Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04/05/2024, 14:07
Static task
static1
Behavioral task
behavioral1
Sample
130f4354c6190460174b7da23635e584_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
130f4354c6190460174b7da23635e584_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
130f4354c6190460174b7da23635e584_JaffaCakes118.html
-
Size
77KB
-
MD5
130f4354c6190460174b7da23635e584
-
SHA1
d9035d1b0a9eca6b7fe2ce2ff13b536106815922
-
SHA256
55068decc96308b1d606b60b36eb79a5914f1e5ee46d04da4968df47b66e91b4
-
SHA512
5e64c1a16d93dee1b4a2c0b6aa8ed8dec26dcb1f52f6d44745057608ca3b2dcd13a425d43b2a28bee756721d95f2b1bae78bb13f6e2fbdce0e32ff559891d6bd
-
SSDEEP
1536:WtVw3eVMf/stMf/ESuqIL16/pXSRUSgyFvTzrrBNWSfE:mVij9IIRfSBFbzrrPWUE
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1060 msedge.exe 1060 msedge.exe 3656 msedge.exe 3656 msedge.exe 2436 identity_helper.exe 2436 identity_helper.exe 4280 msedge.exe 4280 msedge.exe 4280 msedge.exe 4280 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe 3656 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3656 wrote to memory of 3464 3656 msedge.exe 83 PID 3656 wrote to memory of 3464 3656 msedge.exe 83 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 2224 3656 msedge.exe 84 PID 3656 wrote to memory of 1060 3656 msedge.exe 85 PID 3656 wrote to memory of 1060 3656 msedge.exe 85 PID 3656 wrote to memory of 1092 3656 msedge.exe 86 PID 3656 wrote to memory of 1092 3656 msedge.exe 86 PID 3656 wrote to memory of 1092 3656 msedge.exe 86 PID 3656 wrote to memory of 1092 3656 msedge.exe 86 PID 3656 wrote to memory of 1092 3656 msedge.exe 86 PID 3656 wrote to memory of 1092 3656 msedge.exe 86 PID 3656 wrote to memory of 1092 3656 msedge.exe 86 PID 3656 wrote to memory of 1092 3656 msedge.exe 86 PID 3656 wrote to memory of 1092 3656 msedge.exe 86 PID 3656 wrote to memory of 1092 3656 msedge.exe 86 PID 3656 wrote to memory of 1092 3656 msedge.exe 86 PID 3656 wrote to memory of 1092 3656 msedge.exe 86 PID 3656 wrote to memory of 1092 3656 msedge.exe 86 PID 3656 wrote to memory of 1092 3656 msedge.exe 86 PID 3656 wrote to memory of 1092 3656 msedge.exe 86 PID 3656 wrote to memory of 1092 3656 msedge.exe 86 PID 3656 wrote to memory of 1092 3656 msedge.exe 86 PID 3656 wrote to memory of 1092 3656 msedge.exe 86 PID 3656 wrote to memory of 1092 3656 msedge.exe 86 PID 3656 wrote to memory of 1092 3656 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\130f4354c6190460174b7da23635e584_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffabfa46f8,0x7fffabfa4708,0x7fffabfa47182⤵PID:3464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,1617371903659801125,13437463629555317832,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:22⤵PID:2224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,1617371903659801125,13437463629555317832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,1617371903659801125,13437463629555317832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:82⤵PID:1092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1617371903659801125,13437463629555317832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:12⤵PID:4872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1617371903659801125,13437463629555317832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:4020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,1617371903659801125,13437463629555317832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:82⤵PID:3104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,1617371903659801125,13437463629555317832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1617371903659801125,13437463629555317832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:12⤵PID:5432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1617371903659801125,13437463629555317832,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:12⤵PID:3040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1617371903659801125,13437463629555317832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:12⤵PID:5748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,1617371903659801125,13437463629555317832,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:12⤵PID:6028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,1617371903659801125,13437463629555317832,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4848 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4280
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5996
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2672
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58b2290ca03b4ca5fe52d82550c7e7d69
SHA120583a7851a906444204ce8ba4fa51153e6cd494
SHA256f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2
SHA512704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d
-
Filesize
152B
MD5919c29d42fb6034fee2f5de14d573c63
SHA124a2e1042347b3853344157239bde3ed699047a8
SHA25617cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141
SHA512bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d
-
Filesize
181B
MD563b28243cbdd2d7bff997522b94f13ee
SHA195eb9ed4558d2fd3012bf35c1ae07c569f5703cc
SHA2569b6b38f4becb7a7e060354d5b71842faa31df83e58bde152804c2a80c65083cd
SHA51282893a5dc8c332ca05624bcb3bf2bec2b3331785661413608df9ef822205da7b3d515b73d2612f6b500c44488fa85522f27eba52ef568bf4b2408095981b1670
-
Filesize
6KB
MD59220a2ca890f0b1b16590175cd7dfb0a
SHA12b677a10f15a8ea4f64d9e0a2f1686ee42b166c0
SHA256b93bf7850b2de64d78788a76f7553529bc65648b64e482315102b04ee8ae6307
SHA512dd6a1f925a1fb136c72db482c0c99f2478bfa6a3cb507c083706424410355763b18bd9b7a3e360e5592251c22683b5949c85d03577e33d68ace398f80b7b6969
-
Filesize
5KB
MD5dc72d1f633a846324c20072f80cb1006
SHA1c5c80d8e134a60d3adaf7def3c4417058d7244c7
SHA2562e5e73dfc858ddc4f6099bafa25ca577aa9d538ac736512ba119471b63f87a09
SHA512d13d9156c7ac79af4db436d7dbef96aa92cb6053e1d8b8ffa56ed52447e30a83669e985174bb59705ff053e4c196cb3fe8a510bd52d30fca9ea4bf590f59fb75
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD59c8ca3e23630a5465dc647879f4b8133
SHA12de821897d5d92a006e18bf198bbcef09a0f75df
SHA256fa95c143f71769aa2ffea2a94c78734305a77a8b9ba182cac33e388e07c2d9bc
SHA512e2cdc3151437735bb00425ed075a6ae5b083ef49f9d2252cc4374a4b62368d06c41341f9e5d713bd588a445675ca47208e92343b43926d8eec9e5b66af07b041