Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
04/06/2024, 15:25
Static task
static1
Behavioral task
behavioral1
Sample
9559d1e616554c6ab523a77a796d9665_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9559d1e616554c6ab523a77a796d9665_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
9559d1e616554c6ab523a77a796d9665_JaffaCakes118.html
-
Size
461KB
-
MD5
9559d1e616554c6ab523a77a796d9665
-
SHA1
4d9d030e1f8592847967ad368af26c6f4fbf12a0
-
SHA256
c6bdde1ac01bf5d697f89dbb5da637c7aaad06531a962e2a8cb3a34ea4a5c024
-
SHA512
fdbb495faee33ce90b2cd3ac012d31effbbf8073094e9711a567b43dd3d0747c6abe4af83104c01069861830dc911acfd143919f35af67f74b5810f54b8f4340
-
SSDEEP
6144:SvsMYod+X3oI+Y3sMYod+X3oI+Yu+sMYod+X3oI+YLsMYod+X3oI+YQ:W5d+X3R5d+X3l5d+X315d+X3+
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1632 msedge.exe 1632 msedge.exe 1572 msedge.exe 1572 msedge.exe 3348 identity_helper.exe 3348 identity_helper.exe 4744 msedge.exe 4744 msedge.exe 4744 msedge.exe 4744 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe 1572 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1572 wrote to memory of 1348 1572 msedge.exe 82 PID 1572 wrote to memory of 1348 1572 msedge.exe 82 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 4292 1572 msedge.exe 83 PID 1572 wrote to memory of 1632 1572 msedge.exe 84 PID 1572 wrote to memory of 1632 1572 msedge.exe 84 PID 1572 wrote to memory of 2012 1572 msedge.exe 85 PID 1572 wrote to memory of 2012 1572 msedge.exe 85 PID 1572 wrote to memory of 2012 1572 msedge.exe 85 PID 1572 wrote to memory of 2012 1572 msedge.exe 85 PID 1572 wrote to memory of 2012 1572 msedge.exe 85 PID 1572 wrote to memory of 2012 1572 msedge.exe 85 PID 1572 wrote to memory of 2012 1572 msedge.exe 85 PID 1572 wrote to memory of 2012 1572 msedge.exe 85 PID 1572 wrote to memory of 2012 1572 msedge.exe 85 PID 1572 wrote to memory of 2012 1572 msedge.exe 85 PID 1572 wrote to memory of 2012 1572 msedge.exe 85 PID 1572 wrote to memory of 2012 1572 msedge.exe 85 PID 1572 wrote to memory of 2012 1572 msedge.exe 85 PID 1572 wrote to memory of 2012 1572 msedge.exe 85 PID 1572 wrote to memory of 2012 1572 msedge.exe 85 PID 1572 wrote to memory of 2012 1572 msedge.exe 85 PID 1572 wrote to memory of 2012 1572 msedge.exe 85 PID 1572 wrote to memory of 2012 1572 msedge.exe 85 PID 1572 wrote to memory of 2012 1572 msedge.exe 85 PID 1572 wrote to memory of 2012 1572 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9559d1e616554c6ab523a77a796d9665_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8354246f8,0x7ff835424708,0x7ff8354247182⤵PID:1348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,1384526976914968693,10823532524427186514,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:4292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,1384526976914968693,10823532524427186514,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,1384526976914968693,10823532524427186514,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:82⤵PID:2012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1384526976914968693,10823532524427186514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:12⤵PID:1128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1384526976914968693,10823532524427186514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:12⤵PID:5036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,1384526976914968693,10823532524427186514,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:82⤵PID:4368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,1384526976914968693,10823532524427186514,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1384526976914968693,10823532524427186514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:12⤵PID:3284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1384526976914968693,10823532524427186514,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:12⤵PID:3028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1384526976914968693,10823532524427186514,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:12⤵PID:3640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,1384526976914968693,10823532524427186514,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:12⤵PID:2144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,1384526976914968693,10823532524427186514,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4144 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4744
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:432
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52daa93382bba07cbc40af372d30ec576
SHA1c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA2561826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
SHA51265635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
-
Filesize
152B
MD5ecdc2754d7d2ae862272153aa9b9ca6e
SHA1c19bed1c6e1c998b9fa93298639ad7961339147d
SHA256a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
SHA512cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
-
Filesize
5KB
MD531e5d17c24467efc34036f890ff55e78
SHA109f26a6d6e2c4085c0b17711b5a2cc757918d3d6
SHA256e26c99f191948bc4520067c08cdfad7a5e0f3622a490d0731f413a14569e5273
SHA51237fd9ad94f3686dc4fe433cc4eaf1ba8e53e8c02c2247b1ba3cc94ad46a2319385e3df1a9d9b58a1f9ce2d409e68d30d50254f54796f491a4e4ca094274d71ad
-
Filesize
6KB
MD5d398333261ffffc371481ad7d4d4dd80
SHA1000beeff920af9a4de797587169262d567678b85
SHA2563c166d58714f09943c66b6c63eda8bff6446f6a38b371762e0ed876ec86a5a9d
SHA512ed5afc9419337de7c3b73ca632c0018ba7c7f00df4f26d882b52c56de63ef73d31d3ddad3397aa94f599f9043376efce66b5b8e53e850c1f1badc387c164487d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD553460318d604d1f651a469e46cb8c63f
SHA1b9f75dbb4a296cf13d49297718ca38faf47754bb
SHA25666fb76a8a26be5f6c2b212c4dec95f2b3137d177fc6ba16fe642740246b22e95
SHA512480ab378967aba5fccfad4e112c637dc48e195033276fcedca4d8b5904d9d399643334e212785ba50460a8adecdffbf378d4b863b9fa0e28cd1c7cfc4ef458ca