Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28/04/2024, 20:43
Static task
static1
Behavioral task
behavioral1
Sample
06077850008453e6b2ea60c8371df20a_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
06077850008453e6b2ea60c8371df20a_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
06077850008453e6b2ea60c8371df20a_JaffaCakes118.html
-
Size
33KB
-
MD5
06077850008453e6b2ea60c8371df20a
-
SHA1
74d369ec809d7ea69251494121f1295dd4cd04f9
-
SHA256
5c071151209ddb1e83b0580ab0132752f4365f3a73bb5697b778e8bb15ac6174
-
SHA512
32e0e362b54bed02a0f200d8eb2365628a5d3a30be50985fd0f40e36201686c131d8da44bdece803de7a590539984e86ac125a66fc073c400a0cd24703a982e0
-
SSDEEP
192:uW/c9b5nhNnQjxn5Q/UnQie3NnFnQOkEntIunQTbntnQDMCPAskrb2nxvFtmeC+u:XQ/bhCgxvFwcVC4kFZUUFwCou
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3396 msedge.exe 3396 msedge.exe 2024 msedge.exe 2024 msedge.exe 4360 identity_helper.exe 4360 identity_helper.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2024 wrote to memory of 3576 2024 msedge.exe 83 PID 2024 wrote to memory of 3576 2024 msedge.exe 83 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 4260 2024 msedge.exe 84 PID 2024 wrote to memory of 3396 2024 msedge.exe 85 PID 2024 wrote to memory of 3396 2024 msedge.exe 85 PID 2024 wrote to memory of 3256 2024 msedge.exe 86 PID 2024 wrote to memory of 3256 2024 msedge.exe 86 PID 2024 wrote to memory of 3256 2024 msedge.exe 86 PID 2024 wrote to memory of 3256 2024 msedge.exe 86 PID 2024 wrote to memory of 3256 2024 msedge.exe 86 PID 2024 wrote to memory of 3256 2024 msedge.exe 86 PID 2024 wrote to memory of 3256 2024 msedge.exe 86 PID 2024 wrote to memory of 3256 2024 msedge.exe 86 PID 2024 wrote to memory of 3256 2024 msedge.exe 86 PID 2024 wrote to memory of 3256 2024 msedge.exe 86 PID 2024 wrote to memory of 3256 2024 msedge.exe 86 PID 2024 wrote to memory of 3256 2024 msedge.exe 86 PID 2024 wrote to memory of 3256 2024 msedge.exe 86 PID 2024 wrote to memory of 3256 2024 msedge.exe 86 PID 2024 wrote to memory of 3256 2024 msedge.exe 86 PID 2024 wrote to memory of 3256 2024 msedge.exe 86 PID 2024 wrote to memory of 3256 2024 msedge.exe 86 PID 2024 wrote to memory of 3256 2024 msedge.exe 86 PID 2024 wrote to memory of 3256 2024 msedge.exe 86 PID 2024 wrote to memory of 3256 2024 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\06077850008453e6b2ea60c8371df20a_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff44ee46f8,0x7fff44ee4708,0x7fff44ee47182⤵PID:3576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,3201317432910955630,9412948212604951273,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:4260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,3201317432910955630,9412948212604951273,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,3201317432910955630,9412948212604951273,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:82⤵PID:3256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3201317432910955630,9412948212604951273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:1656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3201317432910955630,9412948212604951273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:3684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,3201317432910955630,9412948212604951273,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4348 /prefetch:82⤵PID:2872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,3201317432910955630,9412948212604951273,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4348 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3201317432910955630,9412948212604951273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:12⤵PID:4156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3201317432910955630,9412948212604951273,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:12⤵PID:1768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3201317432910955630,9412948212604951273,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:12⤵PID:4828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3201317432910955630,9412948212604951273,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:12⤵PID:2012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,3201317432910955630,9412948212604951273,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2112
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2000
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5850f27f857369bf7fe83c613d2ec35cb
SHA17677a061c6fd2a030b44841bfb32da0abc1dbefb
SHA256a7db700e067222e55e323a9ffc71a92f59829e81021e2607cec0d2ec6faf602a
SHA5127b1efa002b7a1a23973bff0618fb4a82cd0c5193df55cd960c7516caa63509587fd8b36f3aea6db01ece368065865af6472365b820fadce720b64b561ab5f401
-
Filesize
6KB
MD5df5cbbf0a97b338b54a453080e5a1bb1
SHA1a1f3358dca339267d2fafe49198e6ece412e2e09
SHA256bcae0327e85942d7e4703a38f44eddd8dba7be72de4282b24f53eb1fc2b7d8ba
SHA5126e33a961bf342e73f5d70914483805267eeb45910eea8ebf5f0fbde41cfd121d601e0a35f4e27a6eac45ffc529fac1e208bdd18f325cd07d034d08e220e77fbf
-
Filesize
6KB
MD5df237167a1fa68ee17866d1ac527984f
SHA10f2f54259afcdf8cc3ec0f25d4050c83e7efc61c
SHA2569916e96cdc1f9e4d6c31c396dfd1e9b25a32fc6d1b66ca07138c4745b4243f59
SHA5120143c8a5cf495feced9dd953fd7c8e968ae2f3bf0cbbe8f142a3fc4ff43611a31f0de508e18e9dbe783b14b0b3585f03f1244138174abdde5d2b65302d404875
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD5f82415f965c768e513df64522635f1e8
SHA1c703024974f6defa2b3e09deb9f991bc81a08331
SHA25675bfe5fc4a3170783c97e105ecd1564e7ce3a95f7e51b5f397d0ef4117c8f8d7
SHA51290a79d13e4d603be40caf4bd4f6b3a0d890798557f028a86805ad41601b108d2ad402d238471eaadce92ea6eb1eab8d7216865ad939b7472f402135b8d269f58