Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 07:44
Static task
static1
Behavioral task
behavioral1
Sample
004dbca3fe23cab9d6ec8b2a83147fb7_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
004dbca3fe23cab9d6ec8b2a83147fb7_JaffaCakes118.html
Resource
win10v2004-20240412-en
General
-
Target
004dbca3fe23cab9d6ec8b2a83147fb7_JaffaCakes118.html
-
Size
233KB
-
MD5
004dbca3fe23cab9d6ec8b2a83147fb7
-
SHA1
0ade03734e7f638a91465865fdcf3b7e01f77c50
-
SHA256
8841b24183fef11027ccf007b10d8cda99135931bd7379e51f78967259eccabe
-
SHA512
7855e9f6bbeccad2ec3e68c84adaddde8e120deade5f463b983e715e1735229778c6989eba6c0d808949e0efab08afb18c02fc81ba1675bd999939f83ce417c5
-
SSDEEP
3072:S/yfkMY+BES09JXAnyrZalI+YAf+yfkMY+BES09JXAnyrZalI+YQ:SKsMYod+X3oI+YMbsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 880 msedge.exe 880 msedge.exe 1464 msedge.exe 1464 msedge.exe 3180 identity_helper.exe 3180 identity_helper.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe 4356 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1464 wrote to memory of 3688 1464 msedge.exe 84 PID 1464 wrote to memory of 3688 1464 msedge.exe 84 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 3968 1464 msedge.exe 85 PID 1464 wrote to memory of 880 1464 msedge.exe 86 PID 1464 wrote to memory of 880 1464 msedge.exe 86 PID 1464 wrote to memory of 4992 1464 msedge.exe 87 PID 1464 wrote to memory of 4992 1464 msedge.exe 87 PID 1464 wrote to memory of 4992 1464 msedge.exe 87 PID 1464 wrote to memory of 4992 1464 msedge.exe 87 PID 1464 wrote to memory of 4992 1464 msedge.exe 87 PID 1464 wrote to memory of 4992 1464 msedge.exe 87 PID 1464 wrote to memory of 4992 1464 msedge.exe 87 PID 1464 wrote to memory of 4992 1464 msedge.exe 87 PID 1464 wrote to memory of 4992 1464 msedge.exe 87 PID 1464 wrote to memory of 4992 1464 msedge.exe 87 PID 1464 wrote to memory of 4992 1464 msedge.exe 87 PID 1464 wrote to memory of 4992 1464 msedge.exe 87 PID 1464 wrote to memory of 4992 1464 msedge.exe 87 PID 1464 wrote to memory of 4992 1464 msedge.exe 87 PID 1464 wrote to memory of 4992 1464 msedge.exe 87 PID 1464 wrote to memory of 4992 1464 msedge.exe 87 PID 1464 wrote to memory of 4992 1464 msedge.exe 87 PID 1464 wrote to memory of 4992 1464 msedge.exe 87 PID 1464 wrote to memory of 4992 1464 msedge.exe 87 PID 1464 wrote to memory of 4992 1464 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\004dbca3fe23cab9d6ec8b2a83147fb7_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7dbe46f8,0x7ffa7dbe4708,0x7ffa7dbe47182⤵PID:3688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,1648938536715872734,12181948695122797729,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵PID:3968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,1648938536715872734,12181948695122797729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,1648938536715872734,12181948695122797729,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:82⤵PID:4992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1648938536715872734,12181948695122797729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:4564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1648938536715872734,12181948695122797729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:12⤵PID:1180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,1648938536715872734,12181948695122797729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 /prefetch:82⤵PID:3164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,1648938536715872734,12181948695122797729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1648938536715872734,12181948695122797729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:12⤵PID:4828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1648938536715872734,12181948695122797729,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:12⤵PID:2500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1648938536715872734,12181948695122797729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:12⤵PID:1804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,1648938536715872734,12181948695122797729,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:12⤵PID:424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,1648938536715872734,12181948695122797729,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4324 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4356
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1136
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1804
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a9519bc058003dbea34765176083739e
SHA1ef49b8790219eaddbdacb7fc97d3d05433b8575c
SHA256e034683bc434a09f5d0293cb786e6a3943b902614f9211d42bed47759164d38b
SHA512a1b67ccf313173c560ead25671c64de65e3e2599251926e33ce8399fde682fce5cb20f36ee330fcd8bb8f7a9c00ef432da56c9b02dfd7d3f02865f390c342b53
-
Filesize
152B
MD5cb138796dbfb37877fcae3430bb1e2a7
SHA182bb82178c07530e42eca6caf3178d66527558bc
SHA25650c55ba7baeebe1fa4573118edbca59010d659ea42761148618fb3af8a1c9bdd
SHA512287471cccbe33e08015d6fc35e0bcdca0ec79bebc3a58f6a340b7747b5b2257b33651574bc83ed529aef2ba94be6e68968e59d2a8ef5f733dce9df6404ad7cc5
-
Filesize
5KB
MD5d08aceff13b182017b37b35328d57b15
SHA112810a17d7e465c61b673ea8f7c5473b9a1f00af
SHA256567f0f6677ef6255601661ac34bcbfe0b7c6b3ffe377e87823431cab25eefc7d
SHA51260e9478e5e306b301d288945e9223b0cb319bfad19907cff26dab63f95bff2d732e8c46598c1bfce96f7761fe80dd90da7178e11d8e6e0906be2cbfc739744c3
-
Filesize
6KB
MD51626a0fc7053dd96f1c689b4bcf33f3f
SHA1a7bf56fbe531875ced0fd82e848bb913c41a228b
SHA2560779c77b672fe44946f1efd390988b19fcb041c3056b64d7275e3537ef493714
SHA512fdbcf3685939dfc90e6f53eb5a342c51ac2496ffd27d040e3eb698ae0f3daf7ad2c8f0fa116ca089795d5b367c25044eb9378d9408283c09dfef6b116624d005
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5d4b79e3e8982dc4d68d717df4abc15d6
SHA1a7e8fe48be5f94ee411288c8812d5d1c4b43ad53
SHA2565b5d84a0c9c1308025f675e5724b687de1b71a42a21f507918b98e37192eb8e6
SHA512986d59ce28f8e79250f9d06b140c1ec78f757121f87c0a6b263fa8404b997a1246cc246b24cc31b676ce33a21bb96ad93c91b2ffa7d3e11c96636360ca55bd64