Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2024, 12:25
Static task
static1
Behavioral task
behavioral1
Sample
17a8c90dbb435af68434a7f8f48bf140_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
17a8c90dbb435af68434a7f8f48bf140_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
17a8c90dbb435af68434a7f8f48bf140_JaffaCakes118.html
-
Size
4KB
-
MD5
17a8c90dbb435af68434a7f8f48bf140
-
SHA1
f66aa5a816d8e0b16b88cdc3921aefd3c735cdb6
-
SHA256
3edaa5a1c3e025a305aff969c52547a46994b8402448442e1c6258f0f5b4a32b
-
SHA512
647107b04e6d9a1438f1aabfe3cdcc07e3878706fe1cab04ebcae912192f430396ae0b34dd16434eb6e6b48f19a19cac5296a26c08ff855868a054e99d4d634a
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8obEBSo8t:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDc
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1456 msedge.exe 1456 msedge.exe 4324 msedge.exe 4324 msedge.exe 2684 identity_helper.exe 2684 identity_helper.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe 4324 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4324 wrote to memory of 3832 4324 msedge.exe 85 PID 4324 wrote to memory of 3832 4324 msedge.exe 85 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 4424 4324 msedge.exe 86 PID 4324 wrote to memory of 1456 4324 msedge.exe 87 PID 4324 wrote to memory of 1456 4324 msedge.exe 87 PID 4324 wrote to memory of 5092 4324 msedge.exe 88 PID 4324 wrote to memory of 5092 4324 msedge.exe 88 PID 4324 wrote to memory of 5092 4324 msedge.exe 88 PID 4324 wrote to memory of 5092 4324 msedge.exe 88 PID 4324 wrote to memory of 5092 4324 msedge.exe 88 PID 4324 wrote to memory of 5092 4324 msedge.exe 88 PID 4324 wrote to memory of 5092 4324 msedge.exe 88 PID 4324 wrote to memory of 5092 4324 msedge.exe 88 PID 4324 wrote to memory of 5092 4324 msedge.exe 88 PID 4324 wrote to memory of 5092 4324 msedge.exe 88 PID 4324 wrote to memory of 5092 4324 msedge.exe 88 PID 4324 wrote to memory of 5092 4324 msedge.exe 88 PID 4324 wrote to memory of 5092 4324 msedge.exe 88 PID 4324 wrote to memory of 5092 4324 msedge.exe 88 PID 4324 wrote to memory of 5092 4324 msedge.exe 88 PID 4324 wrote to memory of 5092 4324 msedge.exe 88 PID 4324 wrote to memory of 5092 4324 msedge.exe 88 PID 4324 wrote to memory of 5092 4324 msedge.exe 88 PID 4324 wrote to memory of 5092 4324 msedge.exe 88 PID 4324 wrote to memory of 5092 4324 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\17a8c90dbb435af68434a7f8f48bf140_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff873f446f8,0x7ff873f44708,0x7ff873f447182⤵PID:3832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,9321706632193910646,3715704741586115396,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:22⤵PID:4424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,9321706632193910646,3715704741586115396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,9321706632193910646,3715704741586115396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2540 /prefetch:82⤵PID:5092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9321706632193910646,3715704741586115396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:3704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9321706632193910646,3715704741586115396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,9321706632193910646,3715704741586115396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:82⤵PID:4144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,9321706632193910646,3715704741586115396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9321706632193910646,3715704741586115396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:12⤵PID:3984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9321706632193910646,3715704741586115396,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:12⤵PID:1596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9321706632193910646,3715704741586115396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:12⤵PID:1672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,9321706632193910646,3715704741586115396,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:12⤵PID:2556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,9321706632193910646,3715704741586115396,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:768
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1668
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1580
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dbac49e66219979194c79f1cf1cb3dd1
SHA14ef87804a04d51ae1fac358f92382548b27f62f2
SHA256f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562
SHA512bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1
-
Filesize
152B
MD5a9e55f5864d6e2afd2fd84e25a3bc228
SHA1a5efcff9e3df6252c7fe8535d505235f82aab276
SHA2560f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452
SHA51212f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75
-
Filesize
292B
MD5e307e23ee0c7b60d7ab63f6278995451
SHA14e44bcd2d24454b9a9f69c30e5c48c2298316591
SHA256d8997359a6fda0c38e3e037aac6ce130dec6411efc0a1f6c15154cdc39b4d250
SHA512db1d832756059724d54964a259393d2f9bbc84d32dbcc652da46786e02c0e23e379554675b19b21784e05777d71544f6d03ea3bde61b35372adb14901e151972
-
Filesize
5KB
MD525a3b43310158528fcec23669617c3c1
SHA14a69a72b29c91f257e1c1d9190aede4152a0df3f
SHA2567ba08a168e840cd3d06d8eaab0e5db520b8c3377ee05a3517cbe524c68a662bf
SHA5124cf149ff7de62567a3973893796128b29f3d3ad5b46c062899f022e580fce7f7e3094e66274e3eb946df9c4d89d506d2b263ea622ea8e0a09fca3f4ee992da40
-
Filesize
6KB
MD53b151afc709a76da0b96e4a10954e35d
SHA1c8d3e4a391697f9edd3711fed7b62ddb4642e3f4
SHA256ed215e90278a06f72d4e93461b0b1442afe1ae7d859ec7fa9f86d87f9db7517e
SHA512fd15bfd1cb18feb1d0cd49e109de754739d2b9c125cece0aebf546828f82ecf44753d968e86cda9577ea400db2d4ffa6435739ec3f691c04e479a7360613557f
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5fd02146295e74f9fc5219f45df4bdecd
SHA15baf42c4790056c735cb75d259f065c8369cf1a8
SHA2564c44d5565e453a0f5fcf84c0d01bcd5fa7f97b7a1f62e6ee8dccde6c031cc005
SHA512f52f2f4a04f2b93ab32e185a17cc952be857503c73574c70995b9212344e3bc0b73c0887975bc67775d7a6fb08a828ddbe08767ec1703b7d1b873bcd56d513c5