Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 02:07
Static task
static1
Behavioral task
behavioral1
Sample
1132d6cd1eb54bbb381979e0df8cbecd_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1132d6cd1eb54bbb381979e0df8cbecd_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
1132d6cd1eb54bbb381979e0df8cbecd_JaffaCakes118.html
-
Size
64KB
-
MD5
1132d6cd1eb54bbb381979e0df8cbecd
-
SHA1
2fb5c97a23b004ee1935c0a5b188726c0230fd81
-
SHA256
dfcd4f54beecbfacf7f532a486d9d61fdaf6e3e3f0fb7d6538ff5951d38f68cf
-
SHA512
82facfdd1ce7d0a5b094f1a9e30bdead9122088a50f8f02d5fedf577e2933135182b314e045be859f81a449ac4ff46a0f5688d7599d1a16b77085a6c6ce5211e
-
SSDEEP
768:JiRgcMaehAx99uOHAoTy+CZkoTnMdtbBnfBgN8/0OgcR/QFVG8c//Ijkk5nnfgcI:JrA9Tcec0tbrgaUcoNnfgT
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4920 msedge.exe 4920 msedge.exe 1784 msedge.exe 1784 msedge.exe 1260 identity_helper.exe 1260 identity_helper.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe 1784 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1784 wrote to memory of 2812 1784 msedge.exe 84 PID 1784 wrote to memory of 2812 1784 msedge.exe 84 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 2008 1784 msedge.exe 85 PID 1784 wrote to memory of 4920 1784 msedge.exe 86 PID 1784 wrote to memory of 4920 1784 msedge.exe 86 PID 1784 wrote to memory of 3620 1784 msedge.exe 87 PID 1784 wrote to memory of 3620 1784 msedge.exe 87 PID 1784 wrote to memory of 3620 1784 msedge.exe 87 PID 1784 wrote to memory of 3620 1784 msedge.exe 87 PID 1784 wrote to memory of 3620 1784 msedge.exe 87 PID 1784 wrote to memory of 3620 1784 msedge.exe 87 PID 1784 wrote to memory of 3620 1784 msedge.exe 87 PID 1784 wrote to memory of 3620 1784 msedge.exe 87 PID 1784 wrote to memory of 3620 1784 msedge.exe 87 PID 1784 wrote to memory of 3620 1784 msedge.exe 87 PID 1784 wrote to memory of 3620 1784 msedge.exe 87 PID 1784 wrote to memory of 3620 1784 msedge.exe 87 PID 1784 wrote to memory of 3620 1784 msedge.exe 87 PID 1784 wrote to memory of 3620 1784 msedge.exe 87 PID 1784 wrote to memory of 3620 1784 msedge.exe 87 PID 1784 wrote to memory of 3620 1784 msedge.exe 87 PID 1784 wrote to memory of 3620 1784 msedge.exe 87 PID 1784 wrote to memory of 3620 1784 msedge.exe 87 PID 1784 wrote to memory of 3620 1784 msedge.exe 87 PID 1784 wrote to memory of 3620 1784 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1132d6cd1eb54bbb381979e0df8cbecd_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbfd346f8,0x7fffbfd34708,0x7fffbfd347182⤵PID:2812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,15756868950762720842,10964538172157848060,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:22⤵PID:2008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,15756868950762720842,10964538172157848060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,15756868950762720842,10964538172157848060,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:82⤵PID:3620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15756868950762720842,10964538172157848060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:3388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15756868950762720842,10964538172157848060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:2752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,15756868950762720842,10964538172157848060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:82⤵PID:2384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,15756868950762720842,10964538172157848060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15756868950762720842,10964538172157848060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:12⤵PID:3652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15756868950762720842,10964538172157848060,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:12⤵PID:1840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15756868950762720842,10964538172157848060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:12⤵PID:1476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,15756868950762720842,10964538172157848060,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:1756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,15756868950762720842,10964538172157848060,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5504 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1924
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4644
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2228
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54e96ed67859d0bafd47d805a71041f49
SHA17806c54ae29a6c8d01dcbc78e5525ddde321b16b
SHA256bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d
SHA512432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7
-
Filesize
152B
MD51cbd0e9a14155b7f5d4f542d09a83153
SHA127a442a921921d69743a8e4b76ff0b66016c4b76
SHA256243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c
SHA51217e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d
-
Filesize
5KB
MD5a0d7c25462f29014030885a06d031d05
SHA1c9521a97a4064ec92eeccf6d1ef14d1ea7f744b0
SHA256e9b4eb99ee18e6e6f24e68efbf1a458ae72cba4e5198624028572bfe85244d7b
SHA512540a9668b42bd92322d54ef2d4d5443997762dead4841c29ec5b13a575d25b076217257d58c205a1ae3edb5dd40d9e68b153930a148c0fe95771ffbba1691bf2
-
Filesize
6KB
MD5a8fa945e081daf66355b9d686750e212
SHA1a4990ef38118aa562ab395b3c3623a3c3200263c
SHA25687bcc2dd6c37a79e75a0cdabf72a9e7aa6c0c964d262f2a9f68ce3f55e82248c
SHA51243f38fe0d7ea5cc04bfb47569b5ca94177016645b48101daf5cf4befb143dfdf1a9c91897a000b2e395b0092ddf0bd070b13cc0a807e4942e1b5b5bc706fe880
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5df6551f662614609ba5693e1fcd01671
SHA1dfefd36dc97d4281d89b1ac9e7228a14642de0dd
SHA256b7cc18136db7b716c211fc07b82761c069143987b823d13daa8ca1d3167a72cc
SHA512c34530fb0363e598f982faccde702c61aa328c98eb622ddc9b2dca68120c00e7a9e1c5d99e1d852b8c4c0ec0a555bb7d37a562fdd1fc19b38eb8a4bdb83b18af