Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 15:41
Static task
static1
Behavioral task
behavioral1
Sample
72726fb5384bef9797504ae6e8ee8c1c_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
72726fb5384bef9797504ae6e8ee8c1c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
72726fb5384bef9797504ae6e8ee8c1c_JaffaCakes118.html
-
Size
24KB
-
MD5
72726fb5384bef9797504ae6e8ee8c1c
-
SHA1
05d93eeafcf40fcee3fbd9236d4063e2832cff1f
-
SHA256
0d5e1b95445b5ecbcafc7a36fc7ede9a800a31352e26a1bdff9de7df359dfd7d
-
SHA512
58625da443db9cd31ef2d92734908de2508d4fecdb32a27d1c838c2cea2cf462425abb5746ed4b1dbcf085600005623bbdc4e2680b828d6d9ecea10092bee085
-
SSDEEP
768:SlnniLqBwFzkapLdwwGPTj4BTsHlARTbgh4NOEz:Xqs/xwwGPTj4FsHlCEGND
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 644 msedge.exe 644 msedge.exe 1564 msedge.exe 1564 msedge.exe 2488 identity_helper.exe 2488 identity_helper.exe 2232 msedge.exe 2232 msedge.exe 2232 msedge.exe 2232 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe 1564 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1564 wrote to memory of 1208 1564 msedge.exe 82 PID 1564 wrote to memory of 1208 1564 msedge.exe 82 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 2848 1564 msedge.exe 83 PID 1564 wrote to memory of 644 1564 msedge.exe 84 PID 1564 wrote to memory of 644 1564 msedge.exe 84 PID 1564 wrote to memory of 1924 1564 msedge.exe 85 PID 1564 wrote to memory of 1924 1564 msedge.exe 85 PID 1564 wrote to memory of 1924 1564 msedge.exe 85 PID 1564 wrote to memory of 1924 1564 msedge.exe 85 PID 1564 wrote to memory of 1924 1564 msedge.exe 85 PID 1564 wrote to memory of 1924 1564 msedge.exe 85 PID 1564 wrote to memory of 1924 1564 msedge.exe 85 PID 1564 wrote to memory of 1924 1564 msedge.exe 85 PID 1564 wrote to memory of 1924 1564 msedge.exe 85 PID 1564 wrote to memory of 1924 1564 msedge.exe 85 PID 1564 wrote to memory of 1924 1564 msedge.exe 85 PID 1564 wrote to memory of 1924 1564 msedge.exe 85 PID 1564 wrote to memory of 1924 1564 msedge.exe 85 PID 1564 wrote to memory of 1924 1564 msedge.exe 85 PID 1564 wrote to memory of 1924 1564 msedge.exe 85 PID 1564 wrote to memory of 1924 1564 msedge.exe 85 PID 1564 wrote to memory of 1924 1564 msedge.exe 85 PID 1564 wrote to memory of 1924 1564 msedge.exe 85 PID 1564 wrote to memory of 1924 1564 msedge.exe 85 PID 1564 wrote to memory of 1924 1564 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\72726fb5384bef9797504ae6e8ee8c1c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ace946f8,0x7ff8ace94708,0x7ff8ace947182⤵PID:1208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,7866957116530366529,3671694095572185864,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:2848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,7866957116530366529,3671694095572185864,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,7866957116530366529,3671694095572185864,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:82⤵PID:1924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7866957116530366529,3671694095572185864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:4908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7866957116530366529,3671694095572185864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:1200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,7866957116530366529,3671694095572185864,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:82⤵PID:4292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,7866957116530366529,3671694095572185864,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5504 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7866957116530366529,3671694095572185864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:12⤵PID:4896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7866957116530366529,3671694095572185864,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:12⤵PID:600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7866957116530366529,3671694095572185864,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4524 /prefetch:12⤵PID:3076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7866957116530366529,3671694095572185864,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:12⤵PID:1800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,7866957116530366529,3671694095572185864,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2232
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3148
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3204
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
Filesize
32KB
MD5f48baec69cc4dc0852d118259eff2d56
SHA1e64c6e4423421da5b35700154810cb67160bc32b
SHA256463d99ca5448f815a05b2d946ddae9eed3e21c335c0f4cfe7a16944e3512f76c
SHA51206fdccb5d9536ab7c68355dbf49ac02ebccad5a4ea01cb62200fd67728a6d05c276403e588a5bdceacf5e671913fc65b63e8b92456ca5493dae5b5a70e4a8b37
-
Filesize
189B
MD5443319881835b14fda88caab9945e84c
SHA1adb420bd20774e8eabc4d3d53ecfccb20ae7cb54
SHA256fd79d0831e92ccbffc20eed3a0d07b39a121b4f3be4f720d2981fdd2e7b5b8da
SHA51239c2c7fd638c04ce244473831d3dc8175e8e9ecb9a0df38370300233202d7d7fa9166912b8d97b34efd7b90eab6da376191e1c5c9ce253e96c9686b886ab29fb
-
Filesize
6KB
MD5761f37b2ae831d1821183dafdbafdf3a
SHA1112a1efd687692530ad08f3eae0b2ac2bcb1f9ac
SHA256ab195a7dc234604b572a328f956ce4b87813813fd74d12e619890c51e5de6da7
SHA512ec3a93394d81904cd6883cc48a7ec74fb40e7ab1eb86cedd0561f48c6658d534bdd61048e8acf0ce7d46f7f44c94fe13e9f33bd7f73f72b382f8f3d89c402c9a
-
Filesize
5KB
MD593db3f0e3c574468ec5eeb5c1d00233e
SHA1a959a6ee528e707833b4cb6be8da59f29fb6ba7f
SHA2562277dd6ee332ed3a15a9d3083faa9e9c1866a7c9eee5e628892af5e8942606a7
SHA512d4fcfe2416347e483a2be04318c255aa1ef151408e8e5fc03b5af1a3e88b1d399cd4247a8823fe55907cae57e979ccbb3d62af2165eeb3b7872602b8b6ea036c
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD59a7eff0a2ce2896c711de771a3d3ca9a
SHA1cc785b75d69c2ac7c816bb288b1903d57ee1d041
SHA256c0ba384390fb13415b8c58db032ea3c8b666912677efd98e95992da6889cdf55
SHA512954c74b3ad8ee5d90d6d196417ba871f97d4af42f8bbba875ec9f37193d636bf506af2c00bf2a7d90aae6745235c4c9f1104b00189f3af18b387004d66083de3