Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 10:24
Static task
static1
Behavioral task
behavioral1
Sample
124c76abf456677c7ca8d47f495c2e57_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
124c76abf456677c7ca8d47f495c2e57_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
124c76abf456677c7ca8d47f495c2e57_JaffaCakes118.html
-
Size
41KB
-
MD5
124c76abf456677c7ca8d47f495c2e57
-
SHA1
ce9596eb8ec69813502f24fbdda0899996f58a20
-
SHA256
71ef201fcacd3ab11149a1b920c08157f3e0f01df2a3b05621614df3daa3f695
-
SHA512
3bc76bbd2aeb2898aabdb5accf34eebfc5395aef2b2de11a638ebd4d338e527c18d56b3d8da78706997f1dec8686689af0ef536f7c928033cf2939caa9ec5807
-
SSDEEP
768:6pYCvtLZwvTK7ezXeErShPXyCQLkfGTz6f0IO4nGxKjWCeCPC+CWCYhzt0:6qCvtLZwvTK7ezXeErShPXyCQLkfGTzv
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4856 msedge.exe 4856 msedge.exe 3264 msedge.exe 3264 msedge.exe 1576 identity_helper.exe 1576 identity_helper.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe 2516 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3264 wrote to memory of 2172 3264 msedge.exe 83 PID 3264 wrote to memory of 2172 3264 msedge.exe 83 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 3484 3264 msedge.exe 84 PID 3264 wrote to memory of 4856 3264 msedge.exe 85 PID 3264 wrote to memory of 4856 3264 msedge.exe 85 PID 3264 wrote to memory of 2664 3264 msedge.exe 86 PID 3264 wrote to memory of 2664 3264 msedge.exe 86 PID 3264 wrote to memory of 2664 3264 msedge.exe 86 PID 3264 wrote to memory of 2664 3264 msedge.exe 86 PID 3264 wrote to memory of 2664 3264 msedge.exe 86 PID 3264 wrote to memory of 2664 3264 msedge.exe 86 PID 3264 wrote to memory of 2664 3264 msedge.exe 86 PID 3264 wrote to memory of 2664 3264 msedge.exe 86 PID 3264 wrote to memory of 2664 3264 msedge.exe 86 PID 3264 wrote to memory of 2664 3264 msedge.exe 86 PID 3264 wrote to memory of 2664 3264 msedge.exe 86 PID 3264 wrote to memory of 2664 3264 msedge.exe 86 PID 3264 wrote to memory of 2664 3264 msedge.exe 86 PID 3264 wrote to memory of 2664 3264 msedge.exe 86 PID 3264 wrote to memory of 2664 3264 msedge.exe 86 PID 3264 wrote to memory of 2664 3264 msedge.exe 86 PID 3264 wrote to memory of 2664 3264 msedge.exe 86 PID 3264 wrote to memory of 2664 3264 msedge.exe 86 PID 3264 wrote to memory of 2664 3264 msedge.exe 86 PID 3264 wrote to memory of 2664 3264 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\124c76abf456677c7ca8d47f495c2e57_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3af846f8,0x7ffe3af84708,0x7ffe3af847182⤵PID:2172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,1892343716304254042,3226197609485405592,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:22⤵PID:3484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,1892343716304254042,3226197609485405592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,1892343716304254042,3226197609485405592,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:82⤵PID:2664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1892343716304254042,3226197609485405592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1892343716304254042,3226197609485405592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:1456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,1892343716304254042,3226197609485405592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:82⤵PID:1148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,1892343716304254042,3226197609485405592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1892343716304254042,3226197609485405592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:12⤵PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1892343716304254042,3226197609485405592,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:12⤵PID:4208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1892343716304254042,3226197609485405592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:12⤵PID:3988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1892343716304254042,3226197609485405592,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:12⤵PID:3432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,1892343716304254042,3226197609485405592,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4804 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2516
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1492
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1656
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dbac49e66219979194c79f1cf1cb3dd1
SHA14ef87804a04d51ae1fac358f92382548b27f62f2
SHA256f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562
SHA512bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1
-
Filesize
152B
MD5a9e55f5864d6e2afd2fd84e25a3bc228
SHA1a5efcff9e3df6252c7fe8535d505235f82aab276
SHA2560f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452
SHA51212f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75
-
Filesize
174B
MD5bee92706dae6da257505d1a88bde30a4
SHA10a4b4e856594718f8c9059f0c70228b1bdd60243
SHA2564783eae0c3cb7533e572dc2f1ad3e877eb07bac6977fddfdee407e1ae8f67ca9
SHA5120716eed89d04efdb0b0674d6ec5ee80b8480e6e1543ed5c9ed52cbac939a8ca61fc1ffceb9cd26640a1d441efba962e54e17e20a6acf83a09ac7812d30905efb
-
Filesize
5KB
MD5eab5e202afe47744a4ad2476cabf0ffc
SHA18b8e9b2ccb33f66b727fd1a1e556558e4ee81ddf
SHA25620dfbd0b76c6c21351c191378ccb442f4e00d3958ee1ae16b374aeb4d39a89d1
SHA512880ce163615ceca8f1f7762dff55d445631f2da580edc154db7499b60e4cd08444c7085644cd0f72b6a513687b20ad702d7794d05f3c6aa6e9ec4d1f3e50a9af
-
Filesize
6KB
MD5496e2bc1241257f01ab7501c6b2215b2
SHA149f395bcc1d7595e0d8e8d203bd3e8181b4e0e5f
SHA256ce57689fc53154ab4556cef5215a4f8ab30656651c53378ffcdb79e480b26c74
SHA5125008778cd9f3a0038f6edaec73029a370df63090f6ea7941422eb3567f582c0f9de06dae269b40d83874176594739fc5ff38a5357e8018cf21976cbdb4c0b8bd
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD5082b82c9c453930b85fa4b98d0531523
SHA1716e5bca3d0eef90439e4835a6ea759b4b26a705
SHA2566a6c4d29ab893a28b81bd73c7b663f5bea9fd69fdf824105f6952f21ec6c17a3
SHA512e7738b81af7c55d9a2efa2eff9b05ebd7338f1e598791d617331fa88061365ec3307e5e71127bef8b665b4499a20d8c68cc21eddce0e82d0296bc841460f9bc2