Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 22:26
Static task
static1
Behavioral task
behavioral1
Sample
4d5116f59259ee3e0c00cca4a7c734c5_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4d5116f59259ee3e0c00cca4a7c734c5_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
4d5116f59259ee3e0c00cca4a7c734c5_JaffaCakes118.html
-
Size
2KB
-
MD5
4d5116f59259ee3e0c00cca4a7c734c5
-
SHA1
4328db2eb90496676e7d6ef656ba457e00075e3f
-
SHA256
afcfb8035a4723da19d5ae275a41fe6641b01b24f94b37c11b24aa1107146014
-
SHA512
46250191516cd1f44a241477bd99bd1857e59fc223a27ca03499cf6e9d3516e5631a90fb6c1e5e67465d539b81622c18c0e05821cf5a5877fa89837fb4e046c1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 220 msedge.exe 220 msedge.exe 2148 msedge.exe 2148 msedge.exe 4432 identity_helper.exe 4432 identity_helper.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2148 wrote to memory of 4940 2148 msedge.exe 82 PID 2148 wrote to memory of 4940 2148 msedge.exe 82 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 2184 2148 msedge.exe 83 PID 2148 wrote to memory of 220 2148 msedge.exe 84 PID 2148 wrote to memory of 220 2148 msedge.exe 84 PID 2148 wrote to memory of 3024 2148 msedge.exe 85 PID 2148 wrote to memory of 3024 2148 msedge.exe 85 PID 2148 wrote to memory of 3024 2148 msedge.exe 85 PID 2148 wrote to memory of 3024 2148 msedge.exe 85 PID 2148 wrote to memory of 3024 2148 msedge.exe 85 PID 2148 wrote to memory of 3024 2148 msedge.exe 85 PID 2148 wrote to memory of 3024 2148 msedge.exe 85 PID 2148 wrote to memory of 3024 2148 msedge.exe 85 PID 2148 wrote to memory of 3024 2148 msedge.exe 85 PID 2148 wrote to memory of 3024 2148 msedge.exe 85 PID 2148 wrote to memory of 3024 2148 msedge.exe 85 PID 2148 wrote to memory of 3024 2148 msedge.exe 85 PID 2148 wrote to memory of 3024 2148 msedge.exe 85 PID 2148 wrote to memory of 3024 2148 msedge.exe 85 PID 2148 wrote to memory of 3024 2148 msedge.exe 85 PID 2148 wrote to memory of 3024 2148 msedge.exe 85 PID 2148 wrote to memory of 3024 2148 msedge.exe 85 PID 2148 wrote to memory of 3024 2148 msedge.exe 85 PID 2148 wrote to memory of 3024 2148 msedge.exe 85 PID 2148 wrote to memory of 3024 2148 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4d5116f59259ee3e0c00cca4a7c734c5_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff739b46f8,0x7fff739b4708,0x7fff739b47182⤵PID:4940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,7604092796447690592,16404274700426691707,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:22⤵PID:2184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,7604092796447690592,16404274700426691707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,7604092796447690592,16404274700426691707,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:82⤵PID:3024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,7604092796447690592,16404274700426691707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:2832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,7604092796447690592,16404274700426691707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:12⤵PID:3560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,7604092796447690592,16404274700426691707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:12⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,7604092796447690592,16404274700426691707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:82⤵PID:3580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,7604092796447690592,16404274700426691707,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,7604092796447690592,16404274700426691707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:12⤵PID:4760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,7604092796447690592,16404274700426691707,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:12⤵PID:3876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,7604092796447690592,16404274700426691707,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:12⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,7604092796447690592,16404274700426691707,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:12⤵PID:4964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,7604092796447690592,16404274700426691707,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3436 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1904
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:432
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3368
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52daa93382bba07cbc40af372d30ec576
SHA1c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA2561826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
SHA51265635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
-
Filesize
152B
MD5ecdc2754d7d2ae862272153aa9b9ca6e
SHA1c19bed1c6e1c998b9fa93298639ad7961339147d
SHA256a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
SHA512cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
-
Filesize
5KB
MD501cda4e9a9aa464b351eb6c7aadbcd57
SHA103b04fa30a1e0693cb0f134b836f8db007afb08a
SHA256c7c0044879bb3975d457b2d24f881e3017e14eb937ebd8fda07c54514b4ee9e5
SHA5126fc1db98c9a8ac9669bbb357e6fe0e7daf4846850c258c12a7b7cbcd4e1e6748175fd1736787478f2d2108a11ea5cffae4dbd0534f6d98fda8e47a9111275158
-
Filesize
6KB
MD5c45e1d346537ad3db5276813b153ad67
SHA1241e7958309ec0166e5bbc790a54026acbeb5335
SHA25678196e4d689463f1cdb256de83fc72367ad9aa63b400adbdcb0609eb6ce8899b
SHA512c3a54b059a77ae4554a1483d95c36c40b69f7a36293269e98f4d72e0cd8aa0405676507e9723440b9ef259e2f3365624edb780e7247007ce02e42d0e69cc5606
-
Filesize
6KB
MD54b5c2d5d9b1920452ef80b5fe8e3b346
SHA1fa8651319030efd5967b0505217bfc589da49696
SHA2560eb0367ed6c40f1fb3a550191b8b5aae3d2e947a2e9aaedbc284f5d7b07ae3f9
SHA512d8bf2953f1cd8d9e981158eac01904a6194cebbcb35b8530259cfc49fb566e3993c594c75faef2b9e67bcbcb8b820b8d6b1fb056ac22d352a5c5055b2ecd40e0
-
Filesize
6KB
MD5fb1c0ca5f5a43b78b58d931041fde361
SHA1bb05f8d56042f6171d0a192b41faf40b7604642c
SHA256353d619e615f8a9e87cd9b59fbc4340963dba5142783c8dc6842dd366b109a3c
SHA5122ab25253457e20a2977eeb62345b81511c29c4988ec5843fc57e047a50c0b02ec64753331cba9f9ad5aad587ebca7ee24659d594ffd0ed5a244a31118863905b
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5b3aa5cc061b881ed6d4817a61541307f
SHA1983209f61b99cbe88ff3afa54aa65ed2ce949abe
SHA256d1020d17affba3e72eb2e623a8250968e78b421d5e79b213153424c97c673310
SHA5128fe8dbab37ae2cd8e61c3f02465dae83c59cc495f434cd8d0a241015c97aade9614bbc915ad234c5221892cf6c6614911625895a40a198e300cde08a46a7d4c2