedge.exe 88 PID 2948 wrote to memory of 2060 2948 msedge.exe 88 PID 2948 wrote to memory of 2060 2948 msedge.exe 88 PID 2948 wrote to memory of 2060 2948 msedge.exe 88 PID 2948 wrote to memory of 2060 2948 msedge.exe 88 PID 2948 wrote to memory of 2060 2948 msedge.exe 88 PID 2948 wrote to memory of 2060 2948 msedge.exe 88 PID 2948 wrote to memory of 2060 2948 msedge.exe 88 PID 2948 wrote to memory of 2060 2948 msedge.exe 88 PID 2948 wrote to memory of 2060 2948 msedge.exe 88 PID 2948 wrote to memory of 2060 2948 msedge.exe 88 PID 2948 wrote to memory of 2060 2948 msedge.exe 88 PID 2948 wrote to memory of 2060 2948 msedge.exe 88 PID 2948 wrote to memory of 2060 2948 msedge.exe 88 PID 2948 wrote to memory of 2060 2948 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\01f4de5abd4c100d6bd51f2e28219ac1_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe85c846f8,0x7ffe85c84708,0x7ffe85c847182⤵PID:3004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,4775208572753653208,707855735288267835,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵PID:4484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,4775208572753653208,707855735288267835,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,4775208572753653208,707855735288267835,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:82⤵PID:2060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4775208572753653208,707855735288267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:4604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4775208572753653208,707855735288267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:4308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4775208572753653208,707855735288267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:12⤵PID:1056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4775208572753653208,707855735288267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:12⤵PID:3632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,4775208572753653208,707855735288267835,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:82⤵PID:4140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,4775208572753653208,707855735288267835,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4775208572753653208,707855735288267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:12⤵PID:4396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4775208572753653208,707855735288267835,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:12⤵PID:4924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4775208572753653208,707855735288267835,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:12⤵PID:5232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4775208572753653208,707855735288267835,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:12⤵PID:5240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,4775208572753653208,707855735288267835,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4468 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3544
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4612
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59dc60aef38e7832217e7fa02d6f0d9f6
SHA14f8539dc7d5739b36fe976a932338f459d066db6
SHA2568a0ee0b6fafabb256571b691c2faf77c7244945faa749c72124d5eb43a197a32
SHA51218371541811910992c2b84a8eae7e997e8627640bdb60b9e82751389e50931db9b3e206d31f4d9d2dc3ca25ea3a82c0be413ecb0ef3ac227a14e54f406eaa7e7
-
Filesize
152B
MD57ac03b15b68af2d5cb5c8063057cc83e
SHA19b2d4db737f57322ff5c4bbddd765b3177f930ab
SHA256b90d7596301470b389842eecb46bd3a8e614260b0d374d5c35a36afb9c71a700
SHA512a5e9f40dd9040803046b0218fab6b058d49e5e2a3ada315e161fe9fc80ebb8d6d4442ccc1c98d19e561fc7c61bcf43d662fe2231cacacb447876a2113c2e3732
-
Filesize
6KB
MD5904c0f7bd8a06dc237e3b40f08d485bd
SHA1b89ac89f845770e636a57154647480b37286537b
SHA256e9bba1a05398f0e301b85a8876aeaa0f9ed7a5ec4214c86d883dd6040569656a
SHA512c402a7bec58c399da416c131722f884bed809e429f7d78364b2593e37d04659538609f1f265b67e8b02be320e9e20f4b3e613df51971e86e163fbe0f0ac8091d
-
Filesize
7KB
MD5bd405100851eae2b8d8ddd712394ece2
SHA1b88d613126d83b79521d27057b6781f8043d1779
SHA256fe6e7e84ce2f8b78e8e8fcde4cb04cf3a847c77925184d9eb2204b4a35f732b1
SHA51241cda033dda1670c302431fb945a602795b4831a8897fc7f7c3cfd3a5597bfbac171cacd15df461c9f1c50e21d97bdda6b48e382675b9045d5eebbe42950c5bb
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD51e42e1a3920d5ccd7a96da4dd8247981
SHA18416152a9e62c000c6ed45481d00f6d4cf81eb52
SHA2568056ba12737c5a54c5173ad775abbbae1e6ce6b9fc56c533dc02a3d7e24de0c7
SHA512125c7a40b831abf8c9f4acc5affc47855856cb28190296b94fff0f8bd58d9e0defba6328587e84e485bcddaab5705eddc115c968abaed8dbbe99de0436f00447