Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2024, 07:06
Static task
static1
Behavioral task
behavioral1
Sample
a873d6d779c7d797c092d47ca2fea3ca_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
a873d6d779c7d797c092d47ca2fea3ca_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a873d6d779c7d797c092d47ca2fea3ca_JaffaCakes118.html
-
Size
36KB
-
MD5
a873d6d779c7d797c092d47ca2fea3ca
-
SHA1
f277488642c0cfdee07c7dd51d26bdd4595e7ee8
-
SHA256
4a62d8dae820747008f44b251be2bf5b1de84e98b93ae88e54ebd0ac12f552f7
-
SHA512
e25cf1214305272150ed8350d3120d6f861fe28822a3e180cd6cb7f3198d883f7d1d1c06108b9831a388b7b4c67bcf24c840e3a3f99bab79049335681d18dacc
-
SSDEEP
768:zwx/MDTHOQ88hARvZPXeE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6T9ZOZ6DJtxo6qLT:Q/vbJxNVzuxSs/U81K
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 5104 msedge.exe 5104 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 2484 identity_helper.exe 2484 identity_helper.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe 3572 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3984 wrote to memory of 2052 3984 msedge.exe 81 PID 3984 wrote to memory of 2052 3984 msedge.exe 81 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 3716 3984 msedge.exe 83 PID 3984 wrote to memory of 5104 3984 msedge.exe 84 PID 3984 wrote to memory of 5104 3984 msedge.exe 84 PID 3984 wrote to memory of 2492 3984 msedge.exe 85 PID 3984 wrote to memory of 2492 3984 msedge.exe 85 PID 3984 wrote to memory of 2492 3984 msedge.exe 85 PID 3984 wrote to memory of 2492 3984 msedge.exe 85 PID 3984 wrote to memory of 2492 3984 msedge.exe 85 PID 3984 wrote to memory of 2492 3984 msedge.exe 85 PID 3984 wrote to memory of 2492 3984 msedge.exe 85 PID 3984 wrote to memory of 2492 3984 msedge.exe 85 PID 3984 wrote to memory of 2492 3984 msedge.exe 85 PID 3984 wrote to memory of 2492 3984 msedge.exe 85 PID 3984 wrote to memory of 2492 3984 msedge.exe 85 PID 3984 wrote to memory of 2492 3984 msedge.exe 85 PID 3984 wrote to memory of 2492 3984 msedge.exe 85 PID 3984 wrote to memory of 2492 3984 msedge.exe 85 PID 3984 wrote to memory of 2492 3984 msedge.exe 85 PID 3984 wrote to memory of 2492 3984 msedge.exe 85 PID 3984 wrote to memory of 2492 3984 msedge.exe 85 PID 3984 wrote to memory of 2492 3984 msedge.exe 85 PID 3984 wrote to memory of 2492 3984 msedge.exe 85 PID 3984 wrote to memory of 2492 3984 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a873d6d779c7d797c092d47ca2fea3ca_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa993e46f8,0x7ffa993e4708,0x7ffa993e47182⤵PID:2052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,3817490068506085350,11094424153159560686,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:22⤵PID:3716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,3817490068506085350,11094424153159560686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,3817490068506085350,11094424153159560686,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:82⤵PID:2492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3817490068506085350,11094424153159560686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:4012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3817490068506085350,11094424153159560686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:12⤵PID:2056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,3817490068506085350,11094424153159560686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:82⤵PID:3596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,3817490068506085350,11094424153159560686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3817490068506085350,11094424153159560686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:12⤵PID:4944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3817490068506085350,11094424153159560686,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:12⤵PID:4540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3817490068506085350,11094424153159560686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:12⤵PID:4068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,3817490068506085350,11094424153159560686,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵PID:4112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,3817490068506085350,11094424153159560686,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3572
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4480
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD581e892ca5c5683efdf9135fe0f2adb15
SHA139159b30226d98a465ece1da28dc87088b20ecad
SHA256830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17
SHA512c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0
-
Filesize
152B
MD556067634f68231081c4bd5bdbfcc202f
SHA15582776da6ffc75bb0973840fc3d15598bc09eb1
SHA2568c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4
SHA512c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
614B
MD53a806e4582a476bfabad58293999375d
SHA13676a8d89702c67f08a80d1dcefd8c20506c1cad
SHA256a7103709035b109e1529f8b926d5e8789c005bbd194b7aa365b676614133beaa
SHA512c621629458d95efe44a821baa211954617320ad3ece6d49a0e074145c55c2ca57aea35fd3c6fe86437ed32e63fdcfd9052742ff60a27c0036a8606d2742e2e7b
-
Filesize
6KB
MD551b94c084b98fdce621ea95fc7638099
SHA192cedc219a9358ddccec14bd3dd4c9664be1668f
SHA2565bbad54ac59d71245ef42a7cfe1d895b918beda90ddc5e6b3a1a41cc910ea5e9
SHA512f65fa8a773f050a7ef904cd3a992394bf8b49660ee87ba91de33a9a1e0cacab0f83d1a22555b5ccb33bcf662a72905b1c500915524706181f9db40be275a0776
-
Filesize
6KB
MD546b671d8c69a94fd6479d104e3094435
SHA12564679fba23693c839eb0395bfd0593b012d2f5
SHA256cebd06d2cfb1c49694826f7a7fb541fcf8f8bcb5b8bd9906790b721f8d4a05c2
SHA512a043cf03db65e71b88f1d0550d0e274d2f7ec31c139fdac10b1916823abb9dbe6b535b51da2025247eedbc7522e7af4fc5ada429c15400f0e97362ec7104af79
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD525a600990c79fefd5581a8f443b78d12
SHA1235a4178bf632be8fdaa1fb2be639c2fbb0ed686
SHA2566bffb7d0e54844c6056b168241b6f319482e1bde8f9706efeb36e3c5f7f05cbb
SHA5126178eb3810f6ebd1d0012190587b383d813d4332b1baf47bb84f1d6ee7420e6099d396a56bc60c1c89f5f874c557136124fd1f98e17cdeb021a0874a2cc90429