Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 15:00
Static task
static1
Behavioral task
behavioral1
Sample
400e9419fbbe5765ab3204e9e4788f59_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
400e9419fbbe5765ab3204e9e4788f59_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
400e9419fbbe5765ab3204e9e4788f59_JaffaCakes118.html
-
Size
117KB
-
MD5
400e9419fbbe5765ab3204e9e4788f59
-
SHA1
68289a9c06727fdd2a3c02d702f7e3021b0d4dcf
-
SHA256
e7d825ff7a3a8fa7aa15a37b47c069f9a7a2b4500efb856a87000b7af86acdf7
-
SHA512
1e4fc1648017031a0cbb5cda063114170feefe0a3bb0a368cf72cf1e7f3493386376f2d00533c2023ebaae01858ddc415b7065020b3a91874847677dec0e3bd4
-
SSDEEP
1536:SsRJyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCW:SqyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 684 msedge.exe 684 msedge.exe 4912 msedge.exe 4912 msedge.exe 3672 identity_helper.exe 3672 identity_helper.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe 3168 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe 4912 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4912 wrote to memory of 3732 4912 msedge.exe 82 PID 4912 wrote to memory of 3732 4912 msedge.exe 82 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 860 4912 msedge.exe 83 PID 4912 wrote to memory of 684 4912 msedge.exe 84 PID 4912 wrote to memory of 684 4912 msedge.exe 84 PID 4912 wrote to memory of 1216 4912 msedge.exe 85 PID 4912 wrote to memory of 1216 4912 msedge.exe 85 PID 4912 wrote to memory of 1216 4912 msedge.exe 85 PID 4912 wrote to memory of 1216 4912 msedge.exe 85 PID 4912 wrote to memory of 1216 4912 msedge.exe 85 PID 4912 wrote to memory of 1216 4912 msedge.exe 85 PID 4912 wrote to memory of 1216 4912 msedge.exe 85 PID 4912 wrote to memory of 1216 4912 msedge.exe 85 PID 4912 wrote to memory of 1216 4912 msedge.exe 85 PID 4912 wrote to memory of 1216 4912 msedge.exe 85 PID 4912 wrote to memory of 1216 4912 msedge.exe 85 PID 4912 wrote to memory of 1216 4912 msedge.exe 85 PID 4912 wrote to memory of 1216 4912 msedge.exe 85 PID 4912 wrote to memory of 1216 4912 msedge.exe 85 PID 4912 wrote to memory of 1216 4912 msedge.exe 85 PID 4912 wrote to memory of 1216 4912 msedge.exe 85 PID 4912 wrote to memory of 1216 4912 msedge.exe 85 PID 4912 wrote to memory of 1216 4912 msedge.exe 85 PID 4912 wrote to memory of 1216 4912 msedge.exe 85 PID 4912 wrote to memory of 1216 4912 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\400e9419fbbe5765ab3204e9e4788f59_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa808d46f8,0x7ffa808d4708,0x7ffa808d47182⤵PID:3732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,12425934544212307132,9322340466419801773,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,12425934544212307132,9322340466419801773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,12425934544212307132,9322340466419801773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:82⤵PID:1216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12425934544212307132,9322340466419801773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:2732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12425934544212307132,9322340466419801773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:3784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12425934544212307132,9322340466419801773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:12⤵PID:808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12425934544212307132,9322340466419801773,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:12⤵PID:1544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,12425934544212307132,9322340466419801773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:82⤵PID:2140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,12425934544212307132,9322340466419801773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5816 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12425934544212307132,9322340466419801773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:12⤵PID:3520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,12425934544212307132,9322340466419801773,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:12⤵PID:2052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,12425934544212307132,9322340466419801773,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4972 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3168
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3024
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2728
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54b4f91fa1b362ba5341ecb2836438dea
SHA19561f5aabed742404d455da735259a2c6781fa07
SHA256d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
-
Filesize
152B
MD5eaa3db555ab5bc0cb364826204aad3f0
SHA1a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
-
Filesize
6KB
MD5d1a487e5f0bad059da7b7f8924430e6e
SHA1ff64ed6a139465c3c0bffb7dba7cd838402f9d45
SHA256c0160b3922ff7b8ca247ce685e1327beacd5b08d256eaaf4fe2698df79836889
SHA512835d0d3b7644ca3983654071bfac3c52a4acb820024afdd558640b436f8785cdc00f4d14eb240bd41ab90c34d6c33385cf44523022d60ede5a313df5abf858dc
-
Filesize
6KB
MD5d67080a8dc075dfb2e33f75d5b8acbf4
SHA1836b251164c3b39dd47773706bff3f2cc7221ad6
SHA256e18b2e18ef20c3fd0227e6adb38b7506812999a5552aab5cc698c85dbb632412
SHA51210b9e57583f86d6d808c9012c1c51cdb79a873270a48f10d753583f2454779be16a05d57b9edc1eaaa0e0810d552153600d872027439cd3a67ae32ce2075dffc
-
Filesize
6KB
MD5fd2adaf655040ec4142e740a28484c94
SHA1cd2654a771269e7ac2d6d84febcc97e76cba1377
SHA2565589159f709c224db5cd0d888004940d95ced676dc35e8a2b53f8d9028b91a58
SHA51201a6646265ecaf2574a4d2a39abf6c4ae9b74fb46922c640a0b9e9adb77c42c5141c75b8c3b02b03af5b8bd2b4dbc6f8872a85980241c0f3596f2e2217320873
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5822311c4385d48e9599e3c4a2e4c83e6
SHA14de27d56a9cc0368aba78ef41fb941b51ccc61e0
SHA25652cf389ffc4297c51a70eb51b6463ea2b586d411c9a5aa878fcfe21044985a9f
SHA5128846927b13920c27ba1567ffa0f7d8fb43776f0553dc23ecbb6ee63307310454515ca6c39a345c1eedfc3cf7e76355c53793ffc9054f27f0896248027547132a