Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2024, 08:34
Static task
static1
Behavioral task
behavioral1
Sample
a8c1a73e2e9b61bdf1032d77731bc458_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a8c1a73e2e9b61bdf1032d77731bc458_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
a8c1a73e2e9b61bdf1032d77731bc458_JaffaCakes118.html
-
Size
22KB
-
MD5
a8c1a73e2e9b61bdf1032d77731bc458
-
SHA1
8cfcb5dea2891dd9dca430bb005b8ce5d950c549
-
SHA256
4bb4815d850c5bac33a58054ca3ee13ad6299c775a39af7a168d426975874c57
-
SHA512
2a97fa2fd1b1ac7f4e72c2e8002228c6b497d9e084dd3d2176d3047da8f71898dd6acc0f92265652e30eb6bf5401c26ec2d9d8c196030f54a66371ddd91a557f
-
SSDEEP
192:R9Nm6HoXQg7qFlKgb5nC/e/N/6s/J/2/t/m/V/a/R/p/LnQjLntQ/isnQieVvnL3:MYo6RQ/WXj
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2596 msedge.exe 2596 msedge.exe 2936 msedge.exe 2936 msedge.exe 2256 identity_helper.exe 2256 identity_helper.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe 3104 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe 2936 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2936 wrote to memory of 3984 2936 msedge.exe 82 PID 2936 wrote to memory of 3984 2936 msedge.exe 82 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2688 2936 msedge.exe 83 PID 2936 wrote to memory of 2596 2936 msedge.exe 84 PID 2936 wrote to memory of 2596 2936 msedge.exe 84 PID 2936 wrote to memory of 4540 2936 msedge.exe 85 PID 2936 wrote to memory of 4540 2936 msedge.exe 85 PID 2936 wrote to memory of 4540 2936 msedge.exe 85 PID 2936 wrote to memory of 4540 2936 msedge.exe 85 PID 2936 wrote to memory of 4540 2936 msedge.exe 85 PID 2936 wrote to memory of 4540 2936 msedge.exe 85 PID 2936 wrote to memory of 4540 2936 msedge.exe 85 PID 2936 wrote to memory of 4540 2936 msedge.exe 85 PID 2936 wrote to memory of 4540 2936 msedge.exe 85 PID 2936 wrote to memory of 4540 2936 msedge.exe 85 PID 2936 wrote to memory of 4540 2936 msedge.exe 85 PID 2936 wrote to memory of 4540 2936 msedge.exe 85 PID 2936 wrote to memory of 4540 2936 msedge.exe 85 PID 2936 wrote to memory of 4540 2936 msedge.exe 85 PID 2936 wrote to memory of 4540 2936 msedge.exe 85 PID 2936 wrote to memory of 4540 2936 msedge.exe 85 PID 2936 wrote to memory of 4540 2936 msedge.exe 85 PID 2936 wrote to memory of 4540 2936 msedge.exe 85 PID 2936 wrote to memory of 4540 2936 msedge.exe 85 PID 2936 wrote to memory of 4540 2936 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a8c1a73e2e9b61bdf1032d77731bc458_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeedaa46f8,0x7ffeedaa4708,0x7ffeedaa47182⤵PID:3984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,17506972395981867663,12166952725803614511,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:2688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,17506972395981867663,12166952725803614511,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,17506972395981867663,12166952725803614511,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:82⤵PID:4540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17506972395981867663,12166952725803614511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:2196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17506972395981867663,12166952725803614511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:1848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,17506972395981867663,12166952725803614511,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4648 /prefetch:82⤵PID:1920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,17506972395981867663,12166952725803614511,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4648 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17506972395981867663,12166952725803614511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2340 /prefetch:12⤵PID:1696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17506972395981867663,12166952725803614511,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:12⤵PID:3360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17506972395981867663,12166952725803614511,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:12⤵PID:1976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,17506972395981867663,12166952725803614511,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:12⤵PID:784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,17506972395981867663,12166952725803614511,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3104
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1808
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1816
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5477462b6ad8eaaf8d38f5e3a4daf17b0
SHA186174e670c44767c08a39cc2a53c09c318326201
SHA256e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
SHA512a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
-
Filesize
152B
MD5b704c9ca0493bd4548ac9c69dc4a4f27
SHA1a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA2562ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
SHA51269c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
-
Filesize
6KB
MD5d4f2e63c362100f65a899244381c2ffd
SHA187eacf6e3034891bb25197c6481e147bf6807643
SHA256fd269d71686655085311aff85bf8671c2496bfb39d5f07182106ee3408febe1c
SHA5127156f4e92491e06adc8def2395f468825835e764228c5fa605cccfb925a537534e2219643e523b8041d4416704e4043a93f8ebc2ee03a71e9eb87b88474d6637
-
Filesize
6KB
MD5c827c9da41112200e78b9ee2c95c41ee
SHA17669e5c3f7ad516d9a624f6cc0c7f2f15a33fd88
SHA256781ddc8d22ccec79bcc6b77694f4e9dddfb5c26cafb82796027ba4f67c712e0d
SHA512c7771765e929dca73436673b650fea57c03ee953e04d7d204cb18e7f2706cd8a24f9877001f11fc62a19f5333c5e9e252104a2e4d9a2b9e305a51235ca040cfe
-
Filesize
6KB
MD50151168acbc0d9b770e0eca80e5f3a37
SHA1c6790a69a2aa274c2be19d22512987c0ebb97e1d
SHA256a6fdea3b3b8e8bd1c13f27097edbbc5d1b48a7dac6d37e2973b5f223119c6991
SHA51286d4edb7061398c99a15a52bb5d48adba3554c37e0b8bb13dde36aed3340ef50311d2c48747e8ec7da37990f16f308a2a81d05eb2c5527009ea1e116569c51a8
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD53b5a2b28a543153bbd01130a832b982d
SHA1c8a4be31edc81fa35e97dcb5ca4bde5db06696bd
SHA2569d57eb29b92ac3785391095d7362f7f47b16af4bcda2f3239efd071820b750bc
SHA512f47401d3f7a60e4e2f1619b062ef4153300ab41e0d4449ee31a5659de2e69b61f9ed8a5e1583b10b270297ed17b7a1fcce2ed2c328c90d4ab6e3f31a6db79dfb