Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2024, 08:36
Static task
static1
Behavioral task
behavioral1
Sample
a8c35c32b7293b32d9a0c89a632c5930_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
a8c35c32b7293b32d9a0c89a632c5930_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
a8c35c32b7293b32d9a0c89a632c5930_JaffaCakes118.html
-
Size
71KB
-
MD5
a8c35c32b7293b32d9a0c89a632c5930
-
SHA1
d4ff02cacaceeb80927a200f70d1cf0d0d6411d7
-
SHA256
f7642410247769e16eeb929ac10972c0f856e2c2620d06262417e6c4a17f824c
-
SHA512
12ae43cd450038b4da1b1b37127b83c4f1255901676c9368e25045c12efc2c9b6d77be29ea91f6ae765ae4c8e2c148d555a3b078ecc3b64670651cdeeffc056f
-
SSDEEP
1536:5wcwfR4/ZKWSojIUwcw9O98jOdtuNNz2U31YEykk2R7sCXGmkqvi6p9z8MMDfpF3:9/ZKWSotdtuNNr31Dyk3oCXvPvivfpF3
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3928 msedge.exe 3928 msedge.exe 2008 msedge.exe 2008 msedge.exe 3048 identity_helper.exe 3048 identity_helper.exe 2096 msedge.exe 2096 msedge.exe 2096 msedge.exe 2096 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe 2008 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2008 wrote to memory of 4392 2008 msedge.exe 81 PID 2008 wrote to memory of 4392 2008 msedge.exe 81 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3704 2008 msedge.exe 82 PID 2008 wrote to memory of 3928 2008 msedge.exe 83 PID 2008 wrote to memory of 3928 2008 msedge.exe 83 PID 2008 wrote to memory of 3588 2008 msedge.exe 84 PID 2008 wrote to memory of 3588 2008 msedge.exe 84 PID 2008 wrote to memory of 3588 2008 msedge.exe 84 PID 2008 wrote to memory of 3588 2008 msedge.exe 84 PID 2008 wrote to memory of 3588 2008 msedge.exe 84 PID 2008 wrote to memory of 3588 2008 msedge.exe 84 PID 2008 wrote to memory of 3588 2008 msedge.exe 84 PID 2008 wrote to memory of 3588 2008 msedge.exe 84 PID 2008 wrote to memory of 3588 2008 msedge.exe 84 PID 2008 wrote to memory of 3588 2008 msedge.exe 84 PID 2008 wrote to memory of 3588 2008 msedge.exe 84 PID 2008 wrote to memory of 3588 2008 msedge.exe 84 PID 2008 wrote to memory of 3588 2008 msedge.exe 84 PID 2008 wrote to memory of 3588 2008 msedge.exe 84 PID 2008 wrote to memory of 3588 2008 msedge.exe 84 PID 2008 wrote to memory of 3588 2008 msedge.exe 84 PID 2008 wrote to memory of 3588 2008 msedge.exe 84 PID 2008 wrote to memory of 3588 2008 msedge.exe 84 PID 2008 wrote to memory of 3588 2008 msedge.exe 84 PID 2008 wrote to memory of 3588 2008 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a8c35c32b7293b32d9a0c89a632c5930_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fd0746f8,0x7ff8fd074708,0x7ff8fd0747182⤵PID:4392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5351294524882599131,10677692992596833831,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:3704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,5351294524882599131,10677692992596833831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,5351294524882599131,10677692992596833831,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:82⤵PID:3588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5351294524882599131,10677692992596833831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:3972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5351294524882599131,10677692992596833831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:4244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5351294524882599131,10677692992596833831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 /prefetch:82⤵PID:4884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,5351294524882599131,10677692992596833831,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5351294524882599131,10677692992596833831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4440 /prefetch:12⤵PID:2796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5351294524882599131,10677692992596833831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4420 /prefetch:12⤵PID:1744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5351294524882599131,10677692992596833831,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:12⤵PID:4312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,5351294524882599131,10677692992596833831,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:12⤵PID:1032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,5351294524882599131,10677692992596833831,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4684 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2096
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2000
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2808
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
5KB
MD5ee1b69a963feabbc94d7331cb8cee2fb
SHA1513c4098b5094a89334aba4e4ef4b949f99ff35f
SHA256bde3a3b7e3f792fcff174b21c69ae58000e886d7e5b0cb9ca7eda7aa4e27cb2a
SHA512fb502f579d8ed24f02f6187805e8ad3122925790f90c13c9d59734081f75b84695113c9f7ef97a32d56a6584f8e7f6a2f89cebd9f779cea42d66a976775085fd
-
Filesize
6KB
MD527ddc15ad937c703316234f0357c58d2
SHA1c1d1ce097f9b55509ff7ecd2b7a2555b77447662
SHA256164627dff65cc8630d0e028842038e9c37ab26e3e2c8cff9ab6d835ab2e289fe
SHA51216c9aaf94b945e4eb7101a23ba1b9a12f225f0091b8d284c7632604c579619b9d5382bc247384e74dc04cdbd034135722de61f6503a42eca97ccae33cc308aaa
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
8KB
MD5a2e52c7a2baa808226f642852e6e1c02
SHA1d51a8dc526074baade71a55e382af48dc39f12f8
SHA256f95d5dec182d29836c95805f2e94367aac1dc9f419d928b62349f0dcc0089d99
SHA512fdb4dca5bafb451f4fa8fbe1477b47f41a32d27594423010ab36319003a98ffb3034c0a451a510d2d1e521f605339f4d62fb43b6cc0ccecdd74749afb6b44f7c