Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2024, 08:21
Static task
static1
Behavioral task
behavioral1
Sample
27e142090132e7bf731cad061705247c_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
27e142090132e7bf731cad061705247c_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
27e142090132e7bf731cad061705247c_JaffaCakes118.html
-
Size
18KB
-
MD5
27e142090132e7bf731cad061705247c
-
SHA1
2e03dce1356bfb2ce585eed72187475dbaa9cc25
-
SHA256
1c73983071792905035c832a8f136812f3d9965b712f2818b70a14303f864ece
-
SHA512
53fe6383e5dcb4ca1be662454fc48559970d60899d08d3244d40741aa755c0d960354595a03486be765caccb4f4aa6a7687a272f105df0542d465d1297da7a32
-
SSDEEP
192:nhkVcsZd77uE5VJGxFCVkFvH0H4XBL7zv0NnfrWjoZGHcdZIEJhWCiwsb/5+q32k:hkVcsZdnubCmpRLirWjoZGHcdZIjAmL
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4876 msedge.exe 4876 msedge.exe 2820 msedge.exe 2820 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe 2820 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2820 wrote to memory of 872 2820 msedge.exe 82 PID 2820 wrote to memory of 872 2820 msedge.exe 82 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 648 2820 msedge.exe 84 PID 2820 wrote to memory of 4876 2820 msedge.exe 85 PID 2820 wrote to memory of 4876 2820 msedge.exe 85 PID 2820 wrote to memory of 2276 2820 msedge.exe 86 PID 2820 wrote to memory of 2276 2820 msedge.exe 86 PID 2820 wrote to memory of 2276 2820 msedge.exe 86 PID 2820 wrote to memory of 2276 2820 msedge.exe 86 PID 2820 wrote to memory of 2276 2820 msedge.exe 86 PID 2820 wrote to memory of 2276 2820 msedge.exe 86 PID 2820 wrote to memory of 2276 2820 msedge.exe 86 PID 2820 wrote to memory of 2276 2820 msedge.exe 86 PID 2820 wrote to memory of 2276 2820 msedge.exe 86 PID 2820 wrote to memory of 2276 2820 msedge.exe 86 PID 2820 wrote to memory of 2276 2820 msedge.exe 86 PID 2820 wrote to memory of 2276 2820 msedge.exe 86 PID 2820 wrote to memory of 2276 2820 msedge.exe 86 PID 2820 wrote to memory of 2276 2820 msedge.exe 86 PID 2820 wrote to memory of 2276 2820 msedge.exe 86 PID 2820 wrote to memory of 2276 2820 msedge.exe 86 PID 2820 wrote to memory of 2276 2820 msedge.exe 86 PID 2820 wrote to memory of 2276 2820 msedge.exe 86 PID 2820 wrote to memory of 2276 2820 msedge.exe 86 PID 2820 wrote to memory of 2276 2820 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\27e142090132e7bf731cad061705247c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf03346f8,0x7ffaf0334708,0x7ffaf03347182⤵PID:872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:22⤵PID:648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:82⤵PID:2276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:2628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:4004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:12⤵PID:4672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:12⤵PID:2824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:82⤵PID:2796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:82⤵PID:2632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:12⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:12⤵PID:4360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:12⤵PID:1140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:12⤵PID:4024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,14871188548123566949,17235408877461598700,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3028 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3320
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2572
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2232
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5de1d175f3af722d1feb1c205f4e92d1e
SHA1019cf8527a9b94bd0b35418bf7be8348be5a1c39
SHA2561b99cae942ebf99c31795fa279d51b1a2379ca0af7b27bd3c58ea6c78a033924
SHA512f0dcd08afd3c6a761cc1afa2846ec23fb5438d6127ebd535a754498debabd0b1ebd04858d1b98be92faf14b512f982b1f3dcbb702860e96877eb835f763f9734
-
Filesize
152B
MD506b496d28461d5c01fc81bc2be6a9978
SHA136e7a9d9c7a924d5bb448d68038c7fe5e6cbf5aa
SHA256e4a2d1395627095b0fa55e977e527ccb5b71dff3cd2d138df498f50f9f5ab507
SHA5126488a807c978d38d65010583c1e5582548ab8102ebd68ee827e603c9bdfcdbb9f98a488d31414a829409f6edca8bd2eb4aadd4ff31b144de41249fa63a26bc91
-
Filesize
257B
MD54b1f3959bda91435c41d914cd8aef09f
SHA1c6c0649e876aa23b275206f02e9b07093a251764
SHA256e8991c9ccd18cec60fb89ba3bd2470448160964a368728faecf48c08a0495ec9
SHA5129b38623e270d2322b921703a2829f6341bc0d13bdcb3c1a81bbd583f5b3bd024857e5d322120a37338b3f93b185704dda91851f99762e460f05226570a3a4613
-
Filesize
6KB
MD5b9391aab869a485602c1655a072c42d2
SHA159c16e92894999ee5cc8989a306a53d8bae4e9dd
SHA256d42df950eb0ba351c81c5ef4747dec65937312861df4db6c24e1c7f3028ac09c
SHA5129041f0441e60d4bbe357dc0486c9817d43c7613495856f8e240d5577cb2e139e3a55e84c3a2b368a743e9379851dce4f3e18bc0237399e6914b356898e871b59
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\abe8e45f-998f-4b8d-8325-5814d848fdee.tmp
Filesize6KB
MD5c8801503a74a349eb9c8e82334cfae0e
SHA1d96e5f4f606175d254c1ce3bf7a0b26859f26a69
SHA256deae855126e194b951a4c968834437326fef1e906f75e4becf55d67312497728
SHA51208474adbffdd0f2daef26678ae7f7aac4f32bfba76ec2501aee813a4d99f17ecdd4164ddcae2047bde7a089174a817eda8be9af50b5a075cfb5bca180d847b34
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD50a7cf8a6411fc0b889e780f0ddfea9c4
SHA1ceb86d9fd02ac900bda5507be3c219fa2ce7c993
SHA256d5f491ad40e2d0af2a61e3ed95c012d24e7a13227d808e344de26fb309d2a1b7
SHA5120fe09832bdd6759a08a1564822d90ed20e0afcdc558ce47854be7cbe9c8b6f109237de58c7572186123ec49a8f619bc889717c2f176aab2c30dbb24bfd05fdaa