Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 11:48
Static task
static1
Behavioral task
behavioral1
Sample
12998636937734ba939dc1a062f704c7_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
12998636937734ba939dc1a062f704c7_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
12998636937734ba939dc1a062f704c7_JaffaCakes118.html
-
Size
460KB
-
MD5
12998636937734ba939dc1a062f704c7
-
SHA1
2621dfcdd4991b9d41877542f988fe1c801bd41f
-
SHA256
6378d441639d886e671aa747f85f3f26dc73006cbf5d73e016069d180d463f07
-
SHA512
e9250996469752bb53b7fb97aa307bf58142ed641bd4f243dc2fc0b9f741d2f6ce16649f4a6f141e6f28d595eadfc7c5e35dfe2085a2d63f3081e083d01b53b9
-
SSDEEP
6144:SbsMYod+X3oI+YwsMYod+X3oI+YNpsMYod+X3oI+YLsMYod+X3oI+YQ:i5d+X3U5d+X355d+X315d+X3+
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1088 msedge.exe 1088 msedge.exe 2616 msedge.exe 2616 msedge.exe 1580 identity_helper.exe 1580 identity_helper.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe 3140 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2616 wrote to memory of 2624 2616 msedge.exe 84 PID 2616 wrote to memory of 2624 2616 msedge.exe 84 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 4356 2616 msedge.exe 85 PID 2616 wrote to memory of 1088 2616 msedge.exe 86 PID 2616 wrote to memory of 1088 2616 msedge.exe 86 PID 2616 wrote to memory of 5036 2616 msedge.exe 87 PID 2616 wrote to memory of 5036 2616 msedge.exe 87 PID 2616 wrote to memory of 5036 2616 msedge.exe 87 PID 2616 wrote to memory of 5036 2616 msedge.exe 87 PID 2616 wrote to memory of 5036 2616 msedge.exe 87 PID 2616 wrote to memory of 5036 2616 msedge.exe 87 PID 2616 wrote to memory of 5036 2616 msedge.exe 87 PID 2616 wrote to memory of 5036 2616 msedge.exe 87 PID 2616 wrote to memory of 5036 2616 msedge.exe 87 PID 2616 wrote to memory of 5036 2616 msedge.exe 87 PID 2616 wrote to memory of 5036 2616 msedge.exe 87 PID 2616 wrote to memory of 5036 2616 msedge.exe 87 PID 2616 wrote to memory of 5036 2616 msedge.exe 87 PID 2616 wrote to memory of 5036 2616 msedge.exe 87 PID 2616 wrote to memory of 5036 2616 msedge.exe 87 PID 2616 wrote to memory of 5036 2616 msedge.exe 87 PID 2616 wrote to memory of 5036 2616 msedge.exe 87 PID 2616 wrote to memory of 5036 2616 msedge.exe 87 PID 2616 wrote to memory of 5036 2616 msedge.exe 87 PID 2616 wrote to memory of 5036 2616 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\12998636937734ba939dc1a062f704c7_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90ff846f8,0x7ff90ff84708,0x7ff90ff847182⤵PID:2624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11613847743281718679,10445683484499162013,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:4356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,11613847743281718679,10445683484499162013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,11613847743281718679,10445683484499162013,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:82⤵PID:5036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11613847743281718679,10445683484499162013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11613847743281718679,10445683484499162013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,11613847743281718679,10445683484499162013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:82⤵PID:4984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,11613847743281718679,10445683484499162013,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11613847743281718679,10445683484499162013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:12⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11613847743281718679,10445683484499162013,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:12⤵PID:3892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11613847743281718679,10445683484499162013,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:12⤵PID:4724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11613847743281718679,10445683484499162013,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:12⤵PID:1660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11613847743281718679,10445683484499162013,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4856 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3140
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:724
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2864
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5537815e7cc5c694912ac0308147852e4
SHA12ccdd9d9dc637db5462fe8119c0df261146c363c
SHA256b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
SHA51263969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
-
Filesize
152B
MD58b167567021ccb1a9fdf073fa9112ef0
SHA13baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA25626764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
SHA512726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
-
Filesize
6KB
MD55e476881c6c095616074a74438fd173d
SHA1fa58bb881e4d6705d0f4a5e0214ed33d13c4991f
SHA25650f1cdd6610f5b2c0c34d5b4c6091ba6f4969cc11be4bd7167e07120dc76bf58
SHA512bd97672b2ca694642f3b4582d50b04ae6203593f7d8377f3abd4eea5938b7a3b2bf4b085077e9a9cf251092633b31b0f18aaade9e90b202050f8fb5f4f0dba10
-
Filesize
6KB
MD5bf5b3f3ba3fea2c26bcffe3182e99c6a
SHA10aeae8ddc6f0cc40a7989d1f6ac59e11d2305daf
SHA256422dd462b4ecef4103dd356258f3a24f2089304b8845668d359b0f5a9d218865
SHA512008fd904f6ec4f23a0657297074dc8f83b7545db2c38390cdc96442d0f8e8ff71a1bc6dbab6a205e838bc0fc3a3f6a708a09716f7a28a58aa186307b2e8d0f33
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD56d71315c8350078ed8cc507a1075b7ef
SHA11ab21b67d2b6016a24320e2f8b655603e0d60c02
SHA2561824a0e104023a3e5cdbce4e3917eb745adf109f8b5fda9ee88e9f37f3ae1c29
SHA512a25de6aea1ab7b6970320f69f6afad18914c4597635b38aea4240e149b679ec916240bb5c0af1e72733aa333a7bb6fa5bf592ca1c58d70a567f794eec3bda45b