Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2024, 07:31
Static task
static1
Behavioral task
behavioral1
Sample
27bc92ff96b41e05e98c3c9912c0005d_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
27bc92ff96b41e05e98c3c9912c0005d_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
27bc92ff96b41e05e98c3c9912c0005d_JaffaCakes118.html
-
Size
17KB
-
MD5
27bc92ff96b41e05e98c3c9912c0005d
-
SHA1
b9c74358453daa1897ad49e371a188af35d23a97
-
SHA256
186e7e720098e6b24919e0197f900c930caaa85bf6682e679955a876a481d36f
-
SHA512
bda4a081488f9b3d1cccf14bcd1ad0ef4667e400fe2195d0fb7b35411cfd6712c720cec290cf2b507e52e3c17a07f99f8a3d0052070bb6cd8d915178d958f5d2
-
SSDEEP
192:tMbNWuaYwbyZjyZQyZEyZQF+aYZm404HZU494I4t4e4g4S3jFUUzv9a/ZdmEVFh6:ibGYbJYN/ZwEN/eE4
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4232 msedge.exe 4232 msedge.exe 4892 msedge.exe 4892 msedge.exe 648 identity_helper.exe 648 identity_helper.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe 4892 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4892 wrote to memory of 3552 4892 msedge.exe 82 PID 4892 wrote to memory of 3552 4892 msedge.exe 82 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4380 4892 msedge.exe 83 PID 4892 wrote to memory of 4232 4892 msedge.exe 84 PID 4892 wrote to memory of 4232 4892 msedge.exe 84 PID 4892 wrote to memory of 224 4892 msedge.exe 85 PID 4892 wrote to memory of 224 4892 msedge.exe 85 PID 4892 wrote to memory of 224 4892 msedge.exe 85 PID 4892 wrote to memory of 224 4892 msedge.exe 85 PID 4892 wrote to memory of 224 4892 msedge.exe 85 PID 4892 wrote to memory of 224 4892 msedge.exe 85 PID 4892 wrote to memory of 224 4892 msedge.exe 85 PID 4892 wrote to memory of 224 4892 msedge.exe 85 PID 4892 wrote to memory of 224 4892 msedge.exe 85 PID 4892 wrote to memory of 224 4892 msedge.exe 85 PID 4892 wrote to memory of 224 4892 msedge.exe 85 PID 4892 wrote to memory of 224 4892 msedge.exe 85 PID 4892 wrote to memory of 224 4892 msedge.exe 85 PID 4892 wrote to memory of 224 4892 msedge.exe 85 PID 4892 wrote to memory of 224 4892 msedge.exe 85 PID 4892 wrote to memory of 224 4892 msedge.exe 85 PID 4892 wrote to memory of 224 4892 msedge.exe 85 PID 4892 wrote to memory of 224 4892 msedge.exe 85 PID 4892 wrote to memory of 224 4892 msedge.exe 85 PID 4892 wrote to memory of 224 4892 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\27bc92ff96b41e05e98c3c9912c0005d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffebc9e46f8,0x7ffebc9e4708,0x7ffebc9e47182⤵PID:3552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7708387614319918795,2318372543326410971,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,7708387614319918795,2318372543326410971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,7708387614319918795,2318372543326410971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:82⤵PID:224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7708387614319918795,2318372543326410971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:4840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7708387614319918795,2318372543326410971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:2152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7708387614319918795,2318372543326410971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:12⤵PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7708387614319918795,2318372543326410971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:82⤵PID:3532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,7708387614319918795,2318372543326410971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7708387614319918795,2318372543326410971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:12⤵PID:4872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7708387614319918795,2318372543326410971,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:12⤵PID:2156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7708387614319918795,2318372543326410971,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4336 /prefetch:12⤵PID:4500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,7708387614319918795,2318372543326410971,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:12⤵PID:4508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,7708387614319918795,2318372543326410971,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5024 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3996
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3632
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e81c757cdb64c4fd5c91e6ade1a16308
SHA119dc7ff5e8551a2b08874131d962b697bb84ad9b
SHA25682141d451d07bdb68991f33c59129214dd6d3d10158aeb7a1dc81efbc5fb12b3
SHA512ba8de0b3b04fec5a96d361459dde0941b1b70f5be231fdec94806efa3ecf1e8faf8e27b1800fa606dc4a82e29d4cf5109b94109e5ad242ddf9f4671e2acbcfbd
-
Filesize
152B
MD52e57ec8bd99545e47a55d581964d0549
SHA1bd7055ea7df7696298a94dedfc91136e3b530db8
SHA256a50ba35608edc2f3360cc71be0d4b29bba0e3382d1f08f24df5322ce2ad2443c
SHA5126b9b73d983c472149629c842e16e4f7c2f8a0a3bb6dd64837ef647db810ef1beb3a02b15dc1eec2c5de8aee6b3ca195c7d26c432705061c5b0ec7841a5bbf106
-
Filesize
6KB
MD59b8e04f66254a423b9ea4cde3f915b42
SHA1cf4f0733cc8b9fdf35172512dca242140fcd20c9
SHA25640e7a22eba4922b404ac7d3af2f14c1a85714de90bbaebba896d0954d17733d2
SHA512bf5b5681785dca4c806efe85c511a2db193b2e4374dea48a926e4178ef3e572f31b5dc9395b74af1d247d867b3b469062ea477bc696180e3027d94e125c414ce
-
Filesize
6KB
MD59c1c3ee7f6a11d17cdbba535d11fd3e9
SHA1abc678016e60b560ee90113954b4d3e350768189
SHA25678ca670c8e15f4617ca2d0d325d49f5e44e84178221e34c956a5f08f8328ab5c
SHA512acabfe33940f96f3a9f114ed3d17d28c416b66cae394d798b0b66830d926db1960a46e0051810d68a9ec6b3e6d9e8a9f3253f9a1dc3da82b1f438cdefc622c95
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD550c38be4444cef75fd60061547ee9a8b
SHA18a84b390e42bfead91e06af20f174567100953a9
SHA25621224820d3e5b772f64d40f9e770a60f745df73ccfc151ae7d5446c57cfe7c2d
SHA512f67b885e9b621bdb769d54bf2cf092e9d3b41f4fed90ff55f48d1abceecde27d95ea910668fdb459dc7dd5ee697008139f64172436e7a6335b7e6d1c00b66c5d