Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 03:19
Static task
static1
Behavioral task
behavioral1
Sample
6990fbd4d41961dc7370d0a547635e9b_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
6990fbd4d41961dc7370d0a547635e9b_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6990fbd4d41961dc7370d0a547635e9b_JaffaCakes118.html
-
Size
36KB
-
MD5
6990fbd4d41961dc7370d0a547635e9b
-
SHA1
a2a7d98833c3f6e0653abca149fa47a10f753c1c
-
SHA256
9df5032f77a93426a63e58f1dbcdb7badb17b104cbb94a0ec1e838983d26d0f4
-
SHA512
53ffb494c3788f074ea8acfbfa4f08e03d85260c26d5100faf58a558f0be27bbd6acf2b8e5677ace18544790941584e658be3a1cf8d15516022bf3ddb4487057
-
SSDEEP
768:zwx/MDTH6M88hARGZPXRE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TUZOD6lrw6lLRc8:Q/XbJxNVru0S9/S85K
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1672 msedge.exe 1672 msedge.exe 3252 msedge.exe 3252 msedge.exe 3128 identity_helper.exe 3128 identity_helper.exe 344 msedge.exe 344 msedge.exe 344 msedge.exe 344 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe 3252 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3252 wrote to memory of 1900 3252 msedge.exe 82 PID 3252 wrote to memory of 1900 3252 msedge.exe 82 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 2892 3252 msedge.exe 83 PID 3252 wrote to memory of 1672 3252 msedge.exe 84 PID 3252 wrote to memory of 1672 3252 msedge.exe 84 PID 3252 wrote to memory of 1176 3252 msedge.exe 85 PID 3252 wrote to memory of 1176 3252 msedge.exe 85 PID 3252 wrote to memory of 1176 3252 msedge.exe 85 PID 3252 wrote to memory of 1176 3252 msedge.exe 85 PID 3252 wrote to memory of 1176 3252 msedge.exe 85 PID 3252 wrote to memory of 1176 3252 msedge.exe 85 PID 3252 wrote to memory of 1176 3252 msedge.exe 85 PID 3252 wrote to memory of 1176 3252 msedge.exe 85 PID 3252 wrote to memory of 1176 3252 msedge.exe 85 PID 3252 wrote to memory of 1176 3252 msedge.exe 85 PID 3252 wrote to memory of 1176 3252 msedge.exe 85 PID 3252 wrote to memory of 1176 3252 msedge.exe 85 PID 3252 wrote to memory of 1176 3252 msedge.exe 85 PID 3252 wrote to memory of 1176 3252 msedge.exe 85 PID 3252 wrote to memory of 1176 3252 msedge.exe 85 PID 3252 wrote to memory of 1176 3252 msedge.exe 85 PID 3252 wrote to memory of 1176 3252 msedge.exe 85 PID 3252 wrote to memory of 1176 3252 msedge.exe 85 PID 3252 wrote to memory of 1176 3252 msedge.exe 85 PID 3252 wrote to memory of 1176 3252 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6990fbd4d41961dc7370d0a547635e9b_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84b6d46f8,0x7ff84b6d4708,0x7ff84b6d47182⤵PID:1900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,6767847433021346166,13824843697772653002,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:22⤵PID:2892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,6767847433021346166,13824843697772653002,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,6767847433021346166,13824843697772653002,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:82⤵PID:1176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6767847433021346166,13824843697772653002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6767847433021346166,13824843697772653002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:1104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,6767847433021346166,13824843697772653002,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:82⤵PID:3964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,6767847433021346166,13824843697772653002,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6767847433021346166,13824843697772653002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:12⤵PID:2064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6767847433021346166,13824843697772653002,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:12⤵PID:3932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6767847433021346166,13824843697772653002,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:12⤵PID:1552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,6767847433021346166,13824843697772653002,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:12⤵PID:3044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,6767847433021346166,13824843697772653002,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4596 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:344
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5116
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3540
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
Filesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4efac312-cb9f-453a-9369-948228d79ce5.tmp
Filesize6KB
MD52b471b519559e4a16796796c9c0824b2
SHA1aa83319299c5c9a3c1116df05e369a49a26498f7
SHA2560b18c7090e0101e56b41df88f10ecb4a2377879542f6ae29a5f5c13661706824
SHA5125e10047f5916e170ef575c0290a7d8338aeca0e59271a8f559a763b1272d9ca2bc7a43888b68e073eadd54a19793255eaa86cfb94de2edbb88c833ae055c5613
-
Filesize
613B
MD515387f4cb9e238188954d75c92be5597
SHA11b9886a70a15e83017ef0476ee84edbad371828f
SHA2563bd8e7fc55ce9fbe03b8e7357ba01861e064c45e7df8af1a45febaa7b2c9ab80
SHA512e9955a1da3c2f69195fe7031d99fc1b1b4580c543c1bc6a76bf848703b9eba6a9db3cb97fe3f2c2dcc095caa440e50481e6311daa8c95746eb0f8baba5272f9d
-
Filesize
5KB
MD5839e0b8b1ca9cd99925ce870958d9b4a
SHA1da8320d55739a3c900900b44307219b86f741b39
SHA2562f66434248db695b2456d429ebe1a2347fdc9cc3cb3e9b0346281ea877893eb6
SHA5122c87fbef5aa5b3c19b1b6c70446a3647a62f7acfad231f39e0884d55549136ece8a4ee567fc3fbb457d5ebc4263639935b2e331a1564bb6efc2154563edb3514
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD531a0adc7d5cbd27545e0df39f3a0bfee
SHA10b8550c32b1b4d9810157021e1e3fc507306fbbb
SHA25673165b2bd8e373b05477c24eb9e15b15992aeb3a2389fd0b0f760dfeddc0403e
SHA512bce0cd927a2a0cd33f3894a90d2ae38250af8a39dd18de8d3b069eb81772cdede7c843737df8fbe5ba2e0a93cb5432ee2a3a3b97e0cae505fe0d943d9629af5f