Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 07:47
Static task
static1
Behavioral task
behavioral1
Sample
004efcd50f593be409bdd0c5173f8192_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
004efcd50f593be409bdd0c5173f8192_JaffaCakes118.html
Resource
win10v2004-20240412-en
General
-
Target
004efcd50f593be409bdd0c5173f8192_JaffaCakes118.html
-
Size
32KB
-
MD5
004efcd50f593be409bdd0c5173f8192
-
SHA1
a135e71bed6fcf27e2fd38ffcaa302cc71de4383
-
SHA256
a8a8acaad89baaaa9e97d3af46c4c70ebae93f8e372980b15f1c2aea3eb9a4e1
-
SHA512
2de1387fa0ab960a9a846701bd583828ed9b16bc8774625479aa5c26492f8050c42e453e8ced8b81bb11631f1859f8a89aeb96e28a44462fc95c1308b016a71f
-
SSDEEP
192:4S/sXSh0/foqzCY1zRHciXA0GOCa8iHfzOaGRKpe6VT+XvlgK2QqYb9JSARhX9:4DvB3t8iHfzOFKpe++uK2Qqk9JSARhX9
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1400 msedge.exe 1400 msedge.exe 3420 msedge.exe 3420 msedge.exe 3948 identity_helper.exe 3948 identity_helper.exe 5340 msedge.exe 5340 msedge.exe 5340 msedge.exe 5340 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe 3420 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3420 wrote to memory of 4384 3420 msedge.exe 88 PID 3420 wrote to memory of 4384 3420 msedge.exe 88 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1220 3420 msedge.exe 90 PID 3420 wrote to memory of 1400 3420 msedge.exe 91 PID 3420 wrote to memory of 1400 3420 msedge.exe 91 PID 3420 wrote to memory of 3736 3420 msedge.exe 92 PID 3420 wrote to memory of 3736 3420 msedge.exe 92 PID 3420 wrote to memory of 3736 3420 msedge.exe 92 PID 3420 wrote to memory of 3736 3420 msedge.exe 92 PID 3420 wrote to memory of 3736 3420 msedge.exe 92 PID 3420 wrote to memory of 3736 3420 msedge.exe 92 PID 3420 wrote to memory of 3736 3420 msedge.exe 92 PID 3420 wrote to memory of 3736 3420 msedge.exe 92 PID 3420 wrote to memory of 3736 3420 msedge.exe 92 PID 3420 wrote to memory of 3736 3420 msedge.exe 92 PID 3420 wrote to memory of 3736 3420 msedge.exe 92 PID 3420 wrote to memory of 3736 3420 msedge.exe 92 PID 3420 wrote to memory of 3736 3420 msedge.exe 92 PID 3420 wrote to memory of 3736 3420 msedge.exe 92 PID 3420 wrote to memory of 3736 3420 msedge.exe 92 PID 3420 wrote to memory of 3736 3420 msedge.exe 92 PID 3420 wrote to memory of 3736 3420 msedge.exe 92 PID 3420 wrote to memory of 3736 3420 msedge.exe 92 PID 3420 wrote to memory of 3736 3420 msedge.exe 92 PID 3420 wrote to memory of 3736 3420 msedge.exe 92
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\004efcd50f593be409bdd0c5173f8192_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c86a46f8,0x7ff9c86a4708,0x7ff9c86a47182⤵PID:4384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,2730826155445536271,7702000164312178836,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:1220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,2730826155445536271,7702000164312178836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,2730826155445536271,7702000164312178836,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:82⤵PID:3736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2730826155445536271,7702000164312178836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:1388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2730826155445536271,7702000164312178836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,2730826155445536271,7702000164312178836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 /prefetch:82⤵PID:4484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,2730826155445536271,7702000164312178836,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2730826155445536271,7702000164312178836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:12⤵PID:920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2730826155445536271,7702000164312178836,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:12⤵PID:864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2730826155445536271,7702000164312178836,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:12⤵PID:1668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,2730826155445536271,7702000164312178836,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:12⤵PID:3224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,2730826155445536271,7702000164312178836,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5340
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:744
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3592
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a9519bc058003dbea34765176083739e
SHA1ef49b8790219eaddbdacb7fc97d3d05433b8575c
SHA256e034683bc434a09f5d0293cb786e6a3943b902614f9211d42bed47759164d38b
SHA512a1b67ccf313173c560ead25671c64de65e3e2599251926e33ce8399fde682fce5cb20f36ee330fcd8bb8f7a9c00ef432da56c9b02dfd7d3f02865f390c342b53
-
Filesize
152B
MD5cb138796dbfb37877fcae3430bb1e2a7
SHA182bb82178c07530e42eca6caf3178d66527558bc
SHA25650c55ba7baeebe1fa4573118edbca59010d659ea42761148618fb3af8a1c9bdd
SHA512287471cccbe33e08015d6fc35e0bcdca0ec79bebc3a58f6a340b7747b5b2257b33651574bc83ed529aef2ba94be6e68968e59d2a8ef5f733dce9df6404ad7cc5
-
Filesize
5KB
MD587f14e1b78bef6751243f200048c1c64
SHA1aec06dfeac804f49d000f59c59af24e8ff3d1a6a
SHA25629e754c96b9dbf23434348b11a2ca4ebdebfa9bd3d6987a8bedd0030dbce5092
SHA512665f30ef1b4e72374b6dd1e79923adf7d88461ccd8fd613b92108275895e06bc82437ea5d63c5ed935b57460c990d6bae86319bf3561117eddf87686099a0115
-
Filesize
6KB
MD5e5d4bfbd790f1db84931489b73b8f495
SHA113193e10a7060a9eb206fca437f58ac813d72bef
SHA2561f002981a88e98be4467cd017c41cbf770199ee14af2c90595239d0f73b111c6
SHA512696670c186612a83a50a13a68b4fdbaa1589a23c891e520784e4eea6c1addea8a0df30dd23df6fb028fc3c82dc504069126fed9e5ac150bbf23acdf225958bc1
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5a76eef22cfe736650e53d06b9a79731e
SHA1b6ac3c8d9dd3fbd1bf67f24e4e16cf7f7ed8b87b
SHA256e40f45024181ee4ed4d1f9c7547e7507979b059829bc3581b26bb686d99ac29a
SHA512d5b575fb9e973a91ae259c96c8c6b871b0924c437b9d49841dc05589549e090181a292a63726be5a99b9075e2c66c497735dd436fec9f345de78ee599649b6f5