Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 01:33
Static task
static1
Behavioral task
behavioral1
Sample
7b40402c14d6de8c8a95e2d0b3847791_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7b40402c14d6de8c8a95e2d0b3847791_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7b40402c14d6de8c8a95e2d0b3847791_JaffaCakes118.html
-
Size
447KB
-
MD5
7b40402c14d6de8c8a95e2d0b3847791
-
SHA1
9f0793dffe20c45e6eb3f21217a6a2824b2f5908
-
SHA256
82cdc588634fd0639146e38cd5fa11847eb254232342b34ccec95ab4865fd9fb
-
SHA512
f9e6bd2eee0cbd9a04a8b8a8505852c18aa02d5911a76e9e9cb5fde3da5b3e7b2e193d1adaf752a14ead6c62719112d8a07ebc7cc4397b618b50a099bcabb970
-
SSDEEP
12288:m4cu1ZOLEaaJDHcrYNzBupD9usbZO1c/OU:7/tH+pF
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2780 msedge.exe 2780 msedge.exe 1692 msedge.exe 1692 msedge.exe 612 identity_helper.exe 612 identity_helper.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe 220 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1692 wrote to memory of 1732 1692 msedge.exe 83 PID 1692 wrote to memory of 1732 1692 msedge.exe 83 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 1968 1692 msedge.exe 84 PID 1692 wrote to memory of 2780 1692 msedge.exe 85 PID 1692 wrote to memory of 2780 1692 msedge.exe 85 PID 1692 wrote to memory of 2972 1692 msedge.exe 86 PID 1692 wrote to memory of 2972 1692 msedge.exe 86 PID 1692 wrote to memory of 2972 1692 msedge.exe 86 PID 1692 wrote to memory of 2972 1692 msedge.exe 86 PID 1692 wrote to memory of 2972 1692 msedge.exe 86 PID 1692 wrote to memory of 2972 1692 msedge.exe 86 PID 1692 wrote to memory of 2972 1692 msedge.exe 86 PID 1692 wrote to memory of 2972 1692 msedge.exe 86 PID 1692 wrote to memory of 2972 1692 msedge.exe 86 PID 1692 wrote to memory of 2972 1692 msedge.exe 86 PID 1692 wrote to memory of 2972 1692 msedge.exe 86 PID 1692 wrote to memory of 2972 1692 msedge.exe 86 PID 1692 wrote to memory of 2972 1692 msedge.exe 86 PID 1692 wrote to memory of 2972 1692 msedge.exe 86 PID 1692 wrote to memory of 2972 1692 msedge.exe 86 PID 1692 wrote to memory of 2972 1692 msedge.exe 86 PID 1692 wrote to memory of 2972 1692 msedge.exe 86 PID 1692 wrote to memory of 2972 1692 msedge.exe 86 PID 1692 wrote to memory of 2972 1692 msedge.exe 86 PID 1692 wrote to memory of 2972 1692 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7b40402c14d6de8c8a95e2d0b3847791_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3ad546f8,0x7ffa3ad54708,0x7ffa3ad547182⤵PID:1732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,9638951308318604557,5803534918586624315,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:22⤵PID:1968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,9638951308318604557,5803534918586624315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,9638951308318604557,5803534918586624315,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2464 /prefetch:82⤵PID:2972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,9638951308318604557,5803534918586624315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:3144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,9638951308318604557,5803534918586624315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:3440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,9638951308318604557,5803534918586624315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:82⤵PID:5116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,9638951308318604557,5803534918586624315,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,9638951308318604557,5803534918586624315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:12⤵PID:2872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,9638951308318604557,5803534918586624315,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:12⤵PID:944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,9638951308318604557,5803534918586624315,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:12⤵PID:1296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,9638951308318604557,5803534918586624315,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:12⤵PID:2456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,9638951308318604557,5803534918586624315,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1896 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:220
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2412
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3780
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
Filesize
326B
MD51aac375b60827b9859d42965b9701704
SHA19147ba7c2472942aadc3808fa6e108fd02db0161
SHA2564458d711bd3329b93eef1f32fd1d8dc86b204d0dc4d25e298c84a9d4029f4645
SHA512f1252f9318554833230d72fea3a846693f025c5c75b4bca736f092c0106348c86f37c6bca3085fc8dcb4eaf74baeda59952e415f255820d70a8764030b2795d4
-
Filesize
5KB
MD5d889fae41ab5bb4fe8f7e8b76220a917
SHA13139a4f1e5f250d8662123a1d97c54d84c429a4f
SHA25639d78cb1f925cfc21c4a5abb42a240f8d10f10543d376804fcdf3eef57820222
SHA5127c53b48ded0f0339e493ab2508b0d2edb15957272a13a7873c9a089b92510c8bc73bbc9f5d1f4519cc7fca8914b3799f4cef036b5a159d0faeb5f9e4fcfd0ae2
-
Filesize
6KB
MD50d3204ff1acf931fccb9c5f59d27db28
SHA139a544f0ef486ae00b0f4c47df59adc223da04fc
SHA256c07fa24cb45e0090847100a1523e294fd9196657dd5b7a8d390428fc37e438c7
SHA5123f8cb000da437d58155d5f78533cc397929cd0d92232f9371521c959bd24b58d5f6181546b20ba328ddf6b3d072043a508ec196e3ac075bb4aa6e934d7bb4049
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5ec996e858f5b097ddd75b7a4ea11d8c6
SHA12e137850a09fba1ca75fc17ab49ca19158237f7b
SHA25612352618af669ca0a83f8112127e102f56effaff84c99779625ffe6581b8292b
SHA5121878f2b97116db49e002247cc33b941041bc7c779a7aaae1648f5dec8fb47c28f310b74eb425d0b45b2e389a5fe15dbcc4300dd6f0fbc77f6994ada6f0a03f0d