Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 05:03
Static task
static1
Behavioral task
behavioral1
Sample
a3e830569ec382eb1e2fa2a48e8c9891_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
a3e830569ec382eb1e2fa2a48e8c9891_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a3e830569ec382eb1e2fa2a48e8c9891_JaffaCakes118.html
-
Size
5KB
-
MD5
a3e830569ec382eb1e2fa2a48e8c9891
-
SHA1
928c4afb4193519ef975f93a989178c50e1ce451
-
SHA256
347262973959512b301646f57602a5dc16b7a7310b6c164ab38700e8ad0ac1ba
-
SHA512
1eb97adbf80f73909841238051d9a73c6dc7ff135a7d96e45c0ff40039ea0a8bcfcfbe3a0c05a5872a370ad58625c55d557d8e6d741cb1f5efd51726ce47c27c
-
SSDEEP
96:kzMx6hCzGyA/Z5gmurSZSZSTRUfiAyYcIMXQVO7+U:oM8hu7A/cCIIOGgMAy
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4224 msedge.exe 4224 msedge.exe 3000 msedge.exe 3000 msedge.exe 3840 identity_helper.exe 3840 identity_helper.exe 760 msedge.exe 760 msedge.exe 760 msedge.exe 760 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3000 wrote to memory of 3420 3000 msedge.exe 83 PID 3000 wrote to memory of 3420 3000 msedge.exe 83 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 3668 3000 msedge.exe 84 PID 3000 wrote to memory of 4224 3000 msedge.exe 85 PID 3000 wrote to memory of 4224 3000 msedge.exe 85 PID 3000 wrote to memory of 3448 3000 msedge.exe 86 PID 3000 wrote to memory of 3448 3000 msedge.exe 86 PID 3000 wrote to memory of 3448 3000 msedge.exe 86 PID 3000 wrote to memory of 3448 3000 msedge.exe 86 PID 3000 wrote to memory of 3448 3000 msedge.exe 86 PID 3000 wrote to memory of 3448 3000 msedge.exe 86 PID 3000 wrote to memory of 3448 3000 msedge.exe 86 PID 3000 wrote to memory of 3448 3000 msedge.exe 86 PID 3000 wrote to memory of 3448 3000 msedge.exe 86 PID 3000 wrote to memory of 3448 3000 msedge.exe 86 PID 3000 wrote to memory of 3448 3000 msedge.exe 86 PID 3000 wrote to memory of 3448 3000 msedge.exe 86 PID 3000 wrote to memory of 3448 3000 msedge.exe 86 PID 3000 wrote to memory of 3448 3000 msedge.exe 86 PID 3000 wrote to memory of 3448 3000 msedge.exe 86 PID 3000 wrote to memory of 3448 3000 msedge.exe 86 PID 3000 wrote to memory of 3448 3000 msedge.exe 86 PID 3000 wrote to memory of 3448 3000 msedge.exe 86 PID 3000 wrote to memory of 3448 3000 msedge.exe 86 PID 3000 wrote to memory of 3448 3000 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a3e830569ec382eb1e2fa2a48e8c9891_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8637f46f8,0x7ff8637f4708,0x7ff8637f47182⤵PID:3420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,1374342121723054469,7644175578444348722,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:22⤵PID:3668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,1374342121723054469,7644175578444348722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,1374342121723054469,7644175578444348722,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2996 /prefetch:82⤵PID:3448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,1374342121723054469,7644175578444348722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:4196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,1374342121723054469,7644175578444348722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:2064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,1374342121723054469,7644175578444348722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:82⤵PID:3600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,1374342121723054469,7644175578444348722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,1374342121723054469,7644175578444348722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:12⤵PID:4532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,1374342121723054469,7644175578444348722,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:12⤵PID:4328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,1374342121723054469,7644175578444348722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:5068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,1374342121723054469,7644175578444348722,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:12⤵PID:4048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,1374342121723054469,7644175578444348722,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:760
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1356
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:460
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5477462b6ad8eaaf8d38f5e3a4daf17b0
SHA186174e670c44767c08a39cc2a53c09c318326201
SHA256e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
SHA512a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
-
Filesize
152B
MD5b704c9ca0493bd4548ac9c69dc4a4f27
SHA1a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA2562ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
SHA51269c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
-
Filesize
381B
MD53cbcd0eb96d41892eff3af780e5ae0c2
SHA1ac3f3721df075717556fff45935e43c9f902395f
SHA256d7b8d6164fdf642b546b63ac796f8c7f882b018fa896fbceaecebbbc35704930
SHA512c8aa1809e2144e3a53acedb3a232ee1d830fef960886ce2e31a351048e2e347e809717abf9f8e80b2aa59bc9c8bbfd180b2017620a3836a7ae8f614400dc982b
-
Filesize
6KB
MD5fa3792222069ff4ea00a13ba683243ce
SHA1106f25268e1fd6aac3fc01fa62802d7b4f059c3b
SHA2567716138e8415499d5d135e055eae2330b6d17acc70c8b1ed48c7f6e0bb215834
SHA512c997da10feb9d2d03215cd2365346719472c1a05bc35e5a1f93c1ad483810a2b065ff55a948495f03fd3bd780667cd88fc8b7f353bc5591b3d4402e97d3a090d
-
Filesize
6KB
MD54b8a3e4782aeb59b8032b0fabb8e8f8c
SHA19ece934886138ad21d9c7a5c2fcfdd1debcbb882
SHA256feb37fc561fd4ee6f7ac5eb41895c16e26fb916768400c57e602708a2ff6580c
SHA5124533bddb8a8e60cfbbf6f7991c90efe8f24df21c5bc96e78609a83d30b2e67c00c031a12b044555495a03a421f9c8289afd7af4711bbd1121adae272bef2a077
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5c4daa6fa7493543dbbcf35c6fa35cec0
SHA149cbf0c6c43cc655210ede95e1394de86e0877f5
SHA256aac0ee60ace32ca3de4d825a133202f9831ef10474d6907c823362a5d54545d9
SHA5122eec412092eba8d11db5778e83a586aaaa2c83383e89a1b68c691b9892a2dc77c00478365102da0802407f1c65b232bcfb911be12cccbc911deba652b19a1eeb