Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 01:05
Static task
static1
Behavioral task
behavioral1
Sample
18395c2fb43d50de4d76dc7f12a2bf05_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
18395c2fb43d50de4d76dc7f12a2bf05_JaffaCakes118.html
Resource
win10v2004-20240611-en
General
-
Target
18395c2fb43d50de4d76dc7f12a2bf05_JaffaCakes118.html
-
Size
6KB
-
MD5
18395c2fb43d50de4d76dc7f12a2bf05
-
SHA1
29ccb85e862cd8c2e11e4e44643b23a06d449080
-
SHA256
c320ab92fbebd362efda89e1fb73042689cc7e0a2e398f8ac682f3a5c2fb187b
-
SHA512
1a0a57a2629e3010b6f8f02811c3e50aa5f21841bea5cfa7004b4675930e1de1b81d82820e8b67cc84651c4d375289ef097a5c3605e2c7dfeb53dd72ec6d3932
-
SSDEEP
96:uzVs+ux7RWLLY1k9o84d12ef7CSTUBZcEZ7ru7f:csz7RWAYS/Qb76f
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1448 msedge.exe 1448 msedge.exe 2228 msedge.exe 2228 msedge.exe 2384 identity_helper.exe 2384 identity_helper.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe 2228 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2228 wrote to memory of 3632 2228 msedge.exe 83 PID 2228 wrote to memory of 3632 2228 msedge.exe 83 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 4888 2228 msedge.exe 84 PID 2228 wrote to memory of 1448 2228 msedge.exe 85 PID 2228 wrote to memory of 1448 2228 msedge.exe 85 PID 2228 wrote to memory of 1840 2228 msedge.exe 86 PID 2228 wrote to memory of 1840 2228 msedge.exe 86 PID 2228 wrote to memory of 1840 2228 msedge.exe 86 PID 2228 wrote to memory of 1840 2228 msedge.exe 86 PID 2228 wrote to memory of 1840 2228 msedge.exe 86 PID 2228 wrote to memory of 1840 2228 msedge.exe 86 PID 2228 wrote to memory of 1840 2228 msedge.exe 86 PID 2228 wrote to memory of 1840 2228 msedge.exe 86 PID 2228 wrote to memory of 1840 2228 msedge.exe 86 PID 2228 wrote to memory of 1840 2228 msedge.exe 86 PID 2228 wrote to memory of 1840 2228 msedge.exe 86 PID 2228 wrote to memory of 1840 2228 msedge.exe 86 PID 2228 wrote to memory of 1840 2228 msedge.exe 86 PID 2228 wrote to memory of 1840 2228 msedge.exe 86 PID 2228 wrote to memory of 1840 2228 msedge.exe 86 PID 2228 wrote to memory of 1840 2228 msedge.exe 86 PID 2228 wrote to memory of 1840 2228 msedge.exe 86 PID 2228 wrote to memory of 1840 2228 msedge.exe 86 PID 2228 wrote to memory of 1840 2228 msedge.exe 86 PID 2228 wrote to memory of 1840 2228 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\18395c2fb43d50de4d76dc7f12a2bf05_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f1c146f8,0x7ff9f1c14708,0x7ff9f1c147182⤵PID:3632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10741979456902873533,11350678236638050832,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:4888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,10741979456902873533,11350678236638050832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,10741979456902873533,11350678236638050832,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:82⤵PID:1840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10741979456902873533,11350678236638050832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:1516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10741979456902873533,11350678236638050832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:3508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,10741979456902873533,11350678236638050832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 /prefetch:82⤵PID:4428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,10741979456902873533,11350678236638050832,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10741979456902873533,11350678236638050832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:12⤵PID:2068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10741979456902873533,11350678236638050832,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:12⤵PID:4840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10741979456902873533,11350678236638050832,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:4388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10741979456902873533,11350678236638050832,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:12⤵PID:2676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10741979456902873533,11350678236638050832,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1260 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3768
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1508
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dabfafd78687947a9de64dd5b776d25f
SHA116084c74980dbad713f9d332091985808b436dea
SHA256c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
SHA512dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
-
Filesize
152B
MD5c39b3aa574c0c938c80eb263bb450311
SHA1f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA25666f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
SHA512eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
-
Filesize
5KB
MD5891df0894ff249ba83e72705ba993035
SHA1ec1a41131a100b31fa57d3b5efff15dcda7ff5ec
SHA256490ce2c644cce745f91dd968936082940ca75a30e45f43a7925273aef65f7aff
SHA512c4b47cd5a2cadd8565b7a7ea3f9523d6fa01574828dc7050303c82db299bae4b50aa883cf1e7d1c1e990d9b20e3db4b72593ab06cda6f866a3ca4ed93e31c43e
-
Filesize
6KB
MD5540b3a9d70a168ee3f8b57ad4e44701b
SHA1568c50ba6885821dc254ed80d3170775cf0f0525
SHA256110627ab83926ab8c8ebf553e16a11c5b1cace24283abb302517920c0a82afcd
SHA51223025dd9dc6101848b7374d6feabe570a50a634be1c55576a1c2a148e4872a85ff54f5ab58cee3bba421ef895d0252db3c2c07f99c5432f23ef6f39fa1873a1d
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD574a74b9a8feef7ec509bb5a73d0f1052
SHA13ae89e8946041882a9cc97d996f4ddeecb9e5e1d
SHA256674e3f504fde86cfc489a44034585d8792a76d970f37e1d69348bce669342b41
SHA512e9ac4e1a6c026afaa29a333b65fad0539ad93d5973faf9fc5566942e2f9d61cf074678a0977441218cb4150fd9a5583c9f386c90bbe89e316c9d321631e0d419