Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 12:05
Static task
static1
Behavioral task
behavioral1
Sample
79188b02a2ad3f38b1cf3a3886606c1c_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
79188b02a2ad3f38b1cf3a3886606c1c_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
79188b02a2ad3f38b1cf3a3886606c1c_JaffaCakes118.html
-
Size
126KB
-
MD5
79188b02a2ad3f38b1cf3a3886606c1c
-
SHA1
7c19cae32082fa31f37ee376dca1adaac5494a55
-
SHA256
bb04c5b108eb1adda15e0475a48d81c893fbd3b7225aad5cf502fda3e9abb6f5
-
SHA512
4b3f55f234cca84446a4db27df677fed92a017c22a3841cebd46b748688b77dd244fa6069fcfacbe01f20f703636425c460aa3c62b41786c5050309f89514423
-
SSDEEP
1536:RxXejacfHsrrDJNYhkJxYx9XG+LIAm/+cd/WfM+cSsOqCYWZGjRnORRaVCX:J9NYmojXG9AsDd/d+cFVIG+aVCX
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3332 msedge.exe 3332 msedge.exe 1732 msedge.exe 1732 msedge.exe 3132 identity_helper.exe 3132 identity_helper.exe 2972 msedge.exe 2972 msedge.exe 2972 msedge.exe 2972 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe 1732 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1732 wrote to memory of 220 1732 msedge.exe 83 PID 1732 wrote to memory of 220 1732 msedge.exe 83 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3648 1732 msedge.exe 84 PID 1732 wrote to memory of 3332 1732 msedge.exe 85 PID 1732 wrote to memory of 3332 1732 msedge.exe 85 PID 1732 wrote to memory of 3752 1732 msedge.exe 86 PID 1732 wrote to memory of 3752 1732 msedge.exe 86 PID 1732 wrote to memory of 3752 1732 msedge.exe 86 PID 1732 wrote to memory of 3752 1732 msedge.exe 86 PID 1732 wrote to memory of 3752 1732 msedge.exe 86 PID 1732 wrote to memory of 3752 1732 msedge.exe 86 PID 1732 wrote to memory of 3752 1732 msedge.exe 86 PID 1732 wrote to memory of 3752 1732 msedge.exe 86 PID 1732 wrote to memory of 3752 1732 msedge.exe 86 PID 1732 wrote to memory of 3752 1732 msedge.exe 86 PID 1732 wrote to memory of 3752 1732 msedge.exe 86 PID 1732 wrote to memory of 3752 1732 msedge.exe 86 PID 1732 wrote to memory of 3752 1732 msedge.exe 86 PID 1732 wrote to memory of 3752 1732 msedge.exe 86 PID 1732 wrote to memory of 3752 1732 msedge.exe 86 PID 1732 wrote to memory of 3752 1732 msedge.exe 86 PID 1732 wrote to memory of 3752 1732 msedge.exe 86 PID 1732 wrote to memory of 3752 1732 msedge.exe 86 PID 1732 wrote to memory of 3752 1732 msedge.exe 86 PID 1732 wrote to memory of 3752 1732 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\79188b02a2ad3f38b1cf3a3886606c1c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb649446f8,0x7ffb64944708,0x7ffb649447182⤵PID:220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,2980331329277050636,13565578171574281749,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:3648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,2980331329277050636,13565578171574281749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,2980331329277050636,13565578171574281749,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:82⤵PID:3752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2980331329277050636,13565578171574281749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:4172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2980331329277050636,13565578171574281749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:1660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2980331329277050636,13565578171574281749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:12⤵PID:2136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2980331329277050636,13565578171574281749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:12⤵PID:4812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2980331329277050636,13565578171574281749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:12⤵PID:4728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2980331329277050636,13565578171574281749,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:12⤵PID:424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,2980331329277050636,13565578171574281749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6252 /prefetch:82⤵PID:1896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,2980331329277050636,13565578171574281749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6252 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2980331329277050636,13565578171574281749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:12⤵PID:4324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2980331329277050636,13565578171574281749,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:12⤵PID:1644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,2980331329277050636,13565578171574281749,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3016 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2972
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4696
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4432
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
Filesize
2KB
MD50e8e9e4d0143dc188823e013535e9a7e
SHA145796c0c246795280d04e3966074dd91f5a426ac
SHA25638afec5cf4b0465fb9082a92e9288d1361fd0b3bd3b5da5c921a704711b995d2
SHA512eb49246a0c72e6bcbd6db16a12cfc7e286f391aa8067c96fbcaa151de9283a03ae3bf712c3fadec41869ca6fcc193f629c83db925de9b7849a81678092aeac6c
-
Filesize
5KB
MD572221865584484fb1fcc5011ad67da65
SHA1b3756ab38e7616e6d8aad68b64a5cf3401d89eb0
SHA25638807b5dd74f8cbb98c1850d6b429ce1694cc446be50617663154a280620fcba
SHA512d7b39995cbe5539b109ab51f0756ff8562aa3f1853401a7702adb4c82147cb59bc068fa480de8057abdc588b63bc37856048170598f7825c460b9d6d8567e031
-
Filesize
7KB
MD58419e07e0a777614f13036a1c3b9984f
SHA1ca7be074b2b119ef81df3fb30c83470552b06ffe
SHA2563d4d5959c0362081cb4ab56703c7f9afbfe46073a5ec1b154d6e06ecb40dc540
SHA5121652b765ab7d1eaea0b95f0b3c3e5bf15063a362bf573ff1a4bc7ea74d7227657d63c81dba598a0990352623346f2e60128ed32a3fb8dcf28e9adb2aa5e213ed
-
Filesize
6KB
MD5154908d314457e481ada993d3931d6d7
SHA1d5d4a9a4eb987bd4efe8aa2b537f38f3127afabe
SHA256bcc01a53f03b848a7966c68e861200901a9d20ed3677c5f6fcfd86681399fb87
SHA5129024de99d16bf4f192b16d07efa6a973ea62f2e85c008ac0e6ca621434216c8fd0be176e1d61c177cb23920043934e488696be98180bd4890161f73c3f5d9e07
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5499380fd76de87a24444343a45ed3bc9
SHA16807c75f11adb4fb7fc06d6526f4f32d8c8d16c5
SHA256ada5891a051e3b7b2465901b3e85767093aa6293cca5f17db44497f959cb884b
SHA512374851b89f40447b0d344e3c853dec5aa8e91eeaebd76765026c99a5384d543df64b39b9fd63fdb2dc9bd57343a1194550dfc20266602ddb11674351395eb6da