Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
16/06/2024, 12:33
Static task
static1
Behavioral task
behavioral1
Sample
b386d418f1482168546300ebffec2dff_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
b386d418f1482168546300ebffec2dff_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
b386d418f1482168546300ebffec2dff_JaffaCakes118.html
-
Size
96KB
-
MD5
b386d418f1482168546300ebffec2dff
-
SHA1
28d6b16260a208987654ad2524a5d03a56a7a95b
-
SHA256
09cbf262fbb9e606cf077ae8872dc3a5723e373865408f7d3987fc252d418b4d
-
SHA512
69acf244992bf2d0e6392634275cad21875daa8ec85ade29d998450b5070891ed841141ddda14c3b95cef1cddc2ed7a1fe9c1029efba3fd58bc2e0e8d85b73e9
-
SSDEEP
3072:ICsztlyj72ouGvvjP/yZ9WGZrdPFP+Qgmt1ZqkhCfDKCIVW7uK1V:D2ougvDyZ/tx5+QgsxCfDK8X
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4116 msedge.exe 4116 msedge.exe 4940 msedge.exe 4940 msedge.exe 3952 identity_helper.exe 3952 identity_helper.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe 3152 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4940 wrote to memory of 4868 4940 msedge.exe 81 PID 4940 wrote to memory of 4868 4940 msedge.exe 81 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4488 4940 msedge.exe 82 PID 4940 wrote to memory of 4116 4940 msedge.exe 83 PID 4940 wrote to memory of 4116 4940 msedge.exe 83 PID 4940 wrote to memory of 1584 4940 msedge.exe 84 PID 4940 wrote to memory of 1584 4940 msedge.exe 84 PID 4940 wrote to memory of 1584 4940 msedge.exe 84 PID 4940 wrote to memory of 1584 4940 msedge.exe 84 PID 4940 wrote to memory of 1584 4940 msedge.exe 84 PID 4940 wrote to memory of 1584 4940 msedge.exe 84 PID 4940 wrote to memory of 1584 4940 msedge.exe 84 PID 4940 wrote to memory of 1584 4940 msedge.exe 84 PID 4940 wrote to memory of 1584 4940 msedge.exe 84 PID 4940 wrote to memory of 1584 4940 msedge.exe 84 PID 4940 wrote to memory of 1584 4940 msedge.exe 84 PID 4940 wrote to memory of 1584 4940 msedge.exe 84 PID 4940 wrote to memory of 1584 4940 msedge.exe 84 PID 4940 wrote to memory of 1584 4940 msedge.exe 84 PID 4940 wrote to memory of 1584 4940 msedge.exe 84 PID 4940 wrote to memory of 1584 4940 msedge.exe 84 PID 4940 wrote to memory of 1584 4940 msedge.exe 84 PID 4940 wrote to memory of 1584 4940 msedge.exe 84 PID 4940 wrote to memory of 1584 4940 msedge.exe 84 PID 4940 wrote to memory of 1584 4940 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b386d418f1482168546300ebffec2dff_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff928b546f8,0x7ff928b54708,0x7ff928b547182⤵PID:4868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,420488521091048702,4224695810905077848,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:22⤵PID:4488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,420488521091048702,4224695810905077848,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,420488521091048702,4224695810905077848,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:82⤵PID:1584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,420488521091048702,4224695810905077848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:12⤵PID:2436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,420488521091048702,4224695810905077848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,420488521091048702,4224695810905077848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:12⤵PID:436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,420488521091048702,4224695810905077848,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:82⤵PID:4804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,420488521091048702,4224695810905077848,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,420488521091048702,4224695810905077848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:12⤵PID:856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,420488521091048702,4224695810905077848,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:12⤵PID:2920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,420488521091048702,4224695810905077848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:12⤵PID:4848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,420488521091048702,4224695810905077848,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:12⤵PID:724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,420488521091048702,4224695810905077848,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3040 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3152
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:400
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4188
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dabfafd78687947a9de64dd5b776d25f
SHA116084c74980dbad713f9d332091985808b436dea
SHA256c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
SHA512dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
-
Filesize
152B
MD5c39b3aa574c0c938c80eb263bb450311
SHA1f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA25666f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
SHA512eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
-
Filesize
668B
MD55aeaf5e7fe2b67e4def656dd16aec8f9
SHA185cc677e5d647cd109761f9b4284f97f260d1ee1
SHA25654f409f10dbbae0835590e8c84e4949ee423b83b018119d065ffe3c1415c0201
SHA512f01996bc6a9db80ae8079e9ab83648063cb66ffab01d65f41a449e755df295da9ad72e15e8dbdd8c62e032e61cce84148ece149727b29acb0123c7af572fa679
-
Filesize
6KB
MD5fbb7a381dabff39861367e268002cd64
SHA17e3a1f38de386a1deba8751fd61ad625858fcde0
SHA2568866fb20997497816b40ee35fd98f2dc3566d5a671fe064e3a140ad165bfd83e
SHA5129d81ef466c47ace8b3041ccbd273fcbe74fdd2d750cf2f8db4022b9e274a123dda2b60a5ba25983f27089fba1feb2d6e050fc72d30541656db9506e3e8d77879
-
Filesize
6KB
MD5713c2e59eed2095ed28636774e02cd63
SHA1619c9a8d789fb3c1475324113b7df54e37b2d96d
SHA256ce0c0a344b3e65b1174657c2d709e8f0d450c6b9e34a5db8a4c5bb07d58a5303
SHA512de9a7eeeb62a5546ca3433b9752fa2ab3be5067ec620607e3d040755229998056ecfee3d5e16221718d17faea2faa0bfd33dbed975036bfb3858ff70a6086a65
-
Filesize
6KB
MD5614d541ae4a58e1df673a5f42b77c3ca
SHA146e40f6c5b2808c5f67fc6ee9e0fc31734b2d4ed
SHA256867a497ae620f1e39f508562e2a78589d5ad2ae38334011120f277f859b1963d
SHA5127e16c45f393b1a49611a0eab68b2639de8f0113cc2655332fce90bde57799e53abe0fd4c3f65a8eebb0d63bd631674e4c8e6033f5adbed3adebc0ec12c069c2d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5448f0ee97a259b2e904ed80ed244a334
SHA1e9896240bf1e0780a099c63640149c413a332077
SHA256597a217da8384d510cb76c4c999dbf2237e9850dd7f6b78a54c0357cb2a68b9d
SHA5122683c0f2e8471208c52d32d833361972e075306c90df58f618400a62d365817824728536b9eb367d3c6048a9576b0bfe452ddf25545f39e1989cf2df0e9452e7