Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 06:31
Static task
static1
Behavioral task
behavioral1
Sample
5da6485e27a1289713740ee3be333774_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5da6485e27a1289713740ee3be333774_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
5da6485e27a1289713740ee3be333774_JaffaCakes118.html
-
Size
65KB
-
MD5
5da6485e27a1289713740ee3be333774
-
SHA1
a0306b421ff65fb2fc63c9ab5c943346c7719ba5
-
SHA256
9cde7fc792a65bd79793c5aaf416c1f85b85704214bf900fc5be97fa654c0ffa
-
SHA512
a09cc12b9e1767ecf17054dbb89915a6e55b85c07ae83fdc1bb506042ceb2591a2863c89c69e87f5eba92eb183d871ce5a9ce7cb07aeae86a2e9109b6183af38
-
SSDEEP
1536:cvPNBJKyh5SehhvMJfSk0ghNxgefN3MU39DMglNJfXwJV:cvlzeJfShgeefR9Dt+JV
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3488 msedge.exe 3488 msedge.exe 2968 msedge.exe 2968 msedge.exe 1420 identity_helper.exe 1420 identity_helper.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe 2968 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2968 wrote to memory of 3076 2968 msedge.exe 82 PID 2968 wrote to memory of 3076 2968 msedge.exe 82 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 4404 2968 msedge.exe 83 PID 2968 wrote to memory of 3488 2968 msedge.exe 84 PID 2968 wrote to memory of 3488 2968 msedge.exe 84 PID 2968 wrote to memory of 4600 2968 msedge.exe 85 PID 2968 wrote to memory of 4600 2968 msedge.exe 85 PID 2968 wrote to memory of 4600 2968 msedge.exe 85 PID 2968 wrote to memory of 4600 2968 msedge.exe 85 PID 2968 wrote to memory of 4600 2968 msedge.exe 85 PID 2968 wrote to memory of 4600 2968 msedge.exe 85 PID 2968 wrote to memory of 4600 2968 msedge.exe 85 PID 2968 wrote to memory of 4600 2968 msedge.exe 85 PID 2968 wrote to memory of 4600 2968 msedge.exe 85 PID 2968 wrote to memory of 4600 2968 msedge.exe 85 PID 2968 wrote to memory of 4600 2968 msedge.exe 85 PID 2968 wrote to memory of 4600 2968 msedge.exe 85 PID 2968 wrote to memory of 4600 2968 msedge.exe 85 PID 2968 wrote to memory of 4600 2968 msedge.exe 85 PID 2968 wrote to memory of 4600 2968 msedge.exe 85 PID 2968 wrote to memory of 4600 2968 msedge.exe 85 PID 2968 wrote to memory of 4600 2968 msedge.exe 85 PID 2968 wrote to memory of 4600 2968 msedge.exe 85 PID 2968 wrote to memory of 4600 2968 msedge.exe 85 PID 2968 wrote to memory of 4600 2968 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5da6485e27a1289713740ee3be333774_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff86ae746f8,0x7ff86ae74708,0x7ff86ae747182⤵PID:3076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,7413138168852773844,3822536787075515649,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:22⤵PID:4404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,7413138168852773844,3822536787075515649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,7413138168852773844,3822536787075515649,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:82⤵PID:4600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7413138168852773844,3822536787075515649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:1244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7413138168852773844,3822536787075515649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:12⤵PID:2668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,7413138168852773844,3822536787075515649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:82⤵PID:2188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,7413138168852773844,3822536787075515649,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7413138168852773844,3822536787075515649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:12⤵PID:4724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7413138168852773844,3822536787075515649,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:12⤵PID:1604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7413138168852773844,3822536787075515649,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:12⤵PID:3004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,7413138168852773844,3822536787075515649,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:12⤵PID:3196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,7413138168852773844,3822536787075515649,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4820 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2236
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:968
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4572
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
Filesize
814B
MD5e0b2713936449ac354eb74a60aac7740
SHA13fe23ac02700d4c0e632b30e3e20e7376035af6a
SHA256a5394899e76900a3c17d33392437eecad6556236ce00aaefb96a8750fdb0030f
SHA512531d9c7ae11149f6a989c4ed4b8b9e7993cf8660d24d32b54fbd48a894066c539585d1ab69a131488ea62598079fb53a9fab0d93f9f0b15d78a951267968e653
-
Filesize
5KB
MD5447092f21d044ceb3d3d2ce71211639f
SHA134735f90d46ba21a4e4f6396757918b2bb6726e3
SHA256048e77f03c27c3817b95eec65bf81152dadc8421f794095d9cad5484b412c27e
SHA512471d4c58c1dbac9a9627d7451fb3e1e4e80b3be66ac4faac22375436139823205e5498f3b36ee2a3d2212877ccbd20a0e7f5c8f45cb10e1ea241f1b8e1806bbc
-
Filesize
6KB
MD58b4cf230f1c81eab126e0ab1b281673e
SHA13b6e703ed83d0665b011ebbe000cba1e2ad9dc8a
SHA256e87cdbc78fe89fa2f640899fb0af7ef8417109436c3b8d9093114d7b49375886
SHA512235e6362d398f7a2433d3a6ad5a9e4f9dcf4f03511d940a7023f60cd4aeb8d66fbaca8e6ff0ebea021770ab59bd47b502ceef7cb9928aa3078668d8c9945d5ba
-
Filesize
6KB
MD5f7798fc42ce58b8bef6ac644d86e577e
SHA1869301d37a7f5bd503d35795cab60b0b6e9463f8
SHA25610bbfb26dc15b31a0c3e7d8d97230b8cf42532e1a1e7daa8f6a073851bea792b
SHA512fd906e1f345666dc9edf247eef42caba1425443c5f5eca36bb9d2d3dafb422b02db08195ea8e91ffa235859ae206458deec4362327a58c5a7783d01474ffae91
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5ebb10427143bf6c73c29ff53b4afd82f
SHA1f06732f2a1a1979c281f460dc93e1afcacada413
SHA2562d1fe399033d88b38d27eb377d3f349482cd81d3aec54218de216924cbc69ba2
SHA512adf415663eca6cc7ec84722bc000d9ef2383d12dac7d9bbf853dbcc819f7191d2318c75d62f8a74ad47a33bc3ab02160df6dd8f201e918c3ac2d43e57a347c56