Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28/04/2024, 20:43
Static task
static1
Behavioral task
behavioral1
Sample
0607bfba35dd7dc32b51561cb648c7bf_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0607bfba35dd7dc32b51561cb648c7bf_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0607bfba35dd7dc32b51561cb648c7bf_JaffaCakes118.html
-
Size
355KB
-
MD5
0607bfba35dd7dc32b51561cb648c7bf
-
SHA1
19e3a0193bb2e386b5cf215e0a940d0fd421d385
-
SHA256
767a9fc3f49b1fe71abbe6ee75f37297d79dbaf2129c3f883044401f3a88b562
-
SHA512
7d83297749c99d9c55b2ad8a0b231c6300dff0f313d3a697ae2c860f458d34dd36729d274ab4c56f15522940372dcfc02060d496f8f33fd8c3a55aa410e7720d
-
SSDEEP
6144:EqsMYod+X3oI+Y8ssXwnGsMYod+X3oI+YQ:EI5d+X3vsj5d+X3+
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1208 msedge.exe 1208 msedge.exe 1676 msedge.exe 1676 msedge.exe 3216 identity_helper.exe 3216 identity_helper.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1676 wrote to memory of 2948 1676 msedge.exe 84 PID 1676 wrote to memory of 2948 1676 msedge.exe 84 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 2060 1676 msedge.exe 85 PID 1676 wrote to memory of 1208 1676 msedge.exe 86 PID 1676 wrote to memory of 1208 1676 msedge.exe 86 PID 1676 wrote to memory of 4880 1676 msedge.exe 87 PID 1676 wrote to memory of 4880 1676 msedge.exe 87 PID 1676 wrote to memory of 4880 1676 msedge.exe 87 PID 1676 wrote to memory of 4880 1676 msedge.exe 87 PID 1676 wrote to memory of 4880 1676 msedge.exe 87 PID 1676 wrote to memory of 4880 1676 msedge.exe 87 PID 1676 wrote to memory of 4880 1676 msedge.exe 87 PID 1676 wrote to memory of 4880 1676 msedge.exe 87 PID 1676 wrote to memory of 4880 1676 msedge.exe 87 PID 1676 wrote to memory of 4880 1676 msedge.exe 87 PID 1676 wrote to memory of 4880 1676 msedge.exe 87 PID 1676 wrote to memory of 4880 1676 msedge.exe 87 PID 1676 wrote to memory of 4880 1676 msedge.exe 87 PID 1676 wrote to memory of 4880 1676 msedge.exe 87 PID 1676 wrote to memory of 4880 1676 msedge.exe 87 PID 1676 wrote to memory of 4880 1676 msedge.exe 87 PID 1676 wrote to memory of 4880 1676 msedge.exe 87 PID 1676 wrote to memory of 4880 1676 msedge.exe 87 PID 1676 wrote to memory of 4880 1676 msedge.exe 87 PID 1676 wrote to memory of 4880 1676 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0607bfba35dd7dc32b51561cb648c7bf_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8ba346f8,0x7fff8ba34708,0x7fff8ba347182⤵PID:2948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,17663990550003611335,15563247896250262829,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:22⤵PID:2060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,17663990550003611335,15563247896250262829,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,17663990550003611335,15563247896250262829,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:82⤵PID:4880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17663990550003611335,15563247896250262829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:12⤵PID:5108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17663990550003611335,15563247896250262829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:4276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,17663990550003611335,15563247896250262829,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4404 /prefetch:82⤵PID:2260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,17663990550003611335,15563247896250262829,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4404 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17663990550003611335,15563247896250262829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4472 /prefetch:12⤵PID:2628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17663990550003611335,15563247896250262829,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4448 /prefetch:12⤵PID:4884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17663990550003611335,15563247896250262829,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:12⤵PID:4132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,17663990550003611335,15563247896250262829,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:12⤵PID:4456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,17663990550003611335,15563247896250262829,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3424 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3932
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4520
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2600
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58b2290ca03b4ca5fe52d82550c7e7d69
SHA120583a7851a906444204ce8ba4fa51153e6cd494
SHA256f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2
SHA512704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d
-
Filesize
152B
MD5919c29d42fb6034fee2f5de14d573c63
SHA124a2e1042347b3853344157239bde3ed699047a8
SHA25617cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141
SHA512bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d
-
Filesize
6KB
MD5ad957f6d0bc41b73a6ac1276a84147e9
SHA155a44124e92bbf60d6fa9a645ef1aa71a9eb75dc
SHA256bda35dcd91aa43de3d2863f65a4aab548e11ac16dd065c0e0edb8ac1749dcc91
SHA5125a72b1dc9d4baeabc732f08dd8740ffeb4e83f153eba60ab98a4a27e96a93ee53a1df123400bba4ae7946c9166a2e1a8e7be72749692451bb066434c1cbab1e1
-
Filesize
6KB
MD5ce1c6559a2867fcacecd24cabcb74c31
SHA171ecfe666738934845a9bd4de0952671354726c9
SHA25694bf7dc538d9614bf3ae27a4e2f1e3d6fa8e55c63c25e095b279817666a1d452
SHA5125b88069fdf704e7a2948b8925de7f230f4fc1ab5be25bcd8f91b9e02a8f2c8e2fece822a7aa78fd4a070c49d882d27568b51a741f60078724f541b1c68c3d5e0
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD5068b940e6bddc317a6cb8f01a3a1ed0e
SHA136f7412ea98d42f082319f0a610f9721648d6919
SHA256839c0499f3627178234f0a64370e5c15fc3111af799ec5571c986b277f072fee
SHA512021d9b94140b2d37f6e5355b91357adcfb1e414ad84274b4572b3b4dc0d314d2ac6012b79175b939ea150353d7f07ea35d4da313075b919cb63e9cbde57c7eeb