Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 11:19
Static task
static1
Behavioral task
behavioral1
Sample
19ecddaf7d3e5fdee8309b8dc2477800_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
19ecddaf7d3e5fdee8309b8dc2477800_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
19ecddaf7d3e5fdee8309b8dc2477800_JaffaCakes118.html
-
Size
53KB
-
MD5
19ecddaf7d3e5fdee8309b8dc2477800
-
SHA1
b7abafc1fdc949ba0a927259b8542d2f157a9882
-
SHA256
9a45ca0eaf841d99a698099c72e84c0a98aade4d9e3b106dd6012098f8046e22
-
SHA512
8817c0e4b33e815a9183ea166c147dae0095d8e8428ae3e4aaa676314e4cb82065bf1025f4220c11b43c5c371f7c1b07a1cfb484ad1a9fd4b3c88572030f4967
-
SSDEEP
1536:CkgUiIakTqGivi+PyUcrunlYq63Nj+q5Vy0R0w2AzTICbbroX/t9M/dNwIUTDmD1:CkgUiIakTqGivi+PyUcrunlYq63Nj+q/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1752 msedge.exe 1752 msedge.exe 1408 msedge.exe 1408 msedge.exe 3588 identity_helper.exe 3588 identity_helper.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe 4296 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe 1408 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1408 wrote to memory of 2196 1408 msedge.exe 80 PID 1408 wrote to memory of 2196 1408 msedge.exe 80 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 3028 1408 msedge.exe 81 PID 1408 wrote to memory of 1752 1408 msedge.exe 82 PID 1408 wrote to memory of 1752 1408 msedge.exe 82 PID 1408 wrote to memory of 4240 1408 msedge.exe 83 PID 1408 wrote to memory of 4240 1408 msedge.exe 83 PID 1408 wrote to memory of 4240 1408 msedge.exe 83 PID 1408 wrote to memory of 4240 1408 msedge.exe 83 PID 1408 wrote to memory of 4240 1408 msedge.exe 83 PID 1408 wrote to memory of 4240 1408 msedge.exe 83 PID 1408 wrote to memory of 4240 1408 msedge.exe 83 PID 1408 wrote to memory of 4240 1408 msedge.exe 83 PID 1408 wrote to memory of 4240 1408 msedge.exe 83 PID 1408 wrote to memory of 4240 1408 msedge.exe 83 PID 1408 wrote to memory of 4240 1408 msedge.exe 83 PID 1408 wrote to memory of 4240 1408 msedge.exe 83 PID 1408 wrote to memory of 4240 1408 msedge.exe 83 PID 1408 wrote to memory of 4240 1408 msedge.exe 83 PID 1408 wrote to memory of 4240 1408 msedge.exe 83 PID 1408 wrote to memory of 4240 1408 msedge.exe 83 PID 1408 wrote to memory of 4240 1408 msedge.exe 83 PID 1408 wrote to memory of 4240 1408 msedge.exe 83 PID 1408 wrote to memory of 4240 1408 msedge.exe 83 PID 1408 wrote to memory of 4240 1408 msedge.exe 83
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\19ecddaf7d3e5fdee8309b8dc2477800_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcaaf146f8,0x7ffcaaf14708,0x7ffcaaf147182⤵PID:2196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16468075605968613938,8087664834362403564,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:3028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,16468075605968613938,8087664834362403564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2616 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,16468075605968613938,8087664834362403564,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:82⤵PID:4240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16468075605968613938,8087664834362403564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:2820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16468075605968613938,8087664834362403564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:12⤵PID:2932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16468075605968613938,8087664834362403564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:12⤵PID:1220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16468075605968613938,8087664834362403564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:82⤵PID:2440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16468075605968613938,8087664834362403564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16468075605968613938,8087664834362403564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:12⤵PID:4112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16468075605968613938,8087664834362403564,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:12⤵PID:1180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16468075605968613938,8087664834362403564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:12⤵PID:4620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16468075605968613938,8087664834362403564,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:12⤵PID:5000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16468075605968613938,8087664834362403564,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4400 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4296
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3060
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4968
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
Filesize
5KB
MD538cb719abdf8a05790dd2bff7da0550d
SHA1ebee8d1488e0bffdda91a378eaa11e1eaffeb735
SHA2561bcceb9c88f41903564601add77b349abbf4afb485c998edb30194247606a5c4
SHA512cf9f393d56feb94ee50637643a971478b0326e5c5fa77a427898f0906d4a3965c1b3e1f2c02db9857209ce78cbd9aa5a4e9ea00d85e169ef991860e120d1052a
-
Filesize
6KB
MD505461538be357ab0c11acf91d0595fc1
SHA1f3997c3b4d530be5be63d7ad0394de0ec0a574ae
SHA25600712817f86da05638b06448e5867e988bfb509fba11316093ed3f461d4909e4
SHA512eaaa1ed68418d66b6d1a7caf38693c500fdabb80d5580f96a9c36f9b24a65147296415e9d1cebade7c4b498c25b55cec07c5e482b6d8fd281138b1d607cff6a9
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
8KB
MD5aa7067a6020943d8a46649717a67516c
SHA12e71906189ae9acf9c4eb02d2ab3bb8ab7f25797
SHA256044ac167d8f585aaf7a53b2deec70a82c3f1fd367ef20f5241e0d3a9677860b2
SHA51251b97d0a41cb313f30aa097b99da43fd8db0212c838df0d3646121b5ac46f6c20dfe4850ebc37057fa11b9255ae0140885dc6e258f9dbaa1241d7df0de739bd6