Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 16:49
Static task
static1
Behavioral task
behavioral1
Sample
6b9cb6bbcfb1ff479905598cc63b1ae3_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6b9cb6bbcfb1ff479905598cc63b1ae3_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
6b9cb6bbcfb1ff479905598cc63b1ae3_JaffaCakes118.html
-
Size
69KB
-
MD5
6b9cb6bbcfb1ff479905598cc63b1ae3
-
SHA1
dde0158b43aec4bbba2a218047551e7e6a4ac9cb
-
SHA256
25fcaa349c709bbf9ccefc826ac03e5f2421cc2d1e01f00ffbad1b193f15a9c0
-
SHA512
8edca007cdffe77bde432060ced1954c1dc5dad30cc9718e60bd4a42af589135ff7d9fbc9108c220604c714a1f3cc73de023ab48d95b0f483bbe224a8784dbc6
-
SSDEEP
768:Jifm7gcMWR3sI2PDDnd0g6tGooT2jwC2oTTMdtbBnfBgN8/lboethcRTQFVG8s/U:Js00T42w0tbrga9nhc1nhVa
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3024 msedge.exe 3024 msedge.exe 3436 msedge.exe 3436 msedge.exe 1664 identity_helper.exe 1664 identity_helper.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe 1796 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe 3436 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3436 wrote to memory of 3776 3436 msedge.exe 82 PID 3436 wrote to memory of 3776 3436 msedge.exe 82 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 668 3436 msedge.exe 83 PID 3436 wrote to memory of 3024 3436 msedge.exe 84 PID 3436 wrote to memory of 3024 3436 msedge.exe 84 PID 3436 wrote to memory of 3468 3436 msedge.exe 85 PID 3436 wrote to memory of 3468 3436 msedge.exe 85 PID 3436 wrote to memory of 3468 3436 msedge.exe 85 PID 3436 wrote to memory of 3468 3436 msedge.exe 85 PID 3436 wrote to memory of 3468 3436 msedge.exe 85 PID 3436 wrote to memory of 3468 3436 msedge.exe 85 PID 3436 wrote to memory of 3468 3436 msedge.exe 85 PID 3436 wrote to memory of 3468 3436 msedge.exe 85 PID 3436 wrote to memory of 3468 3436 msedge.exe 85 PID 3436 wrote to memory of 3468 3436 msedge.exe 85 PID 3436 wrote to memory of 3468 3436 msedge.exe 85 PID 3436 wrote to memory of 3468 3436 msedge.exe 85 PID 3436 wrote to memory of 3468 3436 msedge.exe 85 PID 3436 wrote to memory of 3468 3436 msedge.exe 85 PID 3436 wrote to memory of 3468 3436 msedge.exe 85 PID 3436 wrote to memory of 3468 3436 msedge.exe 85 PID 3436 wrote to memory of 3468 3436 msedge.exe 85 PID 3436 wrote to memory of 3468 3436 msedge.exe 85 PID 3436 wrote to memory of 3468 3436 msedge.exe 85 PID 3436 wrote to memory of 3468 3436 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6b9cb6bbcfb1ff479905598cc63b1ae3_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8c3c46f8,0x7fff8c3c4708,0x7fff8c3c47182⤵PID:3776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,5031112337106053590,17806694331913619619,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,5031112337106053590,17806694331913619619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,5031112337106053590,17806694331913619619,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:82⤵PID:3468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5031112337106053590,17806694331913619619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:1512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5031112337106053590,17806694331913619619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,5031112337106053590,17806694331913619619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:82⤵PID:4328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,5031112337106053590,17806694331913619619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5031112337106053590,17806694331913619619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2280 /prefetch:12⤵PID:4460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5031112337106053590,17806694331913619619,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:12⤵PID:3532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5031112337106053590,17806694331913619619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:12⤵PID:5032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5031112337106053590,17806694331913619619,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:12⤵PID:884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,5031112337106053590,17806694331913619619,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4852 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1796
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4400
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2168
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
5KB
MD592d06eb2678e589efb2b5bf1c9b7e9e3
SHA18445807b2dc68d138d0f0b086ee006031e869377
SHA256f84d6caf949e23e38be7217459377108dfe813d40b321343a171f9dd8632de1e
SHA512035d44e55533c0f7a99d777ce777df621a8e507c0b8e8986452089fe82293148d74e58728210ffbd29dd03e80e299fc6fa0563d392f4183c5264835af546a328
-
Filesize
6KB
MD51f39c9cd7abb8ba4fd0b1469ee8e34c2
SHA1285f4896eead438f4fd5a35306db536f60c49d76
SHA256f03c867356e06c76a32466203d584422da8de1520d5c3c8096ba3cb0800e114e
SHA5122536244c956762a49c00e35f63fc7d21c93d522e2e599b517a9e9af557d7cbf9ad49fd8714f7335eb08e5e7aee0dfa6840bcbaf5cc325998bbdbf90daa58f68c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5ecb0d6e2ace7b2c82a32aa8436874f57
SHA112c4f0c3224a94fae69a0fa6325c1d43a5be6098
SHA256d82a84bc37a2c344ced77da5fa097b21815e47caad2949d304cebfda8a08c646
SHA512bbbe598e36b0629bdacb151281ab7e4c9fc48f7db9a1a9d20c9db342aa55164498f2353b9070b322fdcec8391f2efa5250f59d25eb4a5336c7bbde633914db5f