Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 12:19
Static task
static1
Behavioral task
behavioral1
Sample
8a76c2889b5e7970d1e8b1302f1ab706_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
8a76c2889b5e7970d1e8b1302f1ab706_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
8a76c2889b5e7970d1e8b1302f1ab706_JaffaCakes118.html
-
Size
32KB
-
MD5
8a76c2889b5e7970d1e8b1302f1ab706
-
SHA1
6e37f8a48e9bf22e724f7ccb50e94ac84fd48716
-
SHA256
ba42830959a9242ee836a7cecef1e6446ebd2068cbc78590bddf95fdcc1c757c
-
SHA512
de37a3893336d3e2b588399823ddcf1c0154aaa9e5dea6eff99bb858299f22dfe54dc601afc260b872a09793836cfc5a35e1a896a3aa9c2c0e2c1b3c4adde720
-
SSDEEP
768:djhLDJOHE4qEETu7PId8ZAtDqCQl1wzGEe9zfK5ApUcOHwQBYvK55+ViCpub2wVN:djhLDJOHE4qEETu7mqAtGnrwzGEe9zfC
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3964 msedge.exe 3964 msedge.exe 2320 msedge.exe 2320 msedge.exe 2908 identity_helper.exe 2908 identity_helper.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe 5020 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe 2320 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2320 wrote to memory of 2216 2320 msedge.exe 86 PID 2320 wrote to memory of 2216 2320 msedge.exe 86 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 4364 2320 msedge.exe 87 PID 2320 wrote to memory of 3964 2320 msedge.exe 88 PID 2320 wrote to memory of 3964 2320 msedge.exe 88 PID 2320 wrote to memory of 3960 2320 msedge.exe 89 PID 2320 wrote to memory of 3960 2320 msedge.exe 89 PID 2320 wrote to memory of 3960 2320 msedge.exe 89 PID 2320 wrote to memory of 3960 2320 msedge.exe 89 PID 2320 wrote to memory of 3960 2320 msedge.exe 89 PID 2320 wrote to memory of 3960 2320 msedge.exe 89 PID 2320 wrote to memory of 3960 2320 msedge.exe 89 PID 2320 wrote to memory of 3960 2320 msedge.exe 89 PID 2320 wrote to memory of 3960 2320 msedge.exe 89 PID 2320 wrote to memory of 3960 2320 msedge.exe 89 PID 2320 wrote to memory of 3960 2320 msedge.exe 89 PID 2320 wrote to memory of 3960 2320 msedge.exe 89 PID 2320 wrote to memory of 3960 2320 msedge.exe 89 PID 2320 wrote to memory of 3960 2320 msedge.exe 89 PID 2320 wrote to memory of 3960 2320 msedge.exe 89 PID 2320 wrote to memory of 3960 2320 msedge.exe 89 PID 2320 wrote to memory of 3960 2320 msedge.exe 89 PID 2320 wrote to memory of 3960 2320 msedge.exe 89 PID 2320 wrote to memory of 3960 2320 msedge.exe 89 PID 2320 wrote to memory of 3960 2320 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8a76c2889b5e7970d1e8b1302f1ab706_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf44a46f8,0x7ffaf44a4708,0x7ffaf44a47182⤵PID:2216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,394931481674258241,4530504826228107412,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:22⤵PID:4364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,394931481674258241,4530504826228107412,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,394931481674258241,4530504826228107412,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:82⤵PID:3960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,394931481674258241,4530504826228107412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:2060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,394931481674258241,4530504826228107412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:2056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,394931481674258241,4530504826228107412,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:82⤵PID:3580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,394931481674258241,4530504826228107412,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,394931481674258241,4530504826228107412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:12⤵PID:5088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,394931481674258241,4530504826228107412,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:12⤵PID:3776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,394931481674258241,4530504826228107412,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:12⤵PID:2284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,394931481674258241,4530504826228107412,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:12⤵PID:2688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,394931481674258241,4530504826228107412,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1856 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5020
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3704
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:820
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51ac52e2503cc26baee4322f02f5b8d9c
SHA138e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA5127670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
-
Filesize
152B
MD5b2a1398f937474c51a48b347387ee36a
SHA1922a8567f09e68a04233e84e5919043034635949
SHA2562dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA5124a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
-
Filesize
309B
MD5d3e2bd7e28144c509883b4a86f76786d
SHA1fc3afe261533078cddffe032bea4ed9609f2f08a
SHA256256e4bd896a13009c7438f20d17a3a4aeb61c4f1397776b8429a9a76dee33b77
SHA5120c9f9f8b3d4bce28a963513469642b69f1db84e49b403511580d7d71fc3bd2e82d099384765558c5e9f2e4472d5004caddba607069a0cd8776b0e2aa5916d44a
-
Filesize
6KB
MD5b5a68fb8bb8b9d07406f3e69f81c51ca
SHA11981864e2345fb97ee23b23928805be85cb44b1f
SHA2562cd6704f09f36742b1657a1ce30508df11a3d34fb00a6617568147db926fcc88
SHA5129fc55f5efb133a2886297425d29f275bf8057b6a667221adb0bccfbec6fef5b94a09ab670605a3dfe1324e8c28a3e1f9581f267fc15177056b089f05af24cea2
-
Filesize
6KB
MD57a47f9595ed6b0fae34f7a1a88f4a365
SHA1e3777667cca09a4b31d53e137ce61b601ee486d6
SHA25634b205ac0d9c1b17966e088e994a01bf709ca18ece84ae856e2e345fff309cdc
SHA51284e78214aa4fb77bd2193649a61b23089b772fa3c1d1d019deb612ee8e98a13535ad789675d26b700d775c5f68ea422c9af3f085428e38e9e2dcd95bd8c561f0
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5bb6b58eeea48c298c57f1e8fd3ed8bfc
SHA184a50cb08184e7bebd6946c8755f7a57ccdaa86d
SHA2564994f71292e01fe9f12a123a7df7722266ba746ebb601a5e57e31e186d8ecc4f
SHA512b3593fe97ce8d6571650140c586ee88563d796ba63d267faf8e27a82ce7de113d5997e4c99867cbb18976a69b4909fb9d66929ad0d6c4bb94ba7d4f149980896