Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
12/05/2024, 02:50
Static task
static1
Behavioral task
behavioral1
Sample
37dd69b100ca1801af188817481d628e_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
37dd69b100ca1801af188817481d628e_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
37dd69b100ca1801af188817481d628e_JaffaCakes118.html
-
Size
27KB
-
MD5
37dd69b100ca1801af188817481d628e
-
SHA1
ed1f4bf6b128ef02593c178eb1f5d33a1169b8d7
-
SHA256
8377b6c672bfecdb903ef4c41e650193562d961c9d0bd27b40b9b2eeafa34841
-
SHA512
6115d94d444f798d075b295869d894a8f52f4ec4abb48983e228ce991f9a54e6856a9e953b1461212b69f9d0141b00a3850294362414ed3ee815b16b537d761f
-
SSDEEP
192:uwTob5nOOnQjxn5Q/BnQieMNnWnQOkEntbHnQTbnRnQ9e60m6ltwiQl7MBsqnYno:PQ/ybMzw1S2RQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4336 msedge.exe 4336 msedge.exe 116 msedge.exe 116 msedge.exe 4152 identity_helper.exe 4152 identity_helper.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe 116 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 116 wrote to memory of 4840 116 msedge.exe 82 PID 116 wrote to memory of 4840 116 msedge.exe 82 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4068 116 msedge.exe 84 PID 116 wrote to memory of 4336 116 msedge.exe 85 PID 116 wrote to memory of 4336 116 msedge.exe 85 PID 116 wrote to memory of 2744 116 msedge.exe 86 PID 116 wrote to memory of 2744 116 msedge.exe 86 PID 116 wrote to memory of 2744 116 msedge.exe 86 PID 116 wrote to memory of 2744 116 msedge.exe 86 PID 116 wrote to memory of 2744 116 msedge.exe 86 PID 116 wrote to memory of 2744 116 msedge.exe 86 PID 116 wrote to memory of 2744 116 msedge.exe 86 PID 116 wrote to memory of 2744 116 msedge.exe 86 PID 116 wrote to memory of 2744 116 msedge.exe 86 PID 116 wrote to memory of 2744 116 msedge.exe 86 PID 116 wrote to memory of 2744 116 msedge.exe 86 PID 116 wrote to memory of 2744 116 msedge.exe 86 PID 116 wrote to memory of 2744 116 msedge.exe 86 PID 116 wrote to memory of 2744 116 msedge.exe 86 PID 116 wrote to memory of 2744 116 msedge.exe 86 PID 116 wrote to memory of 2744 116 msedge.exe 86 PID 116 wrote to memory of 2744 116 msedge.exe 86 PID 116 wrote to memory of 2744 116 msedge.exe 86 PID 116 wrote to memory of 2744 116 msedge.exe 86 PID 116 wrote to memory of 2744 116 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\37dd69b100ca1801af188817481d628e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfc0446f8,0x7ffcfc044708,0x7ffcfc0447182⤵PID:4840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,4066192803176025692,4271940936849272237,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:22⤵PID:4068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,4066192803176025692,4271940936849272237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,4066192803176025692,4271940936849272237,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:82⤵PID:2744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4066192803176025692,4271940936849272237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:1564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4066192803176025692,4271940936849272237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,4066192803176025692,4271940936849272237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:82⤵PID:4240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,4066192803176025692,4271940936849272237,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4066192803176025692,4271940936849272237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:12⤵PID:1400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4066192803176025692,4271940936849272237,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:12⤵PID:4992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4066192803176025692,4271940936849272237,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:1380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4066192803176025692,4271940936849272237,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:12⤵PID:388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,4066192803176025692,4271940936849272237,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3092 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1184
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4348
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52daa93382bba07cbc40af372d30ec576
SHA1c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA2561826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
SHA51265635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
-
Filesize
152B
MD5ecdc2754d7d2ae862272153aa9b9ca6e
SHA1c19bed1c6e1c998b9fa93298639ad7961339147d
SHA256a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
SHA512cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
-
Filesize
5KB
MD5be2df90c27450e259ed2c8a93ae2d003
SHA13757913d210524ab479b0e3b0aab354433438595
SHA2569d5639af9393e77e84e925ce2f28a35e1bc88258752817ed56015770e709ce0d
SHA512da4d235c557b7a24ef1c193948f901f92fa4a6186ed7b7860057c22200d1c273f1da13032c4e3b6442066a615684fc779625ca06d70ca869c3f0d0814d5cbf60
-
Filesize
6KB
MD5ff562c056096d5a171a3ff194be36e9a
SHA1a9a04116f27b71ee7df16a9814f358a0ef4db942
SHA2562eb2ca9f8de7651f7e9065d1abcaf714844bc7dd34fca97ec711a254851b09ab
SHA512ba3b78577c4f87221cf5e586798f52b90f3c6ee05f64738973007abe5ec2cb9f9ffd26ee1038ac9a108787c706d2772a14faad4efa4d7a9204a39fffa52a38e2
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD50ba7d40351bc154267e3b4adfda512c0
SHA144ded39cf3efec30c67c2996e364e09565d41878
SHA256f1236a3922d0fe478b931387b865f83f9fe540eebdcbf19b6766794a3f28df15
SHA5120684e5f29958ffe14eea6c5705b180300820a5e6418562717b5d5f4540c668a4c4bb9cf7f80ab13f75be9ecfcfa86aac9e3540f0a08f4924856374eedf9b04e0