Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 19:53
Static task
static1
Behavioral task
behavioral1
Sample
7a52ffc309a270bd673524c005497b40_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7a52ffc309a270bd673524c005497b40_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
7a52ffc309a270bd673524c005497b40_JaffaCakes118.html
-
Size
32KB
-
MD5
7a52ffc309a270bd673524c005497b40
-
SHA1
3f5b1d449531daa2ade5afbb05a710a66f08c969
-
SHA256
4c3b1c7ab47cde0bf103e06a83fd395e89b739183f2719aac71cddf2afbb79df
-
SHA512
2406e419a7c7877fac72460fbe013ec11dd00c7d95d70f875041618c288bdec6d149bc3bb3e9f9eae730b79996bc743243f9b59057b77e5658d08b9c25321502
-
SSDEEP
768:pJ3/xB2F7J34YDojIJEYCQWlTbFs8oGnLGyi6plNA7Z0OkHbRKP:pJ3/xB2F7J34YDojIJ77aq8oGnLGyi6Q
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3196 msedge.exe 3196 msedge.exe 2112 msedge.exe 2112 msedge.exe 4352 identity_helper.exe 4352 identity_helper.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe 876 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe 2112 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2620 2112 msedge.exe 82 PID 2112 wrote to memory of 2620 2112 msedge.exe 82 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 1612 2112 msedge.exe 83 PID 2112 wrote to memory of 3196 2112 msedge.exe 84 PID 2112 wrote to memory of 3196 2112 msedge.exe 84 PID 2112 wrote to memory of 4644 2112 msedge.exe 85 PID 2112 wrote to memory of 4644 2112 msedge.exe 85 PID 2112 wrote to memory of 4644 2112 msedge.exe 85 PID 2112 wrote to memory of 4644 2112 msedge.exe 85 PID 2112 wrote to memory of 4644 2112 msedge.exe 85 PID 2112 wrote to memory of 4644 2112 msedge.exe 85 PID 2112 wrote to memory of 4644 2112 msedge.exe 85 PID 2112 wrote to memory of 4644 2112 msedge.exe 85 PID 2112 wrote to memory of 4644 2112 msedge.exe 85 PID 2112 wrote to memory of 4644 2112 msedge.exe 85 PID 2112 wrote to memory of 4644 2112 msedge.exe 85 PID 2112 wrote to memory of 4644 2112 msedge.exe 85 PID 2112 wrote to memory of 4644 2112 msedge.exe 85 PID 2112 wrote to memory of 4644 2112 msedge.exe 85 PID 2112 wrote to memory of 4644 2112 msedge.exe 85 PID 2112 wrote to memory of 4644 2112 msedge.exe 85 PID 2112 wrote to memory of 4644 2112 msedge.exe 85 PID 2112 wrote to memory of 4644 2112 msedge.exe 85 PID 2112 wrote to memory of 4644 2112 msedge.exe 85 PID 2112 wrote to memory of 4644 2112 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7a52ffc309a270bd673524c005497b40_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9584f46f8,0x7ff9584f4708,0x7ff9584f47182⤵PID:2620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10810854027569983301,5169774608439696194,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:1612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,10810854027569983301,5169774608439696194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,10810854027569983301,5169774608439696194,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:82⤵PID:4644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10810854027569983301,5169774608439696194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:1284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10810854027569983301,5169774608439696194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:2772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10810854027569983301,5169774608439696194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1800 /prefetch:12⤵PID:4216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10810854027569983301,5169774608439696194,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:12⤵PID:5116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,10810854027569983301,5169774608439696194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3336 /prefetch:82⤵PID:1476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,10810854027569983301,5169774608439696194,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3336 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10810854027569983301,5169774608439696194,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:12⤵PID:3640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,10810854027569983301,5169774608439696194,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:12⤵PID:1344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,10810854027569983301,5169774608439696194,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:876
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4872
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4172
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51ac52e2503cc26baee4322f02f5b8d9c
SHA138e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA5127670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
-
Filesize
152B
MD5b2a1398f937474c51a48b347387ee36a
SHA1922a8567f09e68a04233e84e5919043034635949
SHA2562dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA5124a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
-
Filesize
182B
MD55fba847350341dc385c90bbd14b812f4
SHA1986d1713b103f3d565ccb88077a8598c8393a24e
SHA256ecb5860418331ce7b5253419ebab9fb495ab9dba26b7d0751699949555074372
SHA512227478553cd394c0ae057d78160c461119d7418765a14ab55ac18daec588ef8883c09c931adc149f380fead0a6e0e92cb0d6d8c29c27cacd63143b615b23e830
-
Filesize
5KB
MD509651b0649b6785788ae9406eb925129
SHA1f94ecf44d59aa7a3022d5ac776735d0b146184aa
SHA2565869c4b4a4d97077e91acd9d9b7a5b5a60d9634f7dee4c8661af42e228dd6af1
SHA5126b43cb845feed976cc3acf90ab582baec41fdf24499f92e4251653ed0f4c29b06bf6af4bb91beb2ae6e10ce3fc8edf8c8e0ec4da28d396aa484bfcf6181fdc1d
-
Filesize
6KB
MD58c111dc25f4ab2c65bda57bea54fdbdb
SHA1ccaee2be53a6c7868a64342a322408d46187783a
SHA2566c4d22555e192742cc0f1a47aae65b2225e02265e5c0329555a240fedd70776a
SHA512dce0b2f21b6cca2bd38848982f005c742fe8558bd5ab9226e5e497116cd64ccc911616b91ade692234bca107a52f726dea6da6739121889d8cc3f167b35ff57e
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD53def26a13fb71d6886733e6ff78a9aa5
SHA1e0f1c335a3e5f85c62f02fad62dbc9975a14d3ee
SHA256c10bf8f50f85c3b101dd8e9186d10215a326f935463e846b04a741dcbe677f5a
SHA512cb5c0f23d99b66c9ace7ccdf4214acb566ba2643ab39c9783159072e9dc43ab7d6133f7a7a71df670345bcfa77a6be64c25bcf4d36cbc32e2123417f9df035f0