Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 06:09
Static task
static1
Behavioral task
behavioral1
Sample
862d67220ebdae30edaf52212f7bf2dd_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
862d67220ebdae30edaf52212f7bf2dd_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
862d67220ebdae30edaf52212f7bf2dd_JaffaCakes118.html
-
Size
35KB
-
MD5
862d67220ebdae30edaf52212f7bf2dd
-
SHA1
567d21e6ed44e1b0f30d59c3c6db4ed0bf9d8c7b
-
SHA256
1a306c9100a020904c6da34143df9f77fb9cfc2538da498171c9cbd065a12cbf
-
SHA512
8acd2af0951f1b040d1d4fb49d106d2cab7510b4d24c1be12aa51f7fe9f9841d5870e439d8ebfba87fc0bb86b69cf1d690f82d1533579ef8cfda2bbabecf2942
-
SSDEEP
768:zwx/MDTHP388hARtZPXEE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6T/uJxF6lJtxU6lh:Q/jbJxNV4u0Sx/x8uK
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1968 msedge.exe 1968 msedge.exe 3300 msedge.exe 3300 msedge.exe 3244 identity_helper.exe 3244 identity_helper.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe 3300 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3300 wrote to memory of 2208 3300 msedge.exe 82 PID 3300 wrote to memory of 2208 3300 msedge.exe 82 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 2168 3300 msedge.exe 83 PID 3300 wrote to memory of 1968 3300 msedge.exe 84 PID 3300 wrote to memory of 1968 3300 msedge.exe 84 PID 3300 wrote to memory of 2292 3300 msedge.exe 85 PID 3300 wrote to memory of 2292 3300 msedge.exe 85 PID 3300 wrote to memory of 2292 3300 msedge.exe 85 PID 3300 wrote to memory of 2292 3300 msedge.exe 85 PID 3300 wrote to memory of 2292 3300 msedge.exe 85 PID 3300 wrote to memory of 2292 3300 msedge.exe 85 PID 3300 wrote to memory of 2292 3300 msedge.exe 85 PID 3300 wrote to memory of 2292 3300 msedge.exe 85 PID 3300 wrote to memory of 2292 3300 msedge.exe 85 PID 3300 wrote to memory of 2292 3300 msedge.exe 85 PID 3300 wrote to memory of 2292 3300 msedge.exe 85 PID 3300 wrote to memory of 2292 3300 msedge.exe 85 PID 3300 wrote to memory of 2292 3300 msedge.exe 85 PID 3300 wrote to memory of 2292 3300 msedge.exe 85 PID 3300 wrote to memory of 2292 3300 msedge.exe 85 PID 3300 wrote to memory of 2292 3300 msedge.exe 85 PID 3300 wrote to memory of 2292 3300 msedge.exe 85 PID 3300 wrote to memory of 2292 3300 msedge.exe 85 PID 3300 wrote to memory of 2292 3300 msedge.exe 85 PID 3300 wrote to memory of 2292 3300 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\862d67220ebdae30edaf52212f7bf2dd_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8e0146f8,0x7ffe8e014708,0x7ffe8e0147182⤵PID:2208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,9542599027263533485,2177976427929966993,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:2168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,9542599027263533485,2177976427929966993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,9542599027263533485,2177976427929966993,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:82⤵PID:2292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9542599027263533485,2177976427929966993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9542599027263533485,2177976427929966993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:4256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,9542599027263533485,2177976427929966993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:82⤵PID:4328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,9542599027263533485,2177976427929966993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9542599027263533485,2177976427929966993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:12⤵PID:1112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9542599027263533485,2177976427929966993,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:12⤵PID:2400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9542599027263533485,2177976427929966993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:12⤵PID:2440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,9542599027263533485,2177976427929966993,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:12⤵PID:2360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,9542599027263533485,2177976427929966993,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4172 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2052
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5000
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
Filesize
613B
MD5b2d9d840c1d9fdca9190eb7d533e3e7e
SHA116d1293a5b90270384c45c0dbff62491eceaaef1
SHA256f60d022638cff9f5735f1a31412cadc5bf60c75e5d9cdafadb1400f1af9b00b6
SHA512d7c46a7d49f1cacfc757199eb773be4213db29c8d61ea4913ba4227352e07d8efd570ab5fd99f75d43a279c18edc2dc0631d7a867ce3d10f34e38eabcff33f5b
-
Filesize
5KB
MD527a9e31e45b9986f7f17251d461a2029
SHA10507ec0d2160976af685fceea9b574473497579d
SHA2561b876025ead93f8e04fc894ed6c0ea6b62614c71eb659dd5c142d016b7793c5c
SHA51294c59b0d3f87eec4d291c8d3529978ed071f858613a527d8aa3d547a94ae63d0745e6fae637efd5f1f54933c9f5473565d3ed39250429584f348f54fe39f3a44
-
Filesize
6KB
MD520c930a1d9ed506808fb721e0edb9283
SHA1f301ef08f9fdc7c93b30cfa1094895405c559ed0
SHA256c6cd32f7bdc89e4948d623caeb56d75a7fa6ef5ad5a6d46a7a686fc8c554a519
SHA512d72b5510586564f3a45e9270ea2cd980397717f0076402166ba4ffda5314a17cfaf8a75b8db9abe3f7184f2858bcf6085ce603129a68e7e6b2f97d709d309072
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5b62f57ef3709890a4e8ca7eb22e7f4ed
SHA120cd3958cabe3bbccbd78257c877e780525ed2f0
SHA2561541b572feafabeaa0eb23e5e871d75dcc5ad51be3ba2cf094209c247e1b7ec8
SHA5124355aeceb81de233224f5a3ed136be007308ac14c80f86c232a3f536032ea63d7c7fb66bf1a4f9fa62eb97793000bec593f5883642d3d05dc2140c18addc850a