Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 00:57
Static task
static1
Behavioral task
behavioral1
Sample
1ee75751e7d5942356dc3c5558f0104c_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1ee75751e7d5942356dc3c5558f0104c_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
1ee75751e7d5942356dc3c5558f0104c_JaffaCakes118.html
-
Size
219KB
-
MD5
1ee75751e7d5942356dc3c5558f0104c
-
SHA1
f7693e145867afc666ec9949316203cfe89ffb91
-
SHA256
d7c14ee8c01fab0092aabef8b8f8b9b0730335749e9148c1d01fa91917d3a9da
-
SHA512
07a74fb7a38662be7d6d106850fc4c7110e9184d41923122bbd67de19e839e3a86d84b1e9fc7acca0b7c4025c1e9a7b4c94ac9ea37b3b889ac2362645c146945
-
SSDEEP
1536:aUZxFb7XCYcolh2tWe1xvbXzGCxBr4ozp5OE3z0R2iYJnsqaYIrZf1EAYXQ6GtB8:aUxbdMDx5cfYJK62Bg+w
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3212 msedge.exe 3212 msedge.exe 4560 msedge.exe 4560 msedge.exe 3988 identity_helper.exe 3988 identity_helper.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe 4536 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe 4560 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4560 wrote to memory of 3532 4560 msedge.exe 85 PID 4560 wrote to memory of 3532 4560 msedge.exe 85 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 1040 4560 msedge.exe 86 PID 4560 wrote to memory of 3212 4560 msedge.exe 87 PID 4560 wrote to memory of 3212 4560 msedge.exe 87 PID 4560 wrote to memory of 3736 4560 msedge.exe 88 PID 4560 wrote to memory of 3736 4560 msedge.exe 88 PID 4560 wrote to memory of 3736 4560 msedge.exe 88 PID 4560 wrote to memory of 3736 4560 msedge.exe 88 PID 4560 wrote to memory of 3736 4560 msedge.exe 88 PID 4560 wrote to memory of 3736 4560 msedge.exe 88 PID 4560 wrote to memory of 3736 4560 msedge.exe 88 PID 4560 wrote to memory of 3736 4560 msedge.exe 88 PID 4560 wrote to memory of 3736 4560 msedge.exe 88 PID 4560 wrote to memory of 3736 4560 msedge.exe 88 PID 4560 wrote to memory of 3736 4560 msedge.exe 88 PID 4560 wrote to memory of 3736 4560 msedge.exe 88 PID 4560 wrote to memory of 3736 4560 msedge.exe 88 PID 4560 wrote to memory of 3736 4560 msedge.exe 88 PID 4560 wrote to memory of 3736 4560 msedge.exe 88 PID 4560 wrote to memory of 3736 4560 msedge.exe 88 PID 4560 wrote to memory of 3736 4560 msedge.exe 88 PID 4560 wrote to memory of 3736 4560 msedge.exe 88 PID 4560 wrote to memory of 3736 4560 msedge.exe 88 PID 4560 wrote to memory of 3736 4560 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1ee75751e7d5942356dc3c5558f0104c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffd329346f8,0x7ffd32934708,0x7ffd329347182⤵PID:3532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12569399176973924440,1589487732823636353,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:22⤵PID:1040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,12569399176973924440,1589487732823636353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,12569399176973924440,1589487732823636353,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:82⤵PID:3736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12569399176973924440,1589487732823636353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12569399176973924440,1589487732823636353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:3204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12569399176973924440,1589487732823636353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3700 /prefetch:82⤵PID:4848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12569399176973924440,1589487732823636353,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3700 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12569399176973924440,1589487732823636353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:12⤵PID:4924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12569399176973924440,1589487732823636353,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2236 /prefetch:12⤵PID:4888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12569399176973924440,1589487732823636353,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:12⤵PID:3484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12569399176973924440,1589487732823636353,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:12⤵PID:744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12569399176973924440,1589487732823636353,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1264 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4536
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2356
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1424
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5537815e7cc5c694912ac0308147852e4
SHA12ccdd9d9dc637db5462fe8119c0df261146c363c
SHA256b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
SHA51263969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
-
Filesize
152B
MD58b167567021ccb1a9fdf073fa9112ef0
SHA13baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA25626764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
SHA512726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
-
Filesize
1KB
MD5f48ac13e6a27d7e8fd77330e4a8e6104
SHA11d121a622ac4d6f90b234ecb0f6cc88746ac7f58
SHA256a2c6356e8f842adc903591a41dbf9b7f5c7955156b34857ea5f2c98f42b15fd8
SHA512ee0eef2a3b4bac99675e01d049814cad1772091d01f252ee95e264ce6eeb837dd5eaffb8227d213c45c3708e0ec772c7d34a166416cd4c5b07e4c29f37fe2164
-
Filesize
6KB
MD59feef3c9ec3bbf054df8660b27c51c88
SHA1477708a8c33ad2ac5b285411f83cf45e6fb7d16e
SHA2569b94781e7e8daefd2165382496ff69626ab6784410213e5ba1e2629c6ea9acc1
SHA512133113f046aa2e28664ddad393366d2ea6d7a77835ba632ea9d2cf0fe4fa2757fa726589e9987fc1033b89fd3adf6b18d0e2d1b9c0c9f274c3b3fa36297a53e0
-
Filesize
6KB
MD5f6f73775e5261abc404fa0ab9896918c
SHA18bada994a00856c32e42196770dd8aa219c8ca87
SHA2567ca3a55da22a5b9b78a68687d24cecefda602fa26cffea5773b75277145ae94d
SHA512e2c8c100970adbcd009acdcf802ed1e35af8a705be2418487d157981b6ce1608bb11466c44bc0e3a2888e296fcde2285370eb38dc684d69f850b55fa70460aae
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5ec48282abe24f76f603ed5e497545408
SHA149206e52433d867eb835250942d6f4f7adf38dca
SHA256db0a77c6fe52f4b97fde6b88d74ffef72868d8ea1786ac33ea7fd61311d1e58d
SHA512b50016dba211e738f8d190c001f0735a839da7fc0abedfa8084c29fa3b416c78871aed9b503e76e3e4c15f4d45910401c1d69ee339b52981b5bfc58a16d577f8