Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 14:00
Static task
static1
Behavioral task
behavioral1
Sample
34eef573d53fc87ea5a7b72d003dd5ab_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
34eef573d53fc87ea5a7b72d003dd5ab_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
34eef573d53fc87ea5a7b72d003dd5ab_JaffaCakes118.html
-
Size
41KB
-
MD5
34eef573d53fc87ea5a7b72d003dd5ab
-
SHA1
090b79f171f78808ff24615c3f0ecdb7b730f7d8
-
SHA256
8bbc5704e4819dc0b111e38afd73838dc1cb536ff1aa434f8f3b18289b4d0a38
-
SHA512
0855d0ad9a2bdaaba1a69166e598c9dac8365af26ae9bda5135b8c40a8b86daef2374252430a88a6f436ca74602f70213c42d6016d3c9632b5752dd6105fa75b
-
SSDEEP
768:V9jDeJz/H6mkI02xpd8FE89XFis82ZIIdR/euAgZnVfT:VpeJz/H6mkI0wpd8FE89XFis82ZNcOV
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4244 msedge.exe 4244 msedge.exe 3016 msedge.exe 3016 msedge.exe 2848 identity_helper.exe 2848 identity_helper.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe 3016 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3016 wrote to memory of 1528 3016 msedge.exe 82 PID 3016 wrote to memory of 1528 3016 msedge.exe 82 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 1836 3016 msedge.exe 83 PID 3016 wrote to memory of 4244 3016 msedge.exe 84 PID 3016 wrote to memory of 4244 3016 msedge.exe 84 PID 3016 wrote to memory of 456 3016 msedge.exe 85 PID 3016 wrote to memory of 456 3016 msedge.exe 85 PID 3016 wrote to memory of 456 3016 msedge.exe 85 PID 3016 wrote to memory of 456 3016 msedge.exe 85 PID 3016 wrote to memory of 456 3016 msedge.exe 85 PID 3016 wrote to memory of 456 3016 msedge.exe 85 PID 3016 wrote to memory of 456 3016 msedge.exe 85 PID 3016 wrote to memory of 456 3016 msedge.exe 85 PID 3016 wrote to memory of 456 3016 msedge.exe 85 PID 3016 wrote to memory of 456 3016 msedge.exe 85 PID 3016 wrote to memory of 456 3016 msedge.exe 85 PID 3016 wrote to memory of 456 3016 msedge.exe 85 PID 3016 wrote to memory of 456 3016 msedge.exe 85 PID 3016 wrote to memory of 456 3016 msedge.exe 85 PID 3016 wrote to memory of 456 3016 msedge.exe 85 PID 3016 wrote to memory of 456 3016 msedge.exe 85 PID 3016 wrote to memory of 456 3016 msedge.exe 85 PID 3016 wrote to memory of 456 3016 msedge.exe 85 PID 3016 wrote to memory of 456 3016 msedge.exe 85 PID 3016 wrote to memory of 456 3016 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\34eef573d53fc87ea5a7b72d003dd5ab_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe902246f8,0x7ffe90224708,0x7ffe902247182⤵PID:1528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,8009024083950425647,5053954221448518492,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:22⤵PID:1836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,8009024083950425647,5053954221448518492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,8009024083950425647,5053954221448518492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:82⤵PID:456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8009024083950425647,5053954221448518492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:5024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8009024083950425647,5053954221448518492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:4248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,8009024083950425647,5053954221448518492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:82⤵PID:4400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,8009024083950425647,5053954221448518492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8009024083950425647,5053954221448518492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:12⤵PID:3316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8009024083950425647,5053954221448518492,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2192 /prefetch:12⤵PID:4908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8009024083950425647,5053954221448518492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2296 /prefetch:12⤵PID:2928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,8009024083950425647,5053954221448518492,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:12⤵PID:2216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,8009024083950425647,5053954221448518492,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4812 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4156
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2848
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3288
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
Filesize
191B
MD5b345c1ce40785d79c32adc30acbc9719
SHA128d6b550c6ee3e2b40e12e797200f6ddd1fb3add
SHA256146b3f48a9bdf7aa24c593d00b717d68df1092780105ab4804682bededce86f0
SHA5123a7d336d563436e05562ecae4ee3e31af4f8428b35531e0621db3512db3b1d5f7cf9da8482be016197f53812f88fcbf685dea6ac1b371e06a830058e5436abde
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
6KB
MD553f3a8deb61e46891783cdccd0e811a3
SHA184bcadbb4aaa391d01027d2d56c87f2d52e7948f
SHA256f431dd5e604deef2ab9b85f2c7aeecc3172a452437adeef913d1f5cb722c5ee4
SHA512988d84e3408521f998e87787e13ef952a6a126dfadc625f73351f9c2f8910a5f0d8cd7954f76d0ed7f6efcc97a56adad3ab14d5ddf8021b7d84747b6bc60cf95
-
Filesize
6KB
MD54467c37cff177dfa5ce91fa9d0c833f7
SHA1686db3d5c5532c26f3f38678880aa8f063fc2c0b
SHA256552e248af456c14be4528478ab73b79c6752ba52fedc6f747af5905c2d3805b3
SHA512cdf6d3843d52caa0b9e5c2651cb4891b168ef4e5c63148a9e8b41a5aae3cefdf0db26cb674aa648dca726e92d013fa02b271c366539a1afeaa4bc644a2279398
-
Filesize
6KB
MD54e6ae4eee19c3436cdf3a924db874e07
SHA172c7334524a9098b968f6bfd4b00c72bbd530235
SHA25632713628dd54e227a05f510497452959d7eab60731b65078224c86bbec156ed6
SHA512ea417a87708e48383648cc51b8c4fc00f4d12d0b2dd612e4d2336f378bb60629ab6254d4e9b0ef1665cf5e575dac6523a588eb36e9e1f86cdd37fefcd2e47995
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD57d2cc73b5026f064a853dbb48888ee3d
SHA12e5ff23d1f685600cdbc657119301a6d1a40fe7e
SHA2566a1b1a50ffd27b2cc2df217a42145b0284a43633b19634500f6099217426c46e
SHA51283907d6f83c71d9b43b6fd8c925828b5b8b21e8ad9b754eefa784e174fb42987cc5a41f6f05757c3ca766ec3158839954bc49d6ed4e6cd1a89a87b21a397f716