Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/06/2024, 05:38
Static task
static1
Behavioral task
behavioral1
Sample
a406093f5fffd299d30a43fb734e754a_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a406093f5fffd299d30a43fb734e754a_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a406093f5fffd299d30a43fb734e754a_JaffaCakes118.html
-
Size
349KB
-
MD5
a406093f5fffd299d30a43fb734e754a
-
SHA1
cbc507fc43faab69068a49824b0c342c9ba34a2a
-
SHA256
de04e823bd75683fc57f7f64cf1b37defab5025bd13e667a2914ecc4aed37607
-
SHA512
35cd92f1fd77b6b3189db29b0f64e91e03af150bfb23c24b9c92294f1f3cb92535f4ade93c8c70eace2142d9055239a900ff65c4ae4c86634d63e4959dd0a65e
-
SSDEEP
6144:SmsMYod+X3oI+YRsMYod+X3oI+YAsMYod+X3oI+YQ:z5d+X3/5d+X3Y5d+X3+
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4588 msedge.exe 4588 msedge.exe 2688 msedge.exe 2688 msedge.exe 1556 identity_helper.exe 1556 identity_helper.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2688 wrote to memory of 4884 2688 msedge.exe 81 PID 2688 wrote to memory of 4884 2688 msedge.exe 81 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 3776 2688 msedge.exe 82 PID 2688 wrote to memory of 4588 2688 msedge.exe 83 PID 2688 wrote to memory of 4588 2688 msedge.exe 83 PID 2688 wrote to memory of 1688 2688 msedge.exe 84 PID 2688 wrote to memory of 1688 2688 msedge.exe 84 PID 2688 wrote to memory of 1688 2688 msedge.exe 84 PID 2688 wrote to memory of 1688 2688 msedge.exe 84 PID 2688 wrote to memory of 1688 2688 msedge.exe 84 PID 2688 wrote to memory of 1688 2688 msedge.exe 84 PID 2688 wrote to memory of 1688 2688 msedge.exe 84 PID 2688 wrote to memory of 1688 2688 msedge.exe 84 PID 2688 wrote to memory of 1688 2688 msedge.exe 84 PID 2688 wrote to memory of 1688 2688 msedge.exe 84 PID 2688 wrote to memory of 1688 2688 msedge.exe 84 PID 2688 wrote to memory of 1688 2688 msedge.exe 84 PID 2688 wrote to memory of 1688 2688 msedge.exe 84 PID 2688 wrote to memory of 1688 2688 msedge.exe 84 PID 2688 wrote to memory of 1688 2688 msedge.exe 84 PID 2688 wrote to memory of 1688 2688 msedge.exe 84 PID 2688 wrote to memory of 1688 2688 msedge.exe 84 PID 2688 wrote to memory of 1688 2688 msedge.exe 84 PID 2688 wrote to memory of 1688 2688 msedge.exe 84 PID 2688 wrote to memory of 1688 2688 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a406093f5fffd299d30a43fb734e754a_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe401546f8,0x7ffe40154708,0x7ffe401547182⤵PID:4884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,13032441253527374362,17190364877535954059,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:3776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,13032441253527374362,17190364877535954059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,13032441253527374362,17190364877535954059,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:82⤵PID:1688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13032441253527374362,17190364877535954059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13032441253527374362,17190364877535954059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:2920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,13032441253527374362,17190364877535954059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:82⤵PID:4572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,13032441253527374362,17190364877535954059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13032441253527374362,17190364877535954059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:12⤵PID:3332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13032441253527374362,17190364877535954059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:12⤵PID:380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13032441253527374362,17190364877535954059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4416 /prefetch:12⤵PID:1356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,13032441253527374362,17190364877535954059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4496 /prefetch:12⤵PID:4428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,13032441253527374362,17190364877535954059,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1600
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:620
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4428
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
5KB
MD5dc456096c931f616a7c01954296248be
SHA14e657049e40ac730d66790f4d21669124c233121
SHA256f1bd3b1e76845b00252936841468fa2ba0d836275be2fcc68fe13b1fdf9a8be3
SHA512279c5d21817b6a5a224d8ea291a22425afd81c28a955c0349fbb63b63ad21c4e4b8c08290540bda79a551867dc774dab9c9848d635c967b1b43cfae94ab8eb7e
-
Filesize
5KB
MD5d41c451f2c05e304bc5cc3fa09e402b9
SHA122bc4a5d1012abffcb0c988c1836422c1acd79c0
SHA2563e3daa3a2d3760c463191595dd0cd978459871c6981edfa167d7188ed339af19
SHA5124503c4af5f43145bf8b66bd7053757b293ed6868d0432bd7009a3ab8c5daa2938507c2797a8e320b4a8d51044fffdfb3fe174680fa984391c5f7693aacbba314
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD506108750da6878c7f447cc58afdcb28f
SHA14cc992aef46cbb65604f12fc00ce1ad8f7082870
SHA25645e5a684e9f44b635bf4c1149b889a5e7c042eb48ee329576ba8cac908d054df
SHA512bbde032b02dff96dc642030a2d96d3801c268145833cc1c77a742996cc3c940d53b08a6bb3c47845ab6b80b25d44871e67ef5e4e2a1da4d41e45e7ce26b050f0