Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/06/2024, 19:54
Static task
static1
Behavioral task
behavioral1
Sample
961152877e2a949da27454d4995f2113_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
961152877e2a949da27454d4995f2113_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
961152877e2a949da27454d4995f2113_JaffaCakes118.html
-
Size
3KB
-
MD5
961152877e2a949da27454d4995f2113
-
SHA1
a56d1a1d7d876d7f81b4e6fd5bde7d0a897a40e6
-
SHA256
cb23d9c11345934578c5ed15f7134602e828a2942fca56cbd854393af18ddabf
-
SHA512
b7c02a1831746c3f7757e65e7bb20d0ea62bce32637d68a505d3f2bdd038a9250db5459e2ae50f7d06fbda4a09f2665457c5e3737befbb49bc5aa1640fcda308
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 936 msedge.exe 936 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 2296 identity_helper.exe 2296 identity_helper.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe 4896 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4896 wrote to memory of 3588 4896 msedge.exe 83 PID 4896 wrote to memory of 3588 4896 msedge.exe 83 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 5060 4896 msedge.exe 84 PID 4896 wrote to memory of 936 4896 msedge.exe 85 PID 4896 wrote to memory of 936 4896 msedge.exe 85 PID 4896 wrote to memory of 3528 4896 msedge.exe 86 PID 4896 wrote to memory of 3528 4896 msedge.exe 86 PID 4896 wrote to memory of 3528 4896 msedge.exe 86 PID 4896 wrote to memory of 3528 4896 msedge.exe 86 PID 4896 wrote to memory of 3528 4896 msedge.exe 86 PID 4896 wrote to memory of 3528 4896 msedge.exe 86 PID 4896 wrote to memory of 3528 4896 msedge.exe 86 PID 4896 wrote to memory of 3528 4896 msedge.exe 86 PID 4896 wrote to memory of 3528 4896 msedge.exe 86 PID 4896 wrote to memory of 3528 4896 msedge.exe 86 PID 4896 wrote to memory of 3528 4896 msedge.exe 86 PID 4896 wrote to memory of 3528 4896 msedge.exe 86 PID 4896 wrote to memory of 3528 4896 msedge.exe 86 PID 4896 wrote to memory of 3528 4896 msedge.exe 86 PID 4896 wrote to memory of 3528 4896 msedge.exe 86 PID 4896 wrote to memory of 3528 4896 msedge.exe 86 PID 4896 wrote to memory of 3528 4896 msedge.exe 86 PID 4896 wrote to memory of 3528 4896 msedge.exe 86 PID 4896 wrote to memory of 3528 4896 msedge.exe 86 PID 4896 wrote to memory of 3528 4896 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\961152877e2a949da27454d4995f2113_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa127d46f8,0x7ffa127d4708,0x7ffa127d47182⤵PID:3588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11226646493092347882,3562419542290185548,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:5060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,11226646493092347882,3562419542290185548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,11226646493092347882,3562419542290185548,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:82⤵PID:3528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11226646493092347882,3562419542290185548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:4404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11226646493092347882,3562419542290185548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11226646493092347882,3562419542290185548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:82⤵PID:2924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,11226646493092347882,3562419542290185548,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11226646493092347882,3562419542290185548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:12⤵PID:5392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11226646493092347882,3562419542290185548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:12⤵PID:3612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11226646493092347882,3562419542290185548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:12⤵PID:4596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11226646493092347882,3562419542290185548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:12⤵PID:840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11226646493092347882,3562419542290185548,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:12⤵PID:5648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,11226646493092347882,3562419542290185548,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:12⤵PID:5028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,11226646493092347882,3562419542290185548,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4952 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4320
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5212
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5144
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1164
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
744B
MD56cc851635eac095c15560fcdac1cebe7
SHA10ef4f6892dbe57ffc70fb1a3dfd3aaa151f856f9
SHA256a485c90239affe1c5d6dd6715da4d925a791be453f7a07a6511cef6b15532e95
SHA51225f9471d603d8d8603ecae515d8ee2b704e765a5bcf9f175cc493b33e412fa5a98eb651e44407bf4e75372453519bc651c507be4c1ea8f472b7b6535acea7826
-
Filesize
3KB
MD5409f86ea9c00fd28be50d005e41fbcd4
SHA1d04b91f380b046fd29abc35bac483fa6d2ee2033
SHA256b3aacc52347b092dbf2ba66e8d021e700a038c60fb8109312a6b7ad5290e8c34
SHA5128cdddea926587fb596ffe7ea42fe601315bca64d07341e2dd9f66e9c3e125fbff388466f8ae39af42898eb159e9a0dd1f6b33e519c350aef209c3893f0b10082
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD5ce26ccfa97ba8be950fd5fd3cbd05aac
SHA10ec0c3d457fc60ec5ce2a122a07da4341d35461c
SHA2566ccc5ff3dfe3ea4d00416998308c5abf7e1724df329ab118454838f3d2bd03c4
SHA51290bd4965f6c18c17afc81d02aaac7cf8faeb229f542b2f7124b85d58088ff4246b423515c451463275ea5c7b202f5a3ba4c0f81b173763008102148b618ead52
-
Filesize
6KB
MD569c768087752bed1dcba4dde30776a9c
SHA15692f6b6650040386d6aaf0b79ce0c68aa8dbb31
SHA2562de2ce76ddb5368ab0d49d8474d351a3fd6c2d42d5f7bc1b8b6d158c1fe751c7
SHA5129c04fde42a04dee5c81703bacfc30fd6eab9f439bf0a36d628f70be4160c44df4f80aded1dc17f0843a46f55a212a26585334628f7b3127affbdebc925d0976f
-
Filesize
6KB
MD55cd772764f5c9a6ee9475ea09c288312
SHA1841cb5fa733c6501a339116e3f46e9b281d96161
SHA256bf9dbf59cdd0a68cb9b45216e5842b976718d605b4de11475b077f99bd2dd9d2
SHA512eee1bc065f9c959e8a6d82a5d74c19050beb37782b144748a9596be6c9d1c5755ef6c913f06e6d7361fa9266426cc7df50b46eff8c5eb587f5021c6b67087263
-
Filesize
6KB
MD5bf56c749dab20fb9e5ce33aba7ec43e4
SHA17845ef5ffb4cf9000de15156206ee42774a761be
SHA25666ff352b3df308c5d4aa04e72500e4bc65ab46b0f1b64acaabb141542a193ba2
SHA51234a1c93ea8f2601909f43133b3121f200508977ee27ba0838c4ca4a0ed5bb90dcbd01c3357befb7f72a2d11d13843a2f994ca7394cd98356e32e948e64bd05d9
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD516996eb9f40ee302df4a4f9e154f3879
SHA13e149bbec1aee1cff94449495ff18745ef3c378f
SHA25630a07bcded197118af19b7acf8a2eecec63f81e7e8d201d744e71d633e919206
SHA5123522a00d3349b979dad829c6779339a0c4c548b6e86cabf79217c4b368829862bb22fa32e35a18eb9015a0a4a30017b3f8d23375bcced4439e36c8268d322ac4