Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 19:46
Static task
static1
Behavioral task
behavioral1
Sample
21754ed18014cd62467a8fb72a026bdf_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
21754ed18014cd62467a8fb72a026bdf_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
21754ed18014cd62467a8fb72a026bdf_JaffaCakes118.html
-
Size
17KB
-
MD5
21754ed18014cd62467a8fb72a026bdf
-
SHA1
3d6d36e3a7efa3821e943eea0779cd6e4cfc2b35
-
SHA256
3973c1385934e89c2ac83c8a464fd7c0e64420ead6834fd66b1d42eb5c502237
-
SHA512
aad5b2b84899368abf2595baeb94d0eed6aaddb1da910bf42343be902ebcc764cf1feddb507ec085bbb70f7d60b6c401ec20d0afdc71e4c70c105f5f26113ac0
-
SSDEEP
384:clDsRLgx5xnvLTMEw6W0v7C7HIjMJofb7fnCW:Rkfnv8sW0TCD2fb7fnCW
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3020 msedge.exe 3020 msedge.exe 4076 msedge.exe 4076 msedge.exe 3364 identity_helper.exe 3364 identity_helper.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe 4076 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4076 wrote to memory of 2240 4076 msedge.exe 83 PID 4076 wrote to memory of 2240 4076 msedge.exe 83 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3500 4076 msedge.exe 84 PID 4076 wrote to memory of 3020 4076 msedge.exe 85 PID 4076 wrote to memory of 3020 4076 msedge.exe 85 PID 4076 wrote to memory of 4024 4076 msedge.exe 86 PID 4076 wrote to memory of 4024 4076 msedge.exe 86 PID 4076 wrote to memory of 4024 4076 msedge.exe 86 PID 4076 wrote to memory of 4024 4076 msedge.exe 86 PID 4076 wrote to memory of 4024 4076 msedge.exe 86 PID 4076 wrote to memory of 4024 4076 msedge.exe 86 PID 4076 wrote to memory of 4024 4076 msedge.exe 86 PID 4076 wrote to memory of 4024 4076 msedge.exe 86 PID 4076 wrote to memory of 4024 4076 msedge.exe 86 PID 4076 wrote to memory of 4024 4076 msedge.exe 86 PID 4076 wrote to memory of 4024 4076 msedge.exe 86 PID 4076 wrote to memory of 4024 4076 msedge.exe 86 PID 4076 wrote to memory of 4024 4076 msedge.exe 86 PID 4076 wrote to memory of 4024 4076 msedge.exe 86 PID 4076 wrote to memory of 4024 4076 msedge.exe 86 PID 4076 wrote to memory of 4024 4076 msedge.exe 86 PID 4076 wrote to memory of 4024 4076 msedge.exe 86 PID 4076 wrote to memory of 4024 4076 msedge.exe 86 PID 4076 wrote to memory of 4024 4076 msedge.exe 86 PID 4076 wrote to memory of 4024 4076 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\21754ed18014cd62467a8fb72a026bdf_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9aba546f8,0x7ff9aba54708,0x7ff9aba547182⤵PID:2240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,9964678570272566970,16893589508791686356,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:22⤵PID:3500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,9964678570272566970,16893589508791686356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,9964678570272566970,16893589508791686356,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:82⤵PID:4024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,9964678570272566970,16893589508791686356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:1904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,9964678570272566970,16893589508791686356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:1608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,9964678570272566970,16893589508791686356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:82⤵PID:3852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,9964678570272566970,16893589508791686356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,9964678570272566970,16893589508791686356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:12⤵PID:1804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,9964678570272566970,16893589508791686356,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:12⤵PID:5116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,9964678570272566970,16893589508791686356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:12⤵PID:3024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,9964678570272566970,16893589508791686356,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:12⤵PID:4288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,9964678570272566970,16893589508791686356,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4792 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3168
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4564
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4280
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Filesize230B
MD58734b5341363bf29cc7a71059d01b8fa
SHA165817caa3c7b6738fd0043f13fe8b83511895e8c
SHA2566d2e52fcbcf787f679cd5c8e110ec5f6f712e18f26edc815ebd79519d10c5d11
SHA5122bb7288220f2cdfa1adbe39f8bb490d1794ca0c5aee319112752befce35a53589a008960c70d50120cf4f8078b8650e5f743489888414dae9d62667d98bf18ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Filesize330B
MD50a0db71c131cc306deb4f89e14ce31e0
SHA10b1babfb13bbfd8808374eafe257c8c3d0f8bd81
SHA2569e8458589247ca6592728335d257cb7875c62cc3870dbc7bed755a3a52831ab3
SHA512453a4d1cb4f2295bddd82b0299afd1ff78894b892ca3d20e8cce023f2edc2e7b28fc4111b12a609053400aeed7aae01b1fb121258fdb89ab317cd1259326e025
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Filesize330B
MD522f54bea560aaac226637b125f72ddda
SHA18a0f181d7e8df9f6baafd00ace95f057b2c0d852
SHA25686c96b60f0e86c12c8dc4e8a8f53fe9041a80c755062915278c7b17c108d8344
SHA512cee5ac358aadca6202c424e7ef9b9cb09d46cdfb318747eed4ff7256b5cb5b6ba29b00f1f557401670dfc6f8e02f0bd858ea0a8c5140bd041501e648a483a9d6
-
Filesize
152B
MD5c9c4c494f8fba32d95ba2125f00586a3
SHA18a600205528aef7953144f1cf6f7a5115e3611de
SHA256a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
SHA5129d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
-
Filesize
152B
MD54dc6fc5e708279a3310fe55d9c44743d
SHA1a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA256a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
SHA5125874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
-
Filesize
1KB
MD5fb5fb4cc10da59d5336eace9a30c93cf
SHA13f8e67dff8f8d7b73653c0ad0eab11d75173d6f5
SHA25646a39173d102dfef456b6e60ec102ec9f2a72770256939bd5ec6b6677cfe5d1d
SHA512950ecf8189052b77d50a81a54887db9c79bf4af364a7e199fbec618e4bbebd7eaec3c30723b9111e1fc2af3dd69e6138cf940f87222cd9ebcbfc1d724b509c06
-
Filesize
6KB
MD5995a65e25713c6a1c3768e2ba4daa295
SHA1148e81fc4215549c8d72d3f4f206dbed772bc965
SHA256ff55a1f4a90bd6e7466f4c4efdacefbd3b0c10b44f602024d5472ad7318102f9
SHA51250eadbb6cfbdd61ca5a0df0167349b704a3f2a6f983a19fddc5b3806cb49dd5e11e985fbe9f7cdfc86111273286d62505a68c24e528aac0288e715135e61d788
-
Filesize
6KB
MD5a9eb8cb55efb087f2ffea6d8e12e2ec5
SHA1a2198a3afa7f5709fd73943159e34833a2795069
SHA256b4313728df9aca9bdef09a2f54fb319c314fa7e3058ed22377dfb7adfb572870
SHA5128f55a49eb46d93b19f836f0c9ff185a46d1c801454b1aa778450a6ed70b3c7d6669f4ba16e3f3e3401f1bbfa7b0a36c080506881707240c3ca1bec4e8f6f172b
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5ea8d9116f451b7b1393291aed956a5ff
SHA131d1ed72f807eafd531967817702641e6d4fe6ab
SHA2563d2eaaf8a5ebbfee1c00137c41e4f16decf7f19fc4b7d72dc76b611a5c997a93
SHA51204fac1732a8e0bd63e5e747f05bd349b9b30e438ee3a23a4a550e67f1a8665b3969a6cf9e5fa1b7f9fddecb915204bd3cbebe0da3b1db07cd8310526496ef606