Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 10:27
Static task
static1
Behavioral task
behavioral1
Sample
45bd123ee5fee7892262fd590fe1d3f2_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
45bd123ee5fee7892262fd590fe1d3f2_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
45bd123ee5fee7892262fd590fe1d3f2_JaffaCakes118.html
-
Size
31KB
-
MD5
45bd123ee5fee7892262fd590fe1d3f2
-
SHA1
e214d17d08d590874a9b200790eb0321bb719b05
-
SHA256
16ac7ec60f09cbe216f8dd3bc65d6a62b57f9d56f3d2630a088aba3eaf4d9ed5
-
SHA512
698540909bcfa380802f1795baa605e3176587475582a1f9a7aeaa62eff69a08592e1967b91cec5ef27296c325affffffaf622c82ac46cca66d4020d2fdb2d0c
-
SSDEEP
768:MWu31J25zv8kA6OeoamxSQK4Pv/jAL1UfzNp86RGUYBoy19I2L8C5ISBndmTy:ORGUcr
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2396 msedge.exe 2396 msedge.exe 3816 msedge.exe 3816 msedge.exe 2012 identity_helper.exe 2012 identity_helper.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe 3816 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3816 wrote to memory of 816 3816 msedge.exe 82 PID 3816 wrote to memory of 816 3816 msedge.exe 82 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 5012 3816 msedge.exe 83 PID 3816 wrote to memory of 2396 3816 msedge.exe 84 PID 3816 wrote to memory of 2396 3816 msedge.exe 84 PID 3816 wrote to memory of 3928 3816 msedge.exe 85 PID 3816 wrote to memory of 3928 3816 msedge.exe 85 PID 3816 wrote to memory of 3928 3816 msedge.exe 85 PID 3816 wrote to memory of 3928 3816 msedge.exe 85 PID 3816 wrote to memory of 3928 3816 msedge.exe 85 PID 3816 wrote to memory of 3928 3816 msedge.exe 85 PID 3816 wrote to memory of 3928 3816 msedge.exe 85 PID 3816 wrote to memory of 3928 3816 msedge.exe 85 PID 3816 wrote to memory of 3928 3816 msedge.exe 85 PID 3816 wrote to memory of 3928 3816 msedge.exe 85 PID 3816 wrote to memory of 3928 3816 msedge.exe 85 PID 3816 wrote to memory of 3928 3816 msedge.exe 85 PID 3816 wrote to memory of 3928 3816 msedge.exe 85 PID 3816 wrote to memory of 3928 3816 msedge.exe 85 PID 3816 wrote to memory of 3928 3816 msedge.exe 85 PID 3816 wrote to memory of 3928 3816 msedge.exe 85 PID 3816 wrote to memory of 3928 3816 msedge.exe 85 PID 3816 wrote to memory of 3928 3816 msedge.exe 85 PID 3816 wrote to memory of 3928 3816 msedge.exe 85 PID 3816 wrote to memory of 3928 3816 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\45bd123ee5fee7892262fd590fe1d3f2_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb649446f8,0x7ffb64944708,0x7ffb649447182⤵PID:816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,13900288065715023735,328408832174882200,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:22⤵PID:5012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,13900288065715023735,328408832174882200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,13900288065715023735,328408832174882200,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:82⤵PID:3928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13900288065715023735,328408832174882200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:2252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13900288065715023735,328408832174882200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵PID:4260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,13900288065715023735,328408832174882200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:82⤵PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,13900288065715023735,328408832174882200,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13900288065715023735,328408832174882200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:12⤵PID:5048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13900288065715023735,328408832174882200,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:12⤵PID:4332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13900288065715023735,328408832174882200,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:12⤵PID:4712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,13900288065715023735,328408832174882200,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:12⤵PID:4452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,13900288065715023735,328408832174882200,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1844 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3272
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2364
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1812
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
Filesize
6KB
MD5d13f35d8424d147b4977d8d06bc48789
SHA1d6546818cb71f5274785bd9b2fc3d188fc640cc3
SHA25668e801235f207dd5b874e0965fad7022bda7bc321115aedd3cfa252983e88cee
SHA512224063f11882d886bb65a276dbaf2ffd5fc59ff62b3eab60db1c528284bedfd03bf70f56008aa8a69eefa5eeda275b0f5ff1cd421e620ea09df761e76ef46977
-
Filesize
6KB
MD58c764b1a563e7c0d573358d13068d885
SHA195e86e13fb66b934e46d4ac17dcfa4ca9dece704
SHA256596e319e45b222ec4c01ea0fa7d429e58afadc02ff7b69e42cd2f2406d26869f
SHA512ee26fc9bd5951a1597fb48742e2a35cbcbdcc11aceb1ad3d40100222c28b14a4fec26651dcfb85f8634cbcd0dde89eeb7a578495363b79b1afe07f2947dfd70e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5fd70511c97e382a990b5299b128bff3e
SHA165626b4a232223fc3b9a1d03defa5a1ff081636f
SHA256d795939b579ece7d13a6b0a847ee4db1c4debc19f95e614e915b1a2c58809fe7
SHA512698dcc3df4107adfe3b2cae2a37fffa0b0437bce1ffbe35985a3f9cb6d57a7744d005145d5a732459ea98e99906354565132a8cac7da5f2d20259109253f291e