Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/06/2024, 08:42
Static task
static1
Behavioral task
behavioral1
Sample
ad96b22d2f4025fc259eb4926c55e41f_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ad96b22d2f4025fc259eb4926c55e41f_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
ad96b22d2f4025fc259eb4926c55e41f_JaffaCakes118.html
-
Size
85KB
-
MD5
ad96b22d2f4025fc259eb4926c55e41f
-
SHA1
ba73efc5d9ed5ba9f5c302674e3c9d4386876ccc
-
SHA256
8ca7d2c44acf8be3089125e767eef733376ac7f968d04d6df045de060a53ce84
-
SHA512
bd142dd7a2e93763a4921071b188113a0b0d29b45b1a196071633e18a4e05f0587ced0d1670dd712b756400a94dba229cc58e28ad8e8dff81ab0b84f3bd00384
-
SSDEEP
1536:MxCeF3eR3h0SHvLylv6tRfhKEf14O2Xx6nGDm3Up7W11QnFeMPctQtW2z8J2m0Af:MxCeF3eRRpHv2lv6tRfhKC14O2Xx6nG2
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2744 msedge.exe 2744 msedge.exe 1488 msedge.exe 1488 msedge.exe 3616 identity_helper.exe 3616 identity_helper.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe 4952 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe 1488 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1488 wrote to memory of 4496 1488 msedge.exe 81 PID 1488 wrote to memory of 4496 1488 msedge.exe 81 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2340 1488 msedge.exe 82 PID 1488 wrote to memory of 2744 1488 msedge.exe 83 PID 1488 wrote to memory of 2744 1488 msedge.exe 83 PID 1488 wrote to memory of 4656 1488 msedge.exe 84 PID 1488 wrote to memory of 4656 1488 msedge.exe 84 PID 1488 wrote to memory of 4656 1488 msedge.exe 84 PID 1488 wrote to memory of 4656 1488 msedge.exe 84 PID 1488 wrote to memory of 4656 1488 msedge.exe 84 PID 1488 wrote to memory of 4656 1488 msedge.exe 84 PID 1488 wrote to memory of 4656 1488 msedge.exe 84 PID 1488 wrote to memory of 4656 1488 msedge.exe 84 PID 1488 wrote to memory of 4656 1488 msedge.exe 84 PID 1488 wrote to memory of 4656 1488 msedge.exe 84 PID 1488 wrote to memory of 4656 1488 msedge.exe 84 PID 1488 wrote to memory of 4656 1488 msedge.exe 84 PID 1488 wrote to memory of 4656 1488 msedge.exe 84 PID 1488 wrote to memory of 4656 1488 msedge.exe 84 PID 1488 wrote to memory of 4656 1488 msedge.exe 84 PID 1488 wrote to memory of 4656 1488 msedge.exe 84 PID 1488 wrote to memory of 4656 1488 msedge.exe 84 PID 1488 wrote to memory of 4656 1488 msedge.exe 84 PID 1488 wrote to memory of 4656 1488 msedge.exe 84 PID 1488 wrote to memory of 4656 1488 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ad96b22d2f4025fc259eb4926c55e41f_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd711f46f8,0x7ffd711f4708,0x7ffd711f47182⤵PID:4496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,195771075353752961,4619425125949223626,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:2340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,195771075353752961,4619425125949223626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,195771075353752961,4619425125949223626,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:82⤵PID:4656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,195771075353752961,4619425125949223626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:5084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,195771075353752961,4619425125949223626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:1204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,195771075353752961,4619425125949223626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4300 /prefetch:82⤵PID:1432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,195771075353752961,4619425125949223626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4300 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,195771075353752961,4619425125949223626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4292 /prefetch:12⤵PID:3876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,195771075353752961,4619425125949223626,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:12⤵PID:4716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,195771075353752961,4619425125949223626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:12⤵PID:4556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,195771075353752961,4619425125949223626,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:12⤵PID:3776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,195771075353752961,4619425125949223626,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4952
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:976
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1148
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
Filesize
6KB
MD5ba834dc94fca27d22697894a6c291b93
SHA13885d568608ad1a37c1ec93a9130a1c4e0739137
SHA256dea21e2c9b8a29b225946e63e2d7fdf5ed80b22512f5a75e59e83e76b50d07c0
SHA5127d265f91cfb46cec130d44954ea2e01a7ec71bf150c5e9eaea5a3f50504553bfeb81876fe03dfff611b8e20420e404dfb1d3c5106a9af13a0b43b24c69629cd4
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fa9c07d5-37e4-4f69-bac8-084c4bc0b29e.tmp
Filesize5KB
MD5daf474290b0befe4e0f1595a589d51f5
SHA19d90a0262a6d5af46eca25dafbc50d5f02efa7e9
SHA2565e3e7ec7ce5a370cc0a6525b32e824fe41799fedda90bcddd765bccacc67dbce
SHA51210f1a926e9b1e6181bb87a8ba5780982ee378e4d0cf06653aaac45c432d7aee4c27dd4e58b2cdb5463f0769c839b54476d283c4dc0ac894135274bc56b61c9f3
-
Filesize
8KB
MD578b07910169d6d76de4d86a896ec7a5b
SHA13897127388ff869eb0ef057821056940108e70d7
SHA256d1a1f907f6e9019df12694303127912b1b55c2f1cee58f60e6db6de8b2c7e5ae
SHA512345864413bd4f7d3be3b38da377aabfd8aaa364586bca3bdafbdb65c7588fa1e8b29706aff0d977977bb2868b230a58fc9890e8cae0ec0186670860b754aba99