Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 06:44
Static task
static1
Behavioral task
behavioral1
Sample
5db2edb2640832c56fb393af3b7adf21_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5db2edb2640832c56fb393af3b7adf21_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
5db2edb2640832c56fb393af3b7adf21_JaffaCakes118.html
-
Size
4KB
-
MD5
5db2edb2640832c56fb393af3b7adf21
-
SHA1
4c2f1c680d754e759971850d97a529c34652b7b8
-
SHA256
2d4ab3dbf302e3735ff7ab3708c7109da22d6a78ff2bff644cf75779abd96dc0
-
SHA512
f69a6f9c02511a6896eb4a0723afb654002ef7bc6aec94a9d560f014d36d48645b36b76f0604fa3426d97e8855fcb05786266e38f320000bd15dca84e5e441b2
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oXlWd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDF
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4076 msedge.exe 4076 msedge.exe 4952 msedge.exe 4952 msedge.exe 3852 identity_helper.exe 3852 identity_helper.exe 1104 msedge.exe 1104 msedge.exe 1104 msedge.exe 1104 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4952 wrote to memory of 4636 4952 msedge.exe 82 PID 4952 wrote to memory of 4636 4952 msedge.exe 82 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4660 4952 msedge.exe 83 PID 4952 wrote to memory of 4076 4952 msedge.exe 84 PID 4952 wrote to memory of 4076 4952 msedge.exe 84 PID 4952 wrote to memory of 656 4952 msedge.exe 85 PID 4952 wrote to memory of 656 4952 msedge.exe 85 PID 4952 wrote to memory of 656 4952 msedge.exe 85 PID 4952 wrote to memory of 656 4952 msedge.exe 85 PID 4952 wrote to memory of 656 4952 msedge.exe 85 PID 4952 wrote to memory of 656 4952 msedge.exe 85 PID 4952 wrote to memory of 656 4952 msedge.exe 85 PID 4952 wrote to memory of 656 4952 msedge.exe 85 PID 4952 wrote to memory of 656 4952 msedge.exe 85 PID 4952 wrote to memory of 656 4952 msedge.exe 85 PID 4952 wrote to memory of 656 4952 msedge.exe 85 PID 4952 wrote to memory of 656 4952 msedge.exe 85 PID 4952 wrote to memory of 656 4952 msedge.exe 85 PID 4952 wrote to memory of 656 4952 msedge.exe 85 PID 4952 wrote to memory of 656 4952 msedge.exe 85 PID 4952 wrote to memory of 656 4952 msedge.exe 85 PID 4952 wrote to memory of 656 4952 msedge.exe 85 PID 4952 wrote to memory of 656 4952 msedge.exe 85 PID 4952 wrote to memory of 656 4952 msedge.exe 85 PID 4952 wrote to memory of 656 4952 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5db2edb2640832c56fb393af3b7adf21_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e53746f8,0x7ff9e5374708,0x7ff9e53747182⤵PID:4636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,10121570436242499176,6314960749586456669,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:22⤵PID:4660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,10121570436242499176,6314960749586456669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,10121570436242499176,6314960749586456669,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:82⤵PID:656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10121570436242499176,6314960749586456669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:2040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10121570436242499176,6314960749586456669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:2516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,10121570436242499176,6314960749586456669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:82⤵PID:1728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,10121570436242499176,6314960749586456669,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10121570436242499176,6314960749586456669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:12⤵PID:2196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10121570436242499176,6314960749586456669,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:12⤵PID:3996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10121570436242499176,6314960749586456669,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:3252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,10121570436242499176,6314960749586456669,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:12⤵PID:3276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,10121570436242499176,6314960749586456669,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1104
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3664
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4560
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
Filesize
292B
MD5264cffa0fd1c5f769981c6c9e79f6603
SHA192afbab4b837b55804642cb14f3fb69a2ecb1cc4
SHA256a1dfd40c5628a8f36c0ce473b8c7ffab8c3ea204b7739beb2e5da9820a5b2338
SHA512ac71d86045a880112ea0ea84fa9778688b1f1c4adc1b161751080bd05415be522d44a019f43a8be0a0a8e225c31bb70fc05ccea9c6e8eb05901b7811fc99b032
-
Filesize
5KB
MD539a2a102234d3b469efe06dba7208152
SHA11b9a65a367d32f3f85aba61b75c17e2cd4c749cf
SHA2561408ee26182a41ee2100ff98fe3a3cd3c2c4c6abbe8143fe716c3b904b2b10b9
SHA5122129752b6c0a7e01a46f9c913feea45c50d94853a486f8cde8deab1666d9fe8ea158e76748b62899ad8f6326a1f2c3535a6c5962909684676e5e8dba550da539
-
Filesize
6KB
MD557e05678328d5c30eba2fa3257733c27
SHA1e7debd1bc50dee753f8b4018fb9b858e8eab9c5e
SHA2562cadac82aca2c2d877deec372b7eed538f95a6e0268a4338d0b96e4dbf90e34f
SHA512e412f62f79e9915d27565c7788b6eb6a9fecedb7ed6c3b69a618784186102ee1b9d8a83f2ae9b058bb4ee03f394d48f3dedbdd26898f5ceb8e38c429aa3f9fcd
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD57653c1ded8f2ce349a64048d68949123
SHA1c8c0143c91eb4c52a4b21cbeb1e12e4b5d35cce3
SHA256e84470fb9006a5cbccbbd9427595708682322d6a87917b92d7d56887bca6e2ac
SHA512c4427a6c7b81a3dda9d507e94b14c676bd2bb55ab6aec9b0ba9835b1a023d6478dc96bb99fcd38d33312df4c047129d9dcced1d50f8e7d48c0cd9730ce2618f9