Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22/05/2024, 06:37
Static task
static1
Behavioral task
behavioral1
Sample
665565e42ab0582f6353eccc9b65eb3d_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
665565e42ab0582f6353eccc9b65eb3d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
665565e42ab0582f6353eccc9b65eb3d_JaffaCakes118.html
-
Size
13KB
-
MD5
665565e42ab0582f6353eccc9b65eb3d
-
SHA1
87def8e4f5ad847d71776f4d3dc34e4253197c68
-
SHA256
3936d6cd03ac1b6a5d751127ff9606be44d179f74e06921f7c66d63b3162fa11
-
SHA512
8dc25abb2120c7abba75b3b95e9dd8285f74711c89cf7b3758aa729e85c8892879bd7fdef82183279ae67db4325fc8b4e62b90c41c90506cd88abd4b20e07fb0
-
SSDEEP
384:2bVtslzOOTei9oT2vdDWIiNNFgSP8bd2d4SUzbd:vF2TwWFgS2ocbd
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4260 msedge.exe 4260 msedge.exe 1712 msedge.exe 1712 msedge.exe 740 identity_helper.exe 740 identity_helper.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe 1712 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1712 wrote to memory of 3960 1712 msedge.exe 83 PID 1712 wrote to memory of 3960 1712 msedge.exe 83 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 1372 1712 msedge.exe 84 PID 1712 wrote to memory of 4260 1712 msedge.exe 85 PID 1712 wrote to memory of 4260 1712 msedge.exe 85 PID 1712 wrote to memory of 528 1712 msedge.exe 86 PID 1712 wrote to memory of 528 1712 msedge.exe 86 PID 1712 wrote to memory of 528 1712 msedge.exe 86 PID 1712 wrote to memory of 528 1712 msedge.exe 86 PID 1712 wrote to memory of 528 1712 msedge.exe 86 PID 1712 wrote to memory of 528 1712 msedge.exe 86 PID 1712 wrote to memory of 528 1712 msedge.exe 86 PID 1712 wrote to memory of 528 1712 msedge.exe 86 PID 1712 wrote to memory of 528 1712 msedge.exe 86 PID 1712 wrote to memory of 528 1712 msedge.exe 86 PID 1712 wrote to memory of 528 1712 msedge.exe 86 PID 1712 wrote to memory of 528 1712 msedge.exe 86 PID 1712 wrote to memory of 528 1712 msedge.exe 86 PID 1712 wrote to memory of 528 1712 msedge.exe 86 PID 1712 wrote to memory of 528 1712 msedge.exe 86 PID 1712 wrote to memory of 528 1712 msedge.exe 86 PID 1712 wrote to memory of 528 1712 msedge.exe 86 PID 1712 wrote to memory of 528 1712 msedge.exe 86 PID 1712 wrote to memory of 528 1712 msedge.exe 86 PID 1712 wrote to memory of 528 1712 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\665565e42ab0582f6353eccc9b65eb3d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc65f46f8,0x7ffdc65f4708,0x7ffdc65f47182⤵PID:3960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16378041014331577824,17274971700984754661,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:1372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,16378041014331577824,17274971700984754661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,16378041014331577824,17274971700984754661,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:82⤵PID:528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16378041014331577824,17274971700984754661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:2884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16378041014331577824,17274971700984754661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16378041014331577824,17274971700984754661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:82⤵PID:3464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16378041014331577824,17274971700984754661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16378041014331577824,17274971700984754661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:12⤵PID:1296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16378041014331577824,17274971700984754661,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:12⤵PID:3744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16378041014331577824,17274971700984754661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:12⤵PID:1472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16378041014331577824,17274971700984754661,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:12⤵PID:2492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16378041014331577824,17274971700984754661,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3764
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1716
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3816
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
Filesize
6KB
MD5b8d27a409d54cbda3a85c608b2fcd44c
SHA14e95623a2fe65fa7721ab6557a9344d85f9a991c
SHA256486d082cd65768b0b8e4bdd15bfe6a936ed533e9f6fe1d5029bc78413caecccd
SHA512412577d3bbc8d15674e1108e34d93cd3afd2f634f6e07ecf06fe169a9753813f70245fdbaecc176853251574c2e76234ac6c45499944d3e8038a2677b45e6e6e
-
Filesize
5KB
MD5a8d1913771a027bbd7b229318c926634
SHA18cefbdb93308dc7498981446c4eeae51255e9e16
SHA256e046cfec6393c0c0470e3dd507dd11c359ae7020b8ed5e51e8c6cd0e00942ea5
SHA5126f3ad4a98766c18f8bddc36c4bc2c77ca1ce1ce3e7282ee76ee03e6f63fa01a1b4d53400bac97810c6422f1e9456763f6bd5c34782072843dcfd9e0e7ff846c2
-
Filesize
6KB
MD5ff68564b5dce9dc9eb879e8e27c84275
SHA14a7efd59c09e534e1eb6343fa29a2ef478efdb96
SHA256536dde05bd532fdfdafa3febe0c5c6c1da02a445844a25e4564c1f6253bf5724
SHA512e2af8f69478612b0a08d826edafb343c915194bf965ae26b939f12dfccf41a030fce811bde8a813bb51ec1657128b289ee45a20d3ab12c7477c690ee38fda97d
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5541feeb00a4477b67c48c53d539a1602
SHA1a352945bb68b961517cc6f78667deb1bd2993bad
SHA256f9933286fe6f035be29f389f390122b1f65cf0064b9dd4751b23e044a161c6a1
SHA5122a387fd134ef2d5c5d02d7b064b014636dc69fe868840f57b669231e18b70286906949e65f02cf551303a98b2fc488e6c6bd6c5891c295c0cf687a97f5df5fcc