Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 22:21
Static task
static1
Behavioral task
behavioral1
Sample
a2ab5bce4457451af01bd15262c864e4_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a2ab5bce4457451af01bd15262c864e4_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a2ab5bce4457451af01bd15262c864e4_JaffaCakes118.html
-
Size
27KB
-
MD5
a2ab5bce4457451af01bd15262c864e4
-
SHA1
41cff65e9cb2a24d76c00c89e8b523f667826b7b
-
SHA256
02027153a598ab5d04f6d2ebce6db8614e2cd58e70853d1646282c1e3433f65f
-
SHA512
4ee2860032a5829172cbca18ef3cef2bc31b255f71f8ddcef17b076a3747e4c5a5a436ad32896caf87b34924c3dac35ed50bc644efdaaab917378f9f4cbcb2bc
-
SSDEEP
384:wj4pUfC+Ze1NEPAIIQ+VaNyLfw01+0XwABUu21dsRSwpwE+VJTw0bOGE7fouBSAb:wcpUa+ZeNtQsVmfIp+rkchjnF2yeqBO
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1512 msedge.exe 1512 msedge.exe 3156 msedge.exe 3156 msedge.exe 1712 identity_helper.exe 1712 identity_helper.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe 3048 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
pid Process 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe 3156 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3156 wrote to memory of 4564 3156 msedge.exe 81 PID 3156 wrote to memory of 4564 3156 msedge.exe 81 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 2120 3156 msedge.exe 82 PID 3156 wrote to memory of 1512 3156 msedge.exe 83 PID 3156 wrote to memory of 1512 3156 msedge.exe 83 PID 3156 wrote to memory of 1776 3156 msedge.exe 84 PID 3156 wrote to memory of 1776 3156 msedge.exe 84 PID 3156 wrote to memory of 1776 3156 msedge.exe 84 PID 3156 wrote to memory of 1776 3156 msedge.exe 84 PID 3156 wrote to memory of 1776 3156 msedge.exe 84 PID 3156 wrote to memory of 1776 3156 msedge.exe 84 PID 3156 wrote to memory of 1776 3156 msedge.exe 84 PID 3156 wrote to memory of 1776 3156 msedge.exe 84 PID 3156 wrote to memory of 1776 3156 msedge.exe 84 PID 3156 wrote to memory of 1776 3156 msedge.exe 84 PID 3156 wrote to memory of 1776 3156 msedge.exe 84 PID 3156 wrote to memory of 1776 3156 msedge.exe 84 PID 3156 wrote to memory of 1776 3156 msedge.exe 84 PID 3156 wrote to memory of 1776 3156 msedge.exe 84 PID 3156 wrote to memory of 1776 3156 msedge.exe 84 PID 3156 wrote to memory of 1776 3156 msedge.exe 84 PID 3156 wrote to memory of 1776 3156 msedge.exe 84 PID 3156 wrote to memory of 1776 3156 msedge.exe 84 PID 3156 wrote to memory of 1776 3156 msedge.exe 84 PID 3156 wrote to memory of 1776 3156 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a2ab5bce4457451af01bd15262c864e4_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6b7d46f8,0x7ffd6b7d4708,0x7ffd6b7d47182⤵PID:4564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,14197635990919721229,5375062182480813468,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:2120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,14197635990919721229,5375062182480813468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,14197635990919721229,5375062182480813468,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:82⤵PID:1776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14197635990919721229,5375062182480813468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:1268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14197635990919721229,5375062182480813468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:1348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14197635990919721229,5375062182480813468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:12⤵PID:748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14197635990919721229,5375062182480813468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4332 /prefetch:12⤵PID:2448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14197635990919721229,5375062182480813468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:1248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,14197635990919721229,5375062182480813468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:82⤵PID:4964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,14197635990919721229,5375062182480813468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14197635990919721229,5375062182480813468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:12⤵PID:4488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14197635990919721229,5375062182480813468,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:12⤵PID:2288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14197635990919721229,5375062182480813468,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:12⤵PID:1236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14197635990919721229,5375062182480813468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:12⤵PID:2544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14197635990919721229,5375062182480813468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:12⤵PID:4340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,14197635990919721229,5375062182480813468,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3000 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14197635990919721229,5375062182480813468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:12⤵PID:4860
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2084
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
Filesize
5KB
MD5816f2fbc254fa37c4458b178e1e46eb9
SHA1cec577bcb8793fb1ea0b729b9ba83939477a8e9d
SHA256045f7151340c703817ab2f12f7a27f3c33019300f436176a63356403611c4d6c
SHA512d518e734728ee8e9d85cb42473f04224e9054cb4a80bb03fab97bd1a4912f1cd1311795f317868f305351c7b898af4010db15cd94748a765bd4181c7831f26eb
-
Filesize
6KB
MD59ccac9b6459748975aa729153ae5ec8a
SHA12815ef76f2dcf55d6ae33f1a2cf7b254a1f80096
SHA256f9a17062a5d70f1963be683ff34bcb6d7fe7f8a3cf369e4b384a6859cc635829
SHA512e30cc8c058e6a2ccfda9586a3cf77d174b9c33a5752a5b03baecbe02262625bd7e61d8f486e2924962499254c1becd57112fb0c61051c4512e405267ab8326df
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD54618283bb1788d0aebe4ce4c907327cf
SHA1fb9922f666bae18f38cffb40981369c431cf9bdd
SHA25663cd8d79ed5ad2dfb77ea21ae150fca95bfa35241c6cb7bc410832b263cfe0c2
SHA51250922efa110cd29b2209094ebc8d2a0020d990540481330e1fca4776a0c0912a5dbbe88713894edb9c0467338d560792f10e5e8c181d6e20bf17ef7ff27b6d79