Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 17:04
Static task
static1
Behavioral task
behavioral1
Sample
302373e07f6469dab5273d271bcf30b3_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
302373e07f6469dab5273d271bcf30b3_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
302373e07f6469dab5273d271bcf30b3_JaffaCakes118.html
-
Size
28KB
-
MD5
302373e07f6469dab5273d271bcf30b3
-
SHA1
282ebc3bf7ab54aa8f715fcdbd05e3481671d381
-
SHA256
0de689ce02058469423d9304829bf83a52fad2ef800d858d9c3b9aba61914a16
-
SHA512
6d8425fc125b4c806acdd790356d2699c0b357d92e7be99c853341fe9e0101a09f4c26beb145b914d73830b8a886fe7967a109b4a2a356a018a850fd9f83fd20
-
SSDEEP
768:kXsOwMSym3S4LGfym3iXsOwMTrrlgnRx8bPvKgkgwrWkc:iwW4LGGwmlgnR8HNBkc
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4416 msedge.exe 4416 msedge.exe 2604 msedge.exe 2604 msedge.exe 844 identity_helper.exe 844 identity_helper.exe 3976 msedge.exe 3976 msedge.exe 3976 msedge.exe 3976 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2604 wrote to memory of 2176 2604 msedge.exe 82 PID 2604 wrote to memory of 2176 2604 msedge.exe 82 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4472 2604 msedge.exe 83 PID 2604 wrote to memory of 4416 2604 msedge.exe 84 PID 2604 wrote to memory of 4416 2604 msedge.exe 84 PID 2604 wrote to memory of 4564 2604 msedge.exe 85 PID 2604 wrote to memory of 4564 2604 msedge.exe 85 PID 2604 wrote to memory of 4564 2604 msedge.exe 85 PID 2604 wrote to memory of 4564 2604 msedge.exe 85 PID 2604 wrote to memory of 4564 2604 msedge.exe 85 PID 2604 wrote to memory of 4564 2604 msedge.exe 85 PID 2604 wrote to memory of 4564 2604 msedge.exe 85 PID 2604 wrote to memory of 4564 2604 msedge.exe 85 PID 2604 wrote to memory of 4564 2604 msedge.exe 85 PID 2604 wrote to memory of 4564 2604 msedge.exe 85 PID 2604 wrote to memory of 4564 2604 msedge.exe 85 PID 2604 wrote to memory of 4564 2604 msedge.exe 85 PID 2604 wrote to memory of 4564 2604 msedge.exe 85 PID 2604 wrote to memory of 4564 2604 msedge.exe 85 PID 2604 wrote to memory of 4564 2604 msedge.exe 85 PID 2604 wrote to memory of 4564 2604 msedge.exe 85 PID 2604 wrote to memory of 4564 2604 msedge.exe 85 PID 2604 wrote to memory of 4564 2604 msedge.exe 85 PID 2604 wrote to memory of 4564 2604 msedge.exe 85 PID 2604 wrote to memory of 4564 2604 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\302373e07f6469dab5273d271bcf30b3_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff810c446f8,0x7ff810c44708,0x7ff810c447182⤵PID:2176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,11297680054084448806,10246987817787594264,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:22⤵PID:4472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,11297680054084448806,10246987817787594264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,11297680054084448806,10246987817787594264,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:82⤵PID:4564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11297680054084448806,10246987817787594264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:1324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11297680054084448806,10246987817787594264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:1312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,11297680054084448806,10246987817787594264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:82⤵PID:4612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,11297680054084448806,10246987817787594264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11297680054084448806,10246987817787594264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:12⤵PID:2012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11297680054084448806,10246987817787594264,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:12⤵PID:1020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11297680054084448806,10246987817787594264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:12⤵PID:4544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11297680054084448806,10246987817787594264,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,11297680054084448806,10246987817787594264,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1420 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3976
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2044
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3596
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
6KB
MD5628a3ac481be5697a4df5f8902fd500b
SHA16937c912fe65ea5034a9eadaddbdb52427f36642
SHA2569b1fab0287b3f436307977f3b69f34f14a33ea7ff8aabbfc49989f3f097a646b
SHA5122e38446a1cae1070e05563500c0d24aad8c9b31eab461879fef4bfb87e07f6af684277ed4b2aac6773faec169f093ae65b76cdd2db7b218250de03448f6b92e1
-
Filesize
6KB
MD537515edb36e2963166b2fc8eea52d87d
SHA1971663a2ad4fc2b8c0452837fbf22f7e6c955fe0
SHA25655474af12a65f9bfd2f7282570a1fc1f6c504a39ac45d0260891cf6ff8fc0997
SHA512c673a7d44c576b1e12cbf670ede0d048141c1834b03eb83e9b2673bfa69fba6ec72a4106d41768b28d1370417a868c6dd7d3605723b77a362136019dda468905
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD5694b45e74a9ad5dc05beae417777fdf4
SHA1f804aee730b587ef92f6adc7bd2cb13179a25a65
SHA256cfd759a69dd3c911d3b6446aa4f6e05821133d65b50e9b769777f3a261d96d68
SHA5124ea564ee306e8713579e9c291125267c4cac704ecafd6bdbbfab8223fc4aad4313b5ab359fc6bb5d5c02d7e1abac98c3476f09a968fdb8c357ef821e45c7f1ea