Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
03/05/2024, 04:01
Static task
static1
Behavioral task
behavioral1
Sample
0f9fb62e3be4a732c8c5f1ee236cf6b3_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0f9fb62e3be4a732c8c5f1ee236cf6b3_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0f9fb62e3be4a732c8c5f1ee236cf6b3_JaffaCakes118.html
-
Size
94KB
-
MD5
0f9fb62e3be4a732c8c5f1ee236cf6b3
-
SHA1
eaf557acc946c6c854719d0d3d9b45869e9c1ea0
-
SHA256
8624e17ef6307f872460ef182f86295d370fbc7f7d1a29c7c196776425416167
-
SHA512
b951a26a1549c2dc2394f8e53b71a8463dd80f467e830061f756ab2f380522bfc5844d20369783695835254ceb5514b1c1bf8a9917118cf563dd75595f7727af
-
SSDEEP
1536:WMLiNfUZJA4kjgfCzlWy8Djf7LIPeFLu1jUZSy7BdkrY8mgHC+qpEyW:WAi46YBdkrY8mgHC+qpEyW
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4112 msedge.exe 4112 msedge.exe 2964 msedge.exe 2964 msedge.exe 2772 identity_helper.exe 2772 identity_helper.exe 2800 msedge.exe 2800 msedge.exe 2800 msedge.exe 2800 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe 2964 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2964 wrote to memory of 4788 2964 msedge.exe 83 PID 2964 wrote to memory of 4788 2964 msedge.exe 83 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4500 2964 msedge.exe 84 PID 2964 wrote to memory of 4112 2964 msedge.exe 85 PID 2964 wrote to memory of 4112 2964 msedge.exe 85 PID 2964 wrote to memory of 2096 2964 msedge.exe 86 PID 2964 wrote to memory of 2096 2964 msedge.exe 86 PID 2964 wrote to memory of 2096 2964 msedge.exe 86 PID 2964 wrote to memory of 2096 2964 msedge.exe 86 PID 2964 wrote to memory of 2096 2964 msedge.exe 86 PID 2964 wrote to memory of 2096 2964 msedge.exe 86 PID 2964 wrote to memory of 2096 2964 msedge.exe 86 PID 2964 wrote to memory of 2096 2964 msedge.exe 86 PID 2964 wrote to memory of 2096 2964 msedge.exe 86 PID 2964 wrote to memory of 2096 2964 msedge.exe 86 PID 2964 wrote to memory of 2096 2964 msedge.exe 86 PID 2964 wrote to memory of 2096 2964 msedge.exe 86 PID 2964 wrote to memory of 2096 2964 msedge.exe 86 PID 2964 wrote to memory of 2096 2964 msedge.exe 86 PID 2964 wrote to memory of 2096 2964 msedge.exe 86 PID 2964 wrote to memory of 2096 2964 msedge.exe 86 PID 2964 wrote to memory of 2096 2964 msedge.exe 86 PID 2964 wrote to memory of 2096 2964 msedge.exe 86 PID 2964 wrote to memory of 2096 2964 msedge.exe 86 PID 2964 wrote to memory of 2096 2964 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0f9fb62e3be4a732c8c5f1ee236cf6b3_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe080f46f8,0x7ffe080f4708,0x7ffe080f47182⤵PID:4788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,1107238680160567307,1858574147112760085,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:4500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,1107238680160567307,1858574147112760085,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,1107238680160567307,1858574147112760085,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:82⤵PID:2096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1107238680160567307,1858574147112760085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:5000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1107238680160567307,1858574147112760085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:1784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1107238680160567307,1858574147112760085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:12⤵PID:1100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1107238680160567307,1858574147112760085,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:12⤵PID:1576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,1107238680160567307,1858574147112760085,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:82⤵PID:384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,1107238680160567307,1858574147112760085,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1107238680160567307,1858574147112760085,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:12⤵PID:4084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,1107238680160567307,1858574147112760085,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,1107238680160567307,1858574147112760085,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4592 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2800
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2420
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3176
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52a70f1bd4da893a67660d6432970788d
SHA1ddf4047e0d468f56ea0c0d8ff078a86a0bb62873
SHA256c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561
SHA51226b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343
-
Filesize
152B
MD5fbe1ce4d182aaffb80de94263be1dd35
SHA1bc6c9827aa35a136a7d79be9e606ff359e2ac3ea
SHA2560021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51
SHA5123fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f
-
Filesize
178B
MD5efb3e41ddcb00d4e436d59962fe73c4d
SHA14b9f2cbd664cf2136cd6966774f9ee04b4efa46a
SHA256edc776d59064e412098066a07cba55cbabb1e7d18534e1292d34003961ad3bb6
SHA51285a53139125a0e589b222ebee00d1c593eb24c8059b9f3f86196f8ef346cf7fc988493bb6f5cebf7aec2d0debc5017eff291b04e8aa37180d1ec5a6e2bb362ba
-
Filesize
5KB
MD5091eee993748c7ccc897b84359d9ee91
SHA11c190bed67fa86bdc07ab13fae9cd717e4abd3b1
SHA2563c40f86fd94d1e98ecc575efe0d803dbfcdd07ccc7237d73540542016517c4f0
SHA5122388eefa72117b64978c3c9c26032c43cda70502f953c67fc688fb34f65296e36b325f4b4f75f59244d943e829b81ea550305958ffab5324028906093f891bf1
-
Filesize
6KB
MD529f0847ba8dae332a8112564886c2182
SHA1051f3b81b5f851f0e0820b634de3a5e76d6aa5cd
SHA2565a3fdb721d3f3fd3f3ad82cede2e79033057b362aaa627f09da1ff514fd4ebcb
SHA5127240ab1ede27db20a7021a6e1771d4efe4c4a109dd60c389484f6d6323a26738b0dcef849b9ab047f64ddfad4a7f6829fa017129050eca5507181cfabadae3f5
-
Filesize
6KB
MD5027eb79f0ee5cd41ae99db0542c46137
SHA15881213aa1a3ceb4b0002d47b057c081b19f95a1
SHA256fc5af11c286e3ee316111e0faaf7dd5eb7db4d96e940854dbbfc353afe270ec7
SHA5121351588554a534597e132674b28c95eff79a4158c55559329931071fcac6c8e7a6a5985814c23cf761adf83522e092f2b4bb9bbc97b94303c8fb3fcf731b7fbe
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD53fb38373ca38a4de72b49c67ca931738
SHA197f9b90c613e9fe89103cb4d9958167978b7e64a
SHA256d11a5bc2700bd227c0cb3b0da76c1300efbddf29f9d544f3711c10e19be567a5
SHA51290f9ff4557db5495aad0addba6e61b96dccb149e1b9f1b0834ad7235badc2c3d3a405763ad85e495ba88c14d853b767e498f9164cb5832df4d11efdcd66a58ce