Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2024, 20:51
Static task
static1
Behavioral task
behavioral1
Sample
9938fc7e6785df4966a29f025cdf4044_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9938fc7e6785df4966a29f025cdf4044_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9938fc7e6785df4966a29f025cdf4044_JaffaCakes118.html
-
Size
82KB
-
MD5
9938fc7e6785df4966a29f025cdf4044
-
SHA1
30cd36fff90abcb876c8149818fbc73c3f19cf27
-
SHA256
bef71dbb80e40dcf350fdc382b498962d866346c013f7336f8fc1bb717c6bcf2
-
SHA512
eed0ca0762620cd7f7831ddf9c8abe414a7cf2b51564c446a8a199369dc400ab2635d87e4abe380e8b0c45d6a10d067af715b54aef88f2dcf4767aab4a867b54
-
SSDEEP
1536:SjyN0bFgNAH6xdMhTCU/sLn3K7N9x4jVIng6CH3GuO3SogBSiJ/ojb8TjWruHJQg:SjyN0bFgNAH6xdMhTCU/sLn3K7/0j5OW
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1300 msedge.exe 1300 msedge.exe 2028 msedge.exe 2028 msedge.exe 4400 identity_helper.exe 4400 identity_helper.exe 1740 msedge.exe 1740 msedge.exe 1740 msedge.exe 1740 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe 2028 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2028 wrote to memory of 1492 2028 msedge.exe 82 PID 2028 wrote to memory of 1492 2028 msedge.exe 82 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 4124 2028 msedge.exe 83 PID 2028 wrote to memory of 1300 2028 msedge.exe 84 PID 2028 wrote to memory of 1300 2028 msedge.exe 84 PID 2028 wrote to memory of 3716 2028 msedge.exe 85 PID 2028 wrote to memory of 3716 2028 msedge.exe 85 PID 2028 wrote to memory of 3716 2028 msedge.exe 85 PID 2028 wrote to memory of 3716 2028 msedge.exe 85 PID 2028 wrote to memory of 3716 2028 msedge.exe 85 PID 2028 wrote to memory of 3716 2028 msedge.exe 85 PID 2028 wrote to memory of 3716 2028 msedge.exe 85 PID 2028 wrote to memory of 3716 2028 msedge.exe 85 PID 2028 wrote to memory of 3716 2028 msedge.exe 85 PID 2028 wrote to memory of 3716 2028 msedge.exe 85 PID 2028 wrote to memory of 3716 2028 msedge.exe 85 PID 2028 wrote to memory of 3716 2028 msedge.exe 85 PID 2028 wrote to memory of 3716 2028 msedge.exe 85 PID 2028 wrote to memory of 3716 2028 msedge.exe 85 PID 2028 wrote to memory of 3716 2028 msedge.exe 85 PID 2028 wrote to memory of 3716 2028 msedge.exe 85 PID 2028 wrote to memory of 3716 2028 msedge.exe 85 PID 2028 wrote to memory of 3716 2028 msedge.exe 85 PID 2028 wrote to memory of 3716 2028 msedge.exe 85 PID 2028 wrote to memory of 3716 2028 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9938fc7e6785df4966a29f025cdf4044_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb533746f8,0x7ffb53374708,0x7ffb533747182⤵PID:1492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,797801210184288969,240122610880688593,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:22⤵PID:4124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,797801210184288969,240122610880688593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,797801210184288969,240122610880688593,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:82⤵PID:3716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,797801210184288969,240122610880688593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:1500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,797801210184288969,240122610880688593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:3444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,797801210184288969,240122610880688593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:12⤵PID:1504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,797801210184288969,240122610880688593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:12⤵PID:1548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,797801210184288969,240122610880688593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:82⤵PID:876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,797801210184288969,240122610880688593,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5620 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,797801210184288969,240122610880688593,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:12⤵PID:3492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,797801210184288969,240122610880688593,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:12⤵PID:4328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,797801210184288969,240122610880688593,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4728 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1740
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1560
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2340
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA256284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
SHA512971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
-
Filesize
152B
MD587f7abeb82600e1e640b843ad50fe0a1
SHA1045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA256b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
SHA512ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
-
Filesize
185B
MD5efa3b79297b792ddfa72609e2389407a
SHA17c959b0d9c508607119d7c112fe81939169c8ccb
SHA25604371cb7276a5868761433e311d805f97da580075fc9bf1a66f0a9d8ac9a4017
SHA5121f08b7ea9823ae979382586db83b05c0d0dc5cb565b3946fb8134c0dfaaf61fdf80d6c666ceca6522964ac446d2a2e798e1f0eaff3dd2ab5cae88a793db20eaf
-
Filesize
5KB
MD53d2277fe9753b05883f3f3362fe52098
SHA1b4f2e40b4b1e451fadc1cfc149d83fbc2e56c3fb
SHA256ea0d71061eaf8918c9338cf1881f7545ad76e10d041629d10c1fc1ee486316af
SHA51216beb5a2e4ed5bbc794aad8afc798f255b43293f5ee9b6fc66f286642c74f5f2d3f08423848f02df257a7df7e0cc0d5a917a11f70571cca92e2bdc3cc7632fbf
-
Filesize
6KB
MD58e61a4454cfa8eec4bab978fc213975d
SHA1fa6a0398312b33edb32d05abda8ccbdfa94590c5
SHA2569226a22f6482cd78e7e00f301484f42e08655542f608a4443dd8d208baf1328e
SHA512de74e3e9250874a99e3be10365c9228007fe69546e11e7b0cdc6089e42498475d7a83001ebb34c6fd6c3f520b9b09cfaeee3e5e1dd719105a241f01896625ad5
-
Filesize
6KB
MD5df7cce684cd46e19d5eea6f54d6dafcc
SHA17ddcd07ba31f224d393ead340a548a79eb6a94ec
SHA2567cde138f937c137d51edcdf1d3ada16fc973951dac2722c3eec4b7bcade33db4
SHA512579f5d1e50a375abdeb57be87cc4cf6d00b4c5554f11fbaecd4f7dd407ddbe0bd1ad2ab229de4a0e93916da7c5cb58d02f40807b6d7a30fc7b433a2776cf4a59
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5dce810be6c391ca2299ba9c0ab80348b
SHA19294e0f9b8fd6deddd1461f583defd7d743bf7f9
SHA25601713b9e19f61e50a25bc09ea44d7335ef342f158651dabe6bff120d880e24d5
SHA512999f84967496494a10f567f873dd45684500162fa0b2dadb901e6f8894205ba26a16d685d43243d423922056728d6af7d7202622f899bbd372a6e84561fb321d