Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/06/2024, 15:51
Static task
static1
Behavioral task
behavioral1
Sample
9b382b8936f5353832695fc7dad7a8e4_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9b382b8936f5353832695fc7dad7a8e4_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9b382b8936f5353832695fc7dad7a8e4_JaffaCakes118.html
-
Size
33KB
-
MD5
9b382b8936f5353832695fc7dad7a8e4
-
SHA1
237c55799f42f282d57446e6976eccfd0a3ac108
-
SHA256
36dc033933e7a9951f591344dd2cc886b8406f46ae82dd0bc57d238c10d02f11
-
SHA512
6e58cda7d5c8281dfbb11b4b60e150b46ea20c4614c99682e91b2ba6e016b0965fbfa900c8df70a746c5c0fd370b78092f07619e6fe00d3c950ef10a0bfe0a16
-
SSDEEP
384:b3AwOHrKlqOMxd8Z5b4ep1wCZDl147eHlbqejdDfAvnWP7ZBJc6ykyyI7cusT1Af:MhHOkOw8f5BZkezzW6lMCICImZ3vMb
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1196 msedge.exe 1196 msedge.exe 2860 msedge.exe 2860 msedge.exe 1484 identity_helper.exe 1484 identity_helper.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe 2140 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe 2860 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2860 wrote to memory of 3364 2860 msedge.exe 82 PID 2860 wrote to memory of 3364 2860 msedge.exe 82 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 3832 2860 msedge.exe 83 PID 2860 wrote to memory of 1196 2860 msedge.exe 84 PID 2860 wrote to memory of 1196 2860 msedge.exe 84 PID 2860 wrote to memory of 676 2860 msedge.exe 85 PID 2860 wrote to memory of 676 2860 msedge.exe 85 PID 2860 wrote to memory of 676 2860 msedge.exe 85 PID 2860 wrote to memory of 676 2860 msedge.exe 85 PID 2860 wrote to memory of 676 2860 msedge.exe 85 PID 2860 wrote to memory of 676 2860 msedge.exe 85 PID 2860 wrote to memory of 676 2860 msedge.exe 85 PID 2860 wrote to memory of 676 2860 msedge.exe 85 PID 2860 wrote to memory of 676 2860 msedge.exe 85 PID 2860 wrote to memory of 676 2860 msedge.exe 85 PID 2860 wrote to memory of 676 2860 msedge.exe 85 PID 2860 wrote to memory of 676 2860 msedge.exe 85 PID 2860 wrote to memory of 676 2860 msedge.exe 85 PID 2860 wrote to memory of 676 2860 msedge.exe 85 PID 2860 wrote to memory of 676 2860 msedge.exe 85 PID 2860 wrote to memory of 676 2860 msedge.exe 85 PID 2860 wrote to memory of 676 2860 msedge.exe 85 PID 2860 wrote to memory of 676 2860 msedge.exe 85 PID 2860 wrote to memory of 676 2860 msedge.exe 85 PID 2860 wrote to memory of 676 2860 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9b382b8936f5353832695fc7dad7a8e4_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed41746f8,0x7ffed4174708,0x7ffed41747182⤵PID:3364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13463350223367571437,6088035770988219985,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:3832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,13463350223367571437,6088035770988219985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,13463350223367571437,6088035770988219985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:82⤵PID:676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13463350223367571437,6088035770988219985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:12⤵PID:3132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13463350223367571437,6088035770988219985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:3288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13463350223367571437,6088035770988219985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:82⤵PID:4388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,13463350223367571437,6088035770988219985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13463350223367571437,6088035770988219985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:12⤵PID:2236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13463350223367571437,6088035770988219985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:12⤵PID:3240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13463350223367571437,6088035770988219985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:12⤵PID:1932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,13463350223367571437,6088035770988219985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4504 /prefetch:12⤵PID:3748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,13463350223367571437,6088035770988219985,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3912 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2140
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:672
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4176
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
5KB
MD5bcbd60b17bc5a4643b803c67d65054cc
SHA11aedf677fbd20fb1ee57c8eb6c80467e7297983d
SHA256ba9ed70025c42031243c85e365ea81f1120e964b15a42b8d6c835fe28e5c89ff
SHA512c5d80333a1a10eb9395a7b881debe2edebd253ed1cd53147634bbed82bd8a65d1e856e555a8f4ccb276ee9a63b206dfe73576e33ef7cbe5eb899a8cae05fcc20
-
Filesize
6KB
MD5e2a67c34c9b68d8728f4a7614a45741c
SHA1b930605b747af7218013e606d41dd0621112fb90
SHA256f76b0dd9b8aa61a5f719f3bc6eea33fb022af47e0f52137366aa3dbfb6a85f51
SHA5124768e98b793ac6d5da97d29607a7dd8b3fbec6333c836fed71a9dc6fc96ee82fae4b19d79d931ede039f939112e419c39908d072511a090bc14457c17d25b167
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD591567b5e4432ceef6aa3e5954dd794c3
SHA1b1493709a9eac56b4be46879015d3958936c6174
SHA2560901ea0cbc6e9fa2eb686d9a1b030ab63373de951a5d82ebb1f3ee1bb9ae7e3d
SHA512eaae73210c5927b4b3b54a94a252af8f075a3563e60d8f7d78568cacc14645ae0c54dbe8748d534bfb32e93fdd5fe3de9762374e17515c8ee182eea837230f20