Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 03:59
Static task
static1
Behavioral task
behavioral1
Sample
4e57997f46df9d370c731fbeeabd7671_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4e57997f46df9d370c731fbeeabd7671_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
4e57997f46df9d370c731fbeeabd7671_JaffaCakes118.html
-
Size
26KB
-
MD5
4e57997f46df9d370c731fbeeabd7671
-
SHA1
112aa1f61492e572f26e7de117cc535ad7d002e6
-
SHA256
36c72b7c8f233893c74abc91cf04f52e099f76272442bdbeeadeb56b0138e703
-
SHA512
37a82ad59a0007f034103d491094229ad1896b022dcf5ee78b17d65aa671dfd8a631080a58f10603b079c3a3b48b0c3f0fda4d78fa15bfc20bc54418efd978d4
-
SSDEEP
384:Swgb1YCeUotR/nVfH8Shu63InGJIM017algv3L0JQyHEup3y5MjnimoSs1:SwgALI57ag0JQU7p3ysiRSs1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 368 msedge.exe 368 msedge.exe 2436 msedge.exe 2436 msedge.exe 2560 identity_helper.exe 2560 identity_helper.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe 3076 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2436 wrote to memory of 4876 2436 msedge.exe 82 PID 2436 wrote to memory of 4876 2436 msedge.exe 82 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 1888 2436 msedge.exe 83 PID 2436 wrote to memory of 368 2436 msedge.exe 84 PID 2436 wrote to memory of 368 2436 msedge.exe 84 PID 2436 wrote to memory of 2844 2436 msedge.exe 85 PID 2436 wrote to memory of 2844 2436 msedge.exe 85 PID 2436 wrote to memory of 2844 2436 msedge.exe 85 PID 2436 wrote to memory of 2844 2436 msedge.exe 85 PID 2436 wrote to memory of 2844 2436 msedge.exe 85 PID 2436 wrote to memory of 2844 2436 msedge.exe 85 PID 2436 wrote to memory of 2844 2436 msedge.exe 85 PID 2436 wrote to memory of 2844 2436 msedge.exe 85 PID 2436 wrote to memory of 2844 2436 msedge.exe 85 PID 2436 wrote to memory of 2844 2436 msedge.exe 85 PID 2436 wrote to memory of 2844 2436 msedge.exe 85 PID 2436 wrote to memory of 2844 2436 msedge.exe 85 PID 2436 wrote to memory of 2844 2436 msedge.exe 85 PID 2436 wrote to memory of 2844 2436 msedge.exe 85 PID 2436 wrote to memory of 2844 2436 msedge.exe 85 PID 2436 wrote to memory of 2844 2436 msedge.exe 85 PID 2436 wrote to memory of 2844 2436 msedge.exe 85 PID 2436 wrote to memory of 2844 2436 msedge.exe 85 PID 2436 wrote to memory of 2844 2436 msedge.exe 85 PID 2436 wrote to memory of 2844 2436 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4e57997f46df9d370c731fbeeabd7671_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5fea46f8,0x7ffa5fea4708,0x7ffa5fea47182⤵PID:4876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,14006990176587165903,12687554162475268014,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:1888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,14006990176587165903,12687554162475268014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,14006990176587165903,12687554162475268014,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:82⤵PID:2844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14006990176587165903,12687554162475268014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:4528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14006990176587165903,12687554162475268014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:1276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14006990176587165903,12687554162475268014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:12⤵PID:4424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,14006990176587165903,12687554162475268014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:82⤵PID:1600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,14006990176587165903,12687554162475268014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14006990176587165903,12687554162475268014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:12⤵PID:2752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14006990176587165903,12687554162475268014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:12⤵PID:3524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14006990176587165903,12687554162475268014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:12⤵PID:3848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14006990176587165903,12687554162475268014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:12⤵PID:1040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,14006990176587165903,12687554162475268014,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5184 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3076
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4712
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4524
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52daa93382bba07cbc40af372d30ec576
SHA1c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA2561826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
SHA51265635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
-
Filesize
152B
MD5ecdc2754d7d2ae862272153aa9b9ca6e
SHA1c19bed1c6e1c998b9fa93298639ad7961339147d
SHA256a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
SHA512cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9cd51778-bfa4-448b-a5a9-bd3682d328e9.tmp
Filesize5KB
MD5e940512390b7b0efff157df49bafbda7
SHA148887d0a0ba0ce68c0d57d52655b405738f736ec
SHA256ac82efd50b3d32882264af6e2821a60b74d3a62931ebcf4209fa79280949376b
SHA5127c7260b626f2585f02fc62a95d3d2193a340e37195a6eedbcddee431e544ab1e94970675188d60443987f6bdaf390612eb7724e89b323679670110f40f673e91
-
Filesize
262B
MD50f536da6f0f7a33cb9d897f3c9591517
SHA14288cb923b6508d6b9c79844959494546883927e
SHA2567721b44fbe81a556cda95419f3b43d61d3913500f778b02f028e4cc159739576
SHA512f7e80d74173ff250d44987046127ea7adbd1503bd728ccf37a6e132232b64fe13d608c47ac7ae06c470d46d6ad78de9cdece83ff400ebb7017d088b1589a8205
-
Filesize
6KB
MD550643aa2a96fcd3e9670ac8914ef1336
SHA19e8336de485d2b699a8c046d1c28c6ceb07ce49c
SHA2562fcc5127c59e3855cb2b5be19db510b88569905bdef1b729f29ba8ecf8774ea4
SHA5120aeb50b8123e1c7ae371b2a92533191cb0dd4fea1cb121755fcb6a32cf62f075d9626342835cf28f35a7b500486d1c5853ff02393c8ebc93fad2de9aea87cdc9
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD52d726427f44c5a12e453c6ddd56d3d77
SHA1f5bf92b5699a43d8fa1e4711e6b47afb98382646
SHA256c843769e2294ea41c7ba3ac65d0cd4efa5a349d5122a471fdd3af616b536c15a
SHA51297601f07f24ad9ca0217bf1bfe1dc02ca1f59c149466e157f228fc9cdf452dce4a6d105c2db45ba3a14f56794c573194bd545c6075272e24e5114acfc535ad22