Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 21:04
Static task
static1
Behavioral task
behavioral1
Sample
43113dcf7f46bdb6733f2351c6f12582_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
43113dcf7f46bdb6733f2351c6f12582_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
43113dcf7f46bdb6733f2351c6f12582_JaffaCakes118.html
-
Size
27KB
-
MD5
43113dcf7f46bdb6733f2351c6f12582
-
SHA1
fea2e71a4c8f4fe798957a2ecb17d3e5080dcdd3
-
SHA256
67e9ee6a186bf194b9b245ffe31b49c432ada717d90d3f158de550fe785bf7b1
-
SHA512
16e2f829f16c1440ee24d7a89c702a4583f9f76375616c17160bd307e594fea5a3f4cdf8edc60a0030c0f8e8c00a8ada1fcb19514048ae43ce8986c58ad3b5b9
-
SSDEEP
192:uwXUb5nNl8nQjxn5Q/4nQieTNnUnQOkEntEqnQTbnVnQ9eH4am60vpvQl7MBzqnA:sxQ/Gqp4puSRiIn
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 216 msedge.exe 216 msedge.exe 3584 msedge.exe 3584 msedge.exe 3380 identity_helper.exe 3380 identity_helper.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe 3160 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe 3584 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3584 wrote to memory of 1384 3584 msedge.exe 82 PID 3584 wrote to memory of 1384 3584 msedge.exe 82 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 2216 3584 msedge.exe 83 PID 3584 wrote to memory of 216 3584 msedge.exe 84 PID 3584 wrote to memory of 216 3584 msedge.exe 84 PID 3584 wrote to memory of 4540 3584 msedge.exe 85 PID 3584 wrote to memory of 4540 3584 msedge.exe 85 PID 3584 wrote to memory of 4540 3584 msedge.exe 85 PID 3584 wrote to memory of 4540 3584 msedge.exe 85 PID 3584 wrote to memory of 4540 3584 msedge.exe 85 PID 3584 wrote to memory of 4540 3584 msedge.exe 85 PID 3584 wrote to memory of 4540 3584 msedge.exe 85 PID 3584 wrote to memory of 4540 3584 msedge.exe 85 PID 3584 wrote to memory of 4540 3584 msedge.exe 85 PID 3584 wrote to memory of 4540 3584 msedge.exe 85 PID 3584 wrote to memory of 4540 3584 msedge.exe 85 PID 3584 wrote to memory of 4540 3584 msedge.exe 85 PID 3584 wrote to memory of 4540 3584 msedge.exe 85 PID 3584 wrote to memory of 4540 3584 msedge.exe 85 PID 3584 wrote to memory of 4540 3584 msedge.exe 85 PID 3584 wrote to memory of 4540 3584 msedge.exe 85 PID 3584 wrote to memory of 4540 3584 msedge.exe 85 PID 3584 wrote to memory of 4540 3584 msedge.exe 85 PID 3584 wrote to memory of 4540 3584 msedge.exe 85 PID 3584 wrote to memory of 4540 3584 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\43113dcf7f46bdb6733f2351c6f12582_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff942d846f8,0x7ff942d84708,0x7ff942d847182⤵PID:1384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,5903954605107520100,12298404351821417956,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:22⤵PID:2216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,5903954605107520100,12298404351821417956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,5903954605107520100,12298404351821417956,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:82⤵PID:4540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5903954605107520100,12298404351821417956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:1472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5903954605107520100,12298404351821417956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:1816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,5903954605107520100,12298404351821417956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:82⤵PID:2920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,5903954605107520100,12298404351821417956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5903954605107520100,12298404351821417956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:12⤵PID:1248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5903954605107520100,12298404351821417956,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:12⤵PID:2900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5903954605107520100,12298404351821417956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:12⤵PID:2120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5903954605107520100,12298404351821417956,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:12⤵PID:3724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,5903954605107520100,12298404351821417956,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2744 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3160
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2248
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51ac52e2503cc26baee4322f02f5b8d9c
SHA138e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA5127670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
-
Filesize
152B
MD5b2a1398f937474c51a48b347387ee36a
SHA1922a8567f09e68a04233e84e5919043034635949
SHA2562dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA5124a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
-
Filesize
5KB
MD573f07bc7b5f4a8a10e88bf545d109898
SHA100048d9e9baedd4984919346d8e4d2aac4957373
SHA256dffad67e4af721452981241b509b3acf7002c20a227eec4f379187954df07f03
SHA512cedcbc468676772dd17891e45c251d197ed17b6b24558ae4cd98b09f72b107723107a059e816105a0c759e1495ee8ea2512f300ed57f8a88298e8c16cf1d4fa7
-
Filesize
6KB
MD5f8ec6f16510753a783a22d3d451af13f
SHA1586ea769e2fa564d9dec9f82da31c8ba2e22919c
SHA25646b637cb05af4ba3830d25cc5cce6c4f6c05f9a704aa2e0ab3b4f0ff04feae42
SHA51228561d01e200a775e9218fe9ab493211d5c578c77a84bdbde237bdd78487d5bfe6e6ef98b804db45afa71d784bf7727f7e9b67eb2a8640d817f87b6b22c7b9a7
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5d640cff1251322e155fac308d701285b
SHA1364943ddc36003a3cfbb373fe0b7327e38a6e8c8
SHA256f6618394419746a1a9bf8ed2c008dcbf2b0659c30d32cc0e0bbb78fe648de5ec
SHA51285c81082330840142bcdb876cfb32b6447d9ef5b59780164e09721b4a8992246c484874355ec648429b88c9a2fa92f89b8d47fd8dc135e2cae3ddaafe7116137