Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27/04/2024, 10:11
Static task
static1
Behavioral task
behavioral1
Sample
0304ceeeabbbe5d9b6194524a600522e_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0304ceeeabbbe5d9b6194524a600522e_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0304ceeeabbbe5d9b6194524a600522e_JaffaCakes118.html
-
Size
172KB
-
MD5
0304ceeeabbbe5d9b6194524a600522e
-
SHA1
6d1e259eb514aa9a412a2f23d26a61ccc89fbfaf
-
SHA256
74992f901a1b82dabe87b995a89df61a7c56674312d47776dafa98d1e2ba22de
-
SHA512
1b8e28734fe42933e90ef9640b70c8b9e6584b1e69774182896f4f77d10f81c29d63d4b5835a75a96cd05c3ea05696edd7416c0020eb4ec97bc633ab51d21a2c
-
SSDEEP
3072:SYslhugyrpUM1KcJ7dVS2Ut7tGXCLEybhOrds5xTB7B/Gwv4IVPmkaPyfkMY+BEu:SYWUgyrpUM1KcJ7dVS2Ut7tGXCLEybhv
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 976 msedge.exe 976 msedge.exe 1572 msedge.exe 1572 msedge.exe 4596 identity_helper.exe 4596 identity_helper.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe 4764 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1572 wrote to memory of 2008 1572 msedge.exe 84 PID 1572 wrote to memory of 2008 1572 msedge.exe 84 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 2912 1572 msedge.exe 85 PID 1572 wrote to memory of 976 1572 msedge.exe 86 PID 1572 wrote to memory of 976 1572 msedge.exe 86 PID 1572 wrote to memory of 5060 1572 msedge.exe 87 PID 1572 wrote to memory of 5060 1572 msedge.exe 87 PID 1572 wrote to memory of 5060 1572 msedge.exe 87 PID 1572 wrote to memory of 5060 1572 msedge.exe 87 PID 1572 wrote to memory of 5060 1572 msedge.exe 87 PID 1572 wrote to memory of 5060 1572 msedge.exe 87 PID 1572 wrote to memory of 5060 1572 msedge.exe 87 PID 1572 wrote to memory of 5060 1572 msedge.exe 87 PID 1572 wrote to memory of 5060 1572 msedge.exe 87 PID 1572 wrote to memory of 5060 1572 msedge.exe 87 PID 1572 wrote to memory of 5060 1572 msedge.exe 87 PID 1572 wrote to memory of 5060 1572 msedge.exe 87 PID 1572 wrote to memory of 5060 1572 msedge.exe 87 PID 1572 wrote to memory of 5060 1572 msedge.exe 87 PID 1572 wrote to memory of 5060 1572 msedge.exe 87 PID 1572 wrote to memory of 5060 1572 msedge.exe 87 PID 1572 wrote to memory of 5060 1572 msedge.exe 87 PID 1572 wrote to memory of 5060 1572 msedge.exe 87 PID 1572 wrote to memory of 5060 1572 msedge.exe 87 PID 1572 wrote to memory of 5060 1572 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0304ceeeabbbe5d9b6194524a600522e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa184e46f8,0x7ffa184e4708,0x7ffa184e47182⤵PID:2008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,8079067582129117297,11999171779621324166,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:22⤵PID:2912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,8079067582129117297,11999171779621324166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,8079067582129117297,11999171779621324166,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:82⤵PID:5060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8079067582129117297,11999171779621324166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8079067582129117297,11999171779621324166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:1700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,8079067582129117297,11999171779621324166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4468 /prefetch:82⤵PID:3612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,8079067582129117297,11999171779621324166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4468 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8079067582129117297,11999171779621324166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:12⤵PID:3296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8079067582129117297,11999171779621324166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:12⤵PID:428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8079067582129117297,11999171779621324166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:12⤵PID:388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,8079067582129117297,11999171779621324166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:12⤵PID:2968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,8079067582129117297,11999171779621324166,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4764
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4832
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1672
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dbac49e66219979194c79f1cf1cb3dd1
SHA14ef87804a04d51ae1fac358f92382548b27f62f2
SHA256f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562
SHA512bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1
-
Filesize
152B
MD5a9e55f5864d6e2afd2fd84e25a3bc228
SHA1a5efcff9e3df6252c7fe8535d505235f82aab276
SHA2560f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452
SHA51212f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75
-
Filesize
6KB
MD55a92770f649f9ae469e72273a6f9c7e2
SHA1eac69e64e4ceaf8ea54c8cbfba1183c8bb59f218
SHA256329b624b01517330335c38240e8ce3726e51bd63487c3be8638095175ecaded3
SHA5124939d221664245e69a0b56853bd4ed470f2d86b66d308dfe79b4987253c00687bfce83e465245ee9f16923999b8babe366abc7d0c0d3310faf814c431faa7f6a
-
Filesize
6KB
MD52acb169d14b45bbe4a867c4694f824e8
SHA1e61c8b3bfe03c0a6d3a514b67168084a1c69a8a0
SHA256dfa55a67d750ce7dd4c187946536c657b7177def117d7161b82f7684c3ab189e
SHA512db704b1a5a1840ea62e5fb7646ef23ab285ea11445528d665569912f7c212732e84b825bfee3114cb5b25918d1387211561512945eb7523eeb216c8e8051a6ac
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD5480a58c54fb2f8c4df28e554b1688acd
SHA11cdf0f7621264f1a53ad4dd2ab435ffca6c6dd85
SHA256a64e5c250d9a7fab6e21ac5cacf87b702021a3f9f9e4906a605f67fdb0a11964
SHA51226a842d15166ba92738954d72cecf045e5fdb6f9660fd7c4cc294c7ea5aeeae43a4c53253f54014489e065147b601d4bd01ce1bf3f7f40dafcb6df19cdfc53d0