Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27/04/2024, 08:22
Static task
static1
Behavioral task
behavioral1
Sample
02d1e302c165e90b6795767d52360f80_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
02d1e302c165e90b6795767d52360f80_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
02d1e302c165e90b6795767d52360f80_JaffaCakes118.html
-
Size
213KB
-
MD5
02d1e302c165e90b6795767d52360f80
-
SHA1
596ace61eed67163fff88a67d547173de6ad3e67
-
SHA256
6ea2110bf54fb18e90867856906d14ec3525e3a5bf293b87ab9ac3554cd34dd2
-
SHA512
720b5a24d58d8caf0f88b202f4653755e8cff3e91f84f3a9983d10cae0233a0624251eaf523f0ccbfe925766ce4164af0efa282de778ede2805effee3ccd4343
-
SSDEEP
3072:Sn+JuJUiz2syfkMY+BES09JXAnyrZalI+YQ:SnjURsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2416 msedge.exe 2416 msedge.exe 3596 msedge.exe 3596 msedge.exe 2128 identity_helper.exe 2128 identity_helper.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe 5116 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe 3596 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3596 wrote to memory of 4884 3596 msedge.exe 85 PID 3596 wrote to memory of 4884 3596 msedge.exe 85 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 3556 3596 msedge.exe 86 PID 3596 wrote to memory of 2416 3596 msedge.exe 87 PID 3596 wrote to memory of 2416 3596 msedge.exe 87 PID 3596 wrote to memory of 5088 3596 msedge.exe 88 PID 3596 wrote to memory of 5088 3596 msedge.exe 88 PID 3596 wrote to memory of 5088 3596 msedge.exe 88 PID 3596 wrote to memory of 5088 3596 msedge.exe 88 PID 3596 wrote to memory of 5088 3596 msedge.exe 88 PID 3596 wrote to memory of 5088 3596 msedge.exe 88 PID 3596 wrote to memory of 5088 3596 msedge.exe 88 PID 3596 wrote to memory of 5088 3596 msedge.exe 88 PID 3596 wrote to memory of 5088 3596 msedge.exe 88 PID 3596 wrote to memory of 5088 3596 msedge.exe 88 PID 3596 wrote to memory of 5088 3596 msedge.exe 88 PID 3596 wrote to memory of 5088 3596 msedge.exe 88 PID 3596 wrote to memory of 5088 3596 msedge.exe 88 PID 3596 wrote to memory of 5088 3596 msedge.exe 88 PID 3596 wrote to memory of 5088 3596 msedge.exe 88 PID 3596 wrote to memory of 5088 3596 msedge.exe 88 PID 3596 wrote to memory of 5088 3596 msedge.exe 88 PID 3596 wrote to memory of 5088 3596 msedge.exe 88 PID 3596 wrote to memory of 5088 3596 msedge.exe 88 PID 3596 wrote to memory of 5088 3596 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\02d1e302c165e90b6795767d52360f80_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe726846f8,0x7ffe72684708,0x7ffe726847182⤵PID:4884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,18307596103913642263,5117309940157193256,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:3556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,18307596103913642263,5117309940157193256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,18307596103913642263,5117309940157193256,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:82⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,18307596103913642263,5117309940157193256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:12⤵PID:2368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,18307596103913642263,5117309940157193256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:12⤵PID:404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,18307596103913642263,5117309940157193256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4428 /prefetch:82⤵PID:4540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,18307596103913642263,5117309940157193256,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4428 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,18307596103913642263,5117309940157193256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:12⤵PID:3816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,18307596103913642263,5117309940157193256,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:12⤵PID:1240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,18307596103913642263,5117309940157193256,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:12⤵PID:4364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,18307596103913642263,5117309940157193256,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:12⤵PID:4576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,18307596103913642263,5117309940157193256,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2688 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5116
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2320
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4316
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54e96ed67859d0bafd47d805a71041f49
SHA17806c54ae29a6c8d01dcbc78e5525ddde321b16b
SHA256bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d
SHA512432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7
-
Filesize
152B
MD51cbd0e9a14155b7f5d4f542d09a83153
SHA127a442a921921d69743a8e4b76ff0b66016c4b76
SHA256243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c
SHA51217e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2e14c4a2-4761-411f-b671-6316979fd34b.tmp
Filesize6KB
MD5c33888089f2358239ae5bbfb3a1fd3f1
SHA1c4989f9e803444885edb06646674d3e59e193b63
SHA2564de46ea00220bc0107e940baabd4698746b9b4b7b633fce18f71d81ab38a3a1b
SHA512b7d899318b278a7e46142b445c8a609752c038d45c3b4649d8ed08e4ba0f02cdfa1c457b4a7852e2623755d9be61ccd3a0120a635f1cc8892b7e832d6dd99c86
-
Filesize
6KB
MD55a70f728d515fff03fa66934214b0733
SHA1e13e0fae3b10966118493e08341d134bb5f517f2
SHA256d661fa842d9e1083a3e38175123f39a0797e20ab153c8250d81a14d306c1de93
SHA51248b42adaf716f439821fa6679dd224186ed5d49cd0cfbb4ed5d221d26e4c51916b2b818b52fb4c6daea218fe43e4a9abdc3e822af6e525a1a803725e468c75f9
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD590926f4e6c588012d3a3837cd9c42fa0
SHA1b00d680d39a505506b1a5321ade1795926911b8d
SHA25635aaf2c85b555cf3064443ebb3bbb89ed64c44e0f13aea37e200160de7aa6a1d
SHA5123a73856d932cec224ee26658d0df0728e0a1c99f42711396f8720927987ade8681ce41e3289d69ad3ef57d7ebd416975b136038969f52979158baf78cbb1b9c1