Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 02:37
Static task
static1
Behavioral task
behavioral1
Sample
6977a34b2c892652ea5ae6582108619e_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6977a34b2c892652ea5ae6582108619e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6977a34b2c892652ea5ae6582108619e_JaffaCakes118.html
-
Size
29KB
-
MD5
6977a34b2c892652ea5ae6582108619e
-
SHA1
75239ff20f1aca8bde4f925eb86f46f51db44e07
-
SHA256
2357d0133cf025ee2d61761184f8fc72ca899a8bb3de3103baf0244ae9be4392
-
SHA512
f795dc8643c5f303937fa953f66d8b061f16a7a918139fa32aeafaa904ef0c063330af530ff46655ea27c450f85ade70a6c99db307d7fab0b2535ef9209340a5
-
SSDEEP
768:8mvXvV6qvVc7Vdnujx9JKo7zFuQIYoOmjWDupIH+Y/SyT:8mvXvVlvVc7Vdnujx9Yo7zFuQIFOmjW5
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4896 msedge.exe 4896 msedge.exe 1968 msedge.exe 1968 msedge.exe 3508 identity_helper.exe 3508 identity_helper.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe 2200 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe 1968 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2948 1968 msedge.exe 82 PID 1968 wrote to memory of 2948 1968 msedge.exe 82 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 3812 1968 msedge.exe 83 PID 1968 wrote to memory of 4896 1968 msedge.exe 84 PID 1968 wrote to memory of 4896 1968 msedge.exe 84 PID 1968 wrote to memory of 3784 1968 msedge.exe 85 PID 1968 wrote to memory of 3784 1968 msedge.exe 85 PID 1968 wrote to memory of 3784 1968 msedge.exe 85 PID 1968 wrote to memory of 3784 1968 msedge.exe 85 PID 1968 wrote to memory of 3784 1968 msedge.exe 85 PID 1968 wrote to memory of 3784 1968 msedge.exe 85 PID 1968 wrote to memory of 3784 1968 msedge.exe 85 PID 1968 wrote to memory of 3784 1968 msedge.exe 85 PID 1968 wrote to memory of 3784 1968 msedge.exe 85 PID 1968 wrote to memory of 3784 1968 msedge.exe 85 PID 1968 wrote to memory of 3784 1968 msedge.exe 85 PID 1968 wrote to memory of 3784 1968 msedge.exe 85 PID 1968 wrote to memory of 3784 1968 msedge.exe 85 PID 1968 wrote to memory of 3784 1968 msedge.exe 85 PID 1968 wrote to memory of 3784 1968 msedge.exe 85 PID 1968 wrote to memory of 3784 1968 msedge.exe 85 PID 1968 wrote to memory of 3784 1968 msedge.exe 85 PID 1968 wrote to memory of 3784 1968 msedge.exe 85 PID 1968 wrote to memory of 3784 1968 msedge.exe 85 PID 1968 wrote to memory of 3784 1968 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6977a34b2c892652ea5ae6582108619e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe676e46f8,0x7ffe676e4708,0x7ffe676e47182⤵PID:2948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1468,3205900273265515048,10216969131293384664,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:22⤵PID:3812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1468,3205900273265515048,10216969131293384664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1468,3205900273265515048,10216969131293384664,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:82⤵PID:3784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,3205900273265515048,10216969131293384664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:1592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,3205900273265515048,10216969131293384664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:3304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,3205900273265515048,10216969131293384664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:12⤵PID:908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,3205900273265515048,10216969131293384664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2004 /prefetch:12⤵PID:624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1468,3205900273265515048,10216969131293384664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:82⤵PID:4864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1468,3205900273265515048,10216969131293384664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,3205900273265515048,10216969131293384664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:12⤵PID:3788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,3205900273265515048,10216969131293384664,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:12⤵PID:1472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,3205900273265515048,10216969131293384664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:12⤵PID:4620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1468,3205900273265515048,10216969131293384664,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:12⤵PID:4976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1468,3205900273265515048,10216969131293384664,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5960 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2200
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2272
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\874bca2e-183b-416e-9036-bbe16d63a917.tmp
Filesize5KB
MD5f2602db7f7f9ff5e99599395f65eadb7
SHA1fe728e6a4f0618384f76eb7c5f762bace82b1831
SHA256d36225fb5bd5e411afd874e8e15aa2ccf32dbe1c3af4eda17a232dc5657f773b
SHA51239503429f6a9f3657b3cafd52abbd205f3442e1bc104bb3791d53c8ae4e32223424c5a11d4a1f0c3ef3e8f19d2610208a024ad60412eb959a7be91064560688f
-
Filesize
2KB
MD587404e473b23c41fe515283697b4cde6
SHA11d79eeb9a78970180bdaf11b5b5fbcc0077d7de3
SHA256b80d692f6566864770649537f9e04ebf288c1d340aa1cd6cbd5b41497729d86c
SHA5125cebd8feadd3bc51a992879546c63cc16b6500d6e4e6c92d8ec4ec0318186d0ab30ae4752f6edbfe74f29aeafe1e4df5b3f42a8fe278bcc5fef9e7de8da97865
-
Filesize
7KB
MD5932da2a1cd1e6815c362eb07fbf0e805
SHA1f6735b0c99f682855a0b650165993395437a9b8b
SHA2563bf0ab4456a3f9df34aa0285e572cc944f3b65579dff2a78c0a90a7e0cb60345
SHA51219a5d445d944fa79911db76be75a3c453cefda5c988a1f0d77c6106acaa5d1aca45228e9528c4a0a85f1b73b793771ad485f2caffb7065593315730e3c5117fc
-
Filesize
6KB
MD566de57a1d88e508be232dac915537e3c
SHA1adf2ef53ec1174c5f46fa566d4a0f332cfb3f7ff
SHA256350625b7a5548ee5f706cfff3b6cce06a5f08de93891a6ef0208d210c12c837c
SHA51239d6ad9ded8229224237e94852615eb4086aad9c2e7a799ca53d96296706a637971518d8258aa89ff50b7004e59d4f79a89e2638c7272ddd1e25deda452948da
-
Filesize
1KB
MD56539293a66762a2c7ab88ea4c2824b4e
SHA1b96262a2c3a30a24271f287cf0b28e38cbacf3ec
SHA256ec4c77ba361deaead84515f0c9f01e5776002ae3fb6e5517a62bc6549dc7b346
SHA51258e912d9dfdb7da53109cb29e77d75fad9cc87e07fd60065564f23a4501371860483c41780a4104b1f882936effaf13aa0195055f81f3c79b055015119401ec3
-
Filesize
1KB
MD52908cb575f3715c7ee1bcd8e597d239a
SHA199378c071fe6a73a5bfd4309f2d6e673e49f8684
SHA25623a5809f00e797eb84497ba7312f5fe2914995ff18635fba3e05d178dec7a0b1
SHA512eae5d09b793ab076c0f779b962b5fbaa0e8eff7d94f609908642a767a1844681f83f4349148caa313756fa65f8742dee486a297b9219445dfa632ffde035c090
-
Filesize
703B
MD5d600e6ec927b995d057c3edd93563ce3
SHA1c1653b0390c8f91868cf96479c6aee8b81562268
SHA256585a9ffab16c852f0c2c27d43d3a9e48c3b918f027bdcf37d5e1506c74e200be
SHA512c5d4d664c70594496a38b0cbfd59cb0683ca489f2d8dcc6189635a0ce1028618ac053e1315826d244bec41395a59dae109f0878f24bdbf8026f3bdd4baec0b5d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD522b55baa1f7c4e0df48695002fa9800f
SHA18a215241a0f7b9a0c4fd8d34bb84fb44c3e16058
SHA256710e758bc917b930d9ba437b018776e3109e97970d70339bef4704915473d67a
SHA5125700b243400642f42f0f1fd10c09bff89e16cda7dc1aa31557b584144d05f1f2ea4a774d6a25c0318c1d5a07e802b3c1d9dfdd8f22f91fced64daf4cdf7865db