Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 09:31
Static task
static1
Behavioral task
behavioral1
Sample
80453ed572a2cc3a0e905cd874ef9bdf_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
80453ed572a2cc3a0e905cd874ef9bdf_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
80453ed572a2cc3a0e905cd874ef9bdf_JaffaCakes118.html
-
Size
21KB
-
MD5
80453ed572a2cc3a0e905cd874ef9bdf
-
SHA1
e7fc5d5b7a999127bd58749333fc796c13e787d1
-
SHA256
3dc6b0620e566398c8a47b6863fa3c3b98d3617e5135e05b77ab05577b9868c3
-
SHA512
bdf723fe0f6e5a2d303685b31b7d1ad4aafe33d4a60af7f1f6651053da26156da1e604dcab7448cb8c77b611cfbc70f30d1aeef52e14691f1de3b06514ce4f10
-
SSDEEP
384:SN1MrOOLueT9uYKr4nUy6pLtKeN13os8lQxuen1V:SN1MrOOLr5NKr/lrNosasRn1V
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2264 msedge.exe 2264 msedge.exe 3308 msedge.exe 3308 msedge.exe 3624 identity_helper.exe 3624 identity_helper.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe 1872 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3308 wrote to memory of 1600 3308 msedge.exe 84 PID 3308 wrote to memory of 1600 3308 msedge.exe 84 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2472 3308 msedge.exe 85 PID 3308 wrote to memory of 2264 3308 msedge.exe 86 PID 3308 wrote to memory of 2264 3308 msedge.exe 86 PID 3308 wrote to memory of 1740 3308 msedge.exe 87 PID 3308 wrote to memory of 1740 3308 msedge.exe 87 PID 3308 wrote to memory of 1740 3308 msedge.exe 87 PID 3308 wrote to memory of 1740 3308 msedge.exe 87 PID 3308 wrote to memory of 1740 3308 msedge.exe 87 PID 3308 wrote to memory of 1740 3308 msedge.exe 87 PID 3308 wrote to memory of 1740 3308 msedge.exe 87 PID 3308 wrote to memory of 1740 3308 msedge.exe 87 PID 3308 wrote to memory of 1740 3308 msedge.exe 87 PID 3308 wrote to memory of 1740 3308 msedge.exe 87 PID 3308 wrote to memory of 1740 3308 msedge.exe 87 PID 3308 wrote to memory of 1740 3308 msedge.exe 87 PID 3308 wrote to memory of 1740 3308 msedge.exe 87 PID 3308 wrote to memory of 1740 3308 msedge.exe 87 PID 3308 wrote to memory of 1740 3308 msedge.exe 87 PID 3308 wrote to memory of 1740 3308 msedge.exe 87 PID 3308 wrote to memory of 1740 3308 msedge.exe 87 PID 3308 wrote to memory of 1740 3308 msedge.exe 87 PID 3308 wrote to memory of 1740 3308 msedge.exe 87 PID 3308 wrote to memory of 1740 3308 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\80453ed572a2cc3a0e905cd874ef9bdf_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc835446f8,0x7ffc83544708,0x7ffc835447182⤵PID:1600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,2255706919015614579,569606280081685025,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:22⤵PID:2472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,2255706919015614579,569606280081685025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,2255706919015614579,569606280081685025,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:82⤵PID:1740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2255706919015614579,569606280081685025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:1684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2255706919015614579,569606280081685025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:3292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,2255706919015614579,569606280081685025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:82⤵PID:3248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,2255706919015614579,569606280081685025,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2255706919015614579,569606280081685025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:12⤵PID:3364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2255706919015614579,569606280081685025,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:12⤵PID:2260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2255706919015614579,569606280081685025,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:12⤵PID:5052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,2255706919015614579,569606280081685025,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:12⤵PID:2296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,2255706919015614579,569606280081685025,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1872
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4616
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54f7152bc5a1a715ef481e37d1c791959
SHA1c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA256704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
SHA5122e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
-
Filesize
152B
MD5ea98e583ad99df195d29aa066204ab56
SHA1f89398664af0179641aa0138b337097b617cb2db
SHA256a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
SHA512e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
-
Filesize
184B
MD5f0794ab58d4ca1b719f942280a39f3c2
SHA1994cc0f59a8473992fa5d02a20689d0ada38d0eb
SHA2560ae1ec54c86cb5ede0b77ce0a82609ac977f6002493ce7f6d29777a37cdcf01f
SHA512fae5221007fcb49d1991f2a4b8b950c0ecea1e7827928e414085867906bd63810ed307f71799ac25b1d58d51b9bc678a8aa56420dcdecf19b6514eaf8b946fa5
-
Filesize
5KB
MD5f454a6d3ae89fcbdabea8922bbf45703
SHA15d8738117cd54a4390159f58d453e767affee07a
SHA2569c5f65e62c4397d96556046b1f9fefadfbba4a64aacd908ce5431cc0655d6aa6
SHA51220788025be8247edde1d33e73a92ba5e2baf3c9eb46a6793f56eb64d85106f155056e9b04910a09e1394799b229fff7d08fa46f021e7102f249f67dd09ea7579
-
Filesize
6KB
MD5f3b6e8008ff3fa29411bb579e3b0c671
SHA1823e8b283c648df9e8df725cc02236912367a466
SHA25619bb11ccf968e6838aa8f8336ca956f4c5092649538d2cae73088883e27dfed4
SHA5124b2ad184ffcc09e21c2573d492691638e89cd919804b2b4fbd7da62656a2a76b6febfcc258efb2c608e5524e207a79c6496a712ab4380318034d1f85a672b04d
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
10KB
MD51bb06444a3d64b0630e8c0681b8a9f1d
SHA18e70e1f68433d213fb6613db57d9bcf758c94f41
SHA2562e3130c8d189d93cec611a3959d55e2df58cf1dae7cbd2bdcca9ae08d6998f84
SHA512f841074b8b00657d83b7c2b2acb63baf50c69537edea4b460a3c5d572dbdae377b3524813624a62670ac83a0b6192e962a4c8fa5a12d876d89a1ef372be05bd0