Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 06:29
Static task
static1
Behavioral task
behavioral1
Sample
7c0499a74fb0147c770d0a385cba384d_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7c0499a74fb0147c770d0a385cba384d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
7c0499a74fb0147c770d0a385cba384d_JaffaCakes118.html
-
Size
158KB
-
MD5
7c0499a74fb0147c770d0a385cba384d
-
SHA1
4421957ede7d0f11ecb151cb90fa9d692e78611c
-
SHA256
30f65ce47769aa653b42c36df93d66a37cecd7cf582ede7a21d9809b30818afb
-
SHA512
466658d4e79eb6a53d4fe7b1aaa367a49886f920bd53eeae9f01deef7a5b644f8a78bf0796fbc147b3fa4be5574296a5dfefb60ec243a22ee7b63c718f12aab7
-
SSDEEP
1536:iKRTmEEk5zirRyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:iI5GRyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4056 msedge.exe 4056 msedge.exe 3288 msedge.exe 3288 msedge.exe 4292 msedge.exe 4292 msedge.exe 4292 msedge.exe 4292 msedge.exe 4620 identity_helper.exe 4620 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe 3288 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3288 wrote to memory of 4092 3288 msedge.exe 81 PID 3288 wrote to memory of 4092 3288 msedge.exe 81 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 396 3288 msedge.exe 82 PID 3288 wrote to memory of 4056 3288 msedge.exe 83 PID 3288 wrote to memory of 4056 3288 msedge.exe 83 PID 3288 wrote to memory of 4976 3288 msedge.exe 84 PID 3288 wrote to memory of 4976 3288 msedge.exe 84 PID 3288 wrote to memory of 4976 3288 msedge.exe 84 PID 3288 wrote to memory of 4976 3288 msedge.exe 84 PID 3288 wrote to memory of 4976 3288 msedge.exe 84 PID 3288 wrote to memory of 4976 3288 msedge.exe 84 PID 3288 wrote to memory of 4976 3288 msedge.exe 84 PID 3288 wrote to memory of 4976 3288 msedge.exe 84 PID 3288 wrote to memory of 4976 3288 msedge.exe 84 PID 3288 wrote to memory of 4976 3288 msedge.exe 84 PID 3288 wrote to memory of 4976 3288 msedge.exe 84 PID 3288 wrote to memory of 4976 3288 msedge.exe 84 PID 3288 wrote to memory of 4976 3288 msedge.exe 84 PID 3288 wrote to memory of 4976 3288 msedge.exe 84 PID 3288 wrote to memory of 4976 3288 msedge.exe 84 PID 3288 wrote to memory of 4976 3288 msedge.exe 84 PID 3288 wrote to memory of 4976 3288 msedge.exe 84 PID 3288 wrote to memory of 4976 3288 msedge.exe 84 PID 3288 wrote to memory of 4976 3288 msedge.exe 84 PID 3288 wrote to memory of 4976 3288 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7c0499a74fb0147c770d0a385cba384d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb93be46f8,0x7ffb93be4708,0x7ffb93be47182⤵PID:4092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,7622510548911604071,11858800697283127788,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:22⤵PID:396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,7622510548911604071,11858800697283127788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,7622510548911604071,11858800697283127788,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:82⤵PID:4976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7622510548911604071,11858800697283127788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7622510548911604071,11858800697283127788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:1100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,7622510548911604071,11858800697283127788,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,7622510548911604071,11858800697283127788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 /prefetch:82⤵PID:3960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,7622510548911604071,11858800697283127788,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7622510548911604071,11858800697283127788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:12⤵PID:1416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7622510548911604071,11858800697283127788,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:12⤵PID:5112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7622510548911604071,11858800697283127788,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:12⤵PID:2840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7622510548911604071,11858800697283127788,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:12⤵PID:4348
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1068
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3080
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
Filesize
5KB
MD50e312af5eae41e6422c328a0419107de
SHA1535408e26584c2326655bee4c859cc9f205cbef7
SHA2561d6b3720f7a371c9a904038ae7f7107afad7761af912b571aa7d30ca61ff2334
SHA51225c41c459e84d55736c8a98139a4307cf9b6c21ada7ff32fed6bb340b92784336248edd9d72d19eb571899551e69e95f753f4079485b8b31f9bd79e5c8a5a80b
-
Filesize
6KB
MD5a28b94103d13eb9df3010b2932fa9f62
SHA1631d187f5e67ff861567c7497fa847f78289dd84
SHA25603da1aeb45a42f89ce8850f382f9d91838d5a02650413718a435d6a5242b1e9b
SHA51218d5f86690aa661e09273c1b7ef224c1ca6cdfc32cf678d8eddc8386b6e5d6444f0ee964abde7e09fc709c48a583dd042e76752e13918442ffdd1ed00f41a17b
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD5992d9f8e6a0402c9f6e6a03eac547773
SHA102926fe5d39745ae394a7ecb4fa34e2b30d09214
SHA2566720d1be903e62209613f79f161504734480928a4103c5bad498fce99bcf6807
SHA512a3c428550f5744879344c45ef69406e54da96f69e3ae000c28ad6bb6d751351620643c79732ea6c64f413cf22d99b1c5bce64041479d0677a3a92c97bc2eb15c