Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
03/05/2024, 04:16
Static task
static1
Behavioral task
behavioral1
Sample
0fa5b2340c007915dc74991a1a93c836_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0fa5b2340c007915dc74991a1a93c836_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0fa5b2340c007915dc74991a1a93c836_JaffaCakes118.html
-
Size
36KB
-
MD5
0fa5b2340c007915dc74991a1a93c836
-
SHA1
272aaa92deef76915fdb3eeb958ef83cf832c943
-
SHA256
3c27ba918a98e971f0e4641a7282183c963619868a381415b61bff396498e556
-
SHA512
33db4eae07032f5e33d18a546caec793c70d37c8503f1030de783622dd75bf623e33fca5cec541a89766589bb3e8cda3d53bfae055846411c4042d32c3280f0a
-
SSDEEP
384:07o+ATTkarJmHf53894R0URR6U+UrmHl5nCxYnYINVJEFXVL5GfLxiw6R1Y24V4/:eotTAarJ8mZrhCxYn1PFYGQH
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2844 msedge.exe 2844 msedge.exe 1368 msedge.exe 1368 msedge.exe 2316 identity_helper.exe 2316 identity_helper.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe 1368 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1368 wrote to memory of 3884 1368 msedge.exe 83 PID 1368 wrote to memory of 3884 1368 msedge.exe 83 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 4832 1368 msedge.exe 84 PID 1368 wrote to memory of 2844 1368 msedge.exe 85 PID 1368 wrote to memory of 2844 1368 msedge.exe 85 PID 1368 wrote to memory of 4520 1368 msedge.exe 86 PID 1368 wrote to memory of 4520 1368 msedge.exe 86 PID 1368 wrote to memory of 4520 1368 msedge.exe 86 PID 1368 wrote to memory of 4520 1368 msedge.exe 86 PID 1368 wrote to memory of 4520 1368 msedge.exe 86 PID 1368 wrote to memory of 4520 1368 msedge.exe 86 PID 1368 wrote to memory of 4520 1368 msedge.exe 86 PID 1368 wrote to memory of 4520 1368 msedge.exe 86 PID 1368 wrote to memory of 4520 1368 msedge.exe 86 PID 1368 wrote to memory of 4520 1368 msedge.exe 86 PID 1368 wrote to memory of 4520 1368 msedge.exe 86 PID 1368 wrote to memory of 4520 1368 msedge.exe 86 PID 1368 wrote to memory of 4520 1368 msedge.exe 86 PID 1368 wrote to memory of 4520 1368 msedge.exe 86 PID 1368 wrote to memory of 4520 1368 msedge.exe 86 PID 1368 wrote to memory of 4520 1368 msedge.exe 86 PID 1368 wrote to memory of 4520 1368 msedge.exe 86 PID 1368 wrote to memory of 4520 1368 msedge.exe 86 PID 1368 wrote to memory of 4520 1368 msedge.exe 86 PID 1368 wrote to memory of 4520 1368 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0fa5b2340c007915dc74991a1a93c836_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0x100,0x104,0xe4,0x108,0x7fffca0e46f8,0x7fffca0e4708,0x7fffca0e47182⤵PID:3884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,448373440768353212,13912575710567042124,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:22⤵PID:4832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,448373440768353212,13912575710567042124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,448373440768353212,13912575710567042124,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:82⤵PID:4520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,448373440768353212,13912575710567042124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:2428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,448373440768353212,13912575710567042124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,448373440768353212,13912575710567042124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:82⤵PID:4312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,448373440768353212,13912575710567042124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,448373440768353212,13912575710567042124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:12⤵PID:2904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,448373440768353212,13912575710567042124,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:12⤵PID:2880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,448373440768353212,13912575710567042124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:12⤵PID:4968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,448373440768353212,13912575710567042124,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:12⤵PID:4900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,448373440768353212,13912575710567042124,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2664 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5080
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4128
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3956
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59dc60aef38e7832217e7fa02d6f0d9f6
SHA14f8539dc7d5739b36fe976a932338f459d066db6
SHA2568a0ee0b6fafabb256571b691c2faf77c7244945faa749c72124d5eb43a197a32
SHA51218371541811910992c2b84a8eae7e997e8627640bdb60b9e82751389e50931db9b3e206d31f4d9d2dc3ca25ea3a82c0be413ecb0ef3ac227a14e54f406eaa7e7
-
Filesize
152B
MD57ac03b15b68af2d5cb5c8063057cc83e
SHA19b2d4db737f57322ff5c4bbddd765b3177f930ab
SHA256b90d7596301470b389842eecb46bd3a8e614260b0d374d5c35a36afb9c71a700
SHA512a5e9f40dd9040803046b0218fab6b058d49e5e2a3ada315e161fe9fc80ebb8d6d4442ccc1c98d19e561fc7c61bcf43d662fe2231cacacb447876a2113c2e3732
-
Filesize
1KB
MD5015d7627350ebdc7a775a274b9fa3ff5
SHA16ee548e253762f1213ae86f236c087dfe9c2b7c8
SHA25609bd53f0ba36c6dd9e39d986516cd9cdcf6a42b4a46a9e919b175eacb2bf9522
SHA512c721cf7d1fd9023e4d149ad4a292d91e1216cf0b7aaf1c6ef8c830c61fb615c1e330a1e9d4c7874a873d1cc8a1b66c7c9940da001580fb755c7258c3345b3e93
-
Filesize
5KB
MD5c6b8043451c2f4f2e6fde2070c43ea67
SHA1eaec6d0c76ab34b955721b159102d4ba87f94106
SHA256cd46bf4593a4c5da99b359b6e9b3415e3575e7238aac18574d333ed7639ca489
SHA5122de3a6d8cbe0a0268f7848f96012a5567b60e118bf9e27bc005d0a1856da6325468943b4bc5f7e35b70279de357155ff58ac3a354ba69ec651679ceba9b336f6
-
Filesize
6KB
MD5b96e42327b75e44e1128ede639a8701a
SHA18b330ba4f37e67dfc3dc6ab6d08023e98b902278
SHA2561b4e8fb0bf00623ace0817ccf87df41badd3f23a719b22fda41a431bbbec5d79
SHA51237f03402676daf4b73f26e102baa16fa2f51d75a33fb07405619a69153e5a800ad3a14cd0bad0221fde5676ecd02c38a9e25d33cc731222e7157babf868d3dc8
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD536967e47f4c2cfe9a1952eea239f2b92
SHA100bebd192f14a1c6ac930f98109f083f6035ccf4
SHA2564fa43c910e21679152b41ded9acb4c7d0307dd317698cc812a16406b039e11a3
SHA5128fa696a29c9bd604a902b0b683d7aa213c9a4000d3c0e039cfe0eee817ccd1cb9a4e32b8ecba3fe4f5c900604a7aa798b92cb387e8afb0d8e330e04f54cd1816