Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2024, 18:13
Static task
static1
Behavioral task
behavioral1
Sample
2922c6e7c00b0b799ddc2fc279a39e6f_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2922c6e7c00b0b799ddc2fc279a39e6f_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2922c6e7c00b0b799ddc2fc279a39e6f_JaffaCakes118.html
-
Size
7KB
-
MD5
2922c6e7c00b0b799ddc2fc279a39e6f
-
SHA1
78d031e2b9010f0ec08ab4818ab4ea4356f07532
-
SHA256
fc7a46eabe693e268f6ab63b337869532a3ba46d83dc0b0b9426d280cdbf7415
-
SHA512
2d44abc7918c0a7522605d47d4b4653acada6010b9b72797b46c60ade89c16ea92e4be9191eb0a92eda5088d6d679b8f712ac857b78d52b40de322cdbfc4e0a7
-
SSDEEP
192:ljVAUYVLB9ruYVLBaeQlpdaTdqs3CTH0uP7KJ5:lpHYLKYEuYvHBU
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4636 msedge.exe 4636 msedge.exe 3740 msedge.exe 3740 msedge.exe 4468 identity_helper.exe 4468 identity_helper.exe 1952 msedge.exe 1952 msedge.exe 1952 msedge.exe 1952 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe 3740 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3740 wrote to memory of 768 3740 msedge.exe 82 PID 3740 wrote to memory of 768 3740 msedge.exe 82 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4936 3740 msedge.exe 83 PID 3740 wrote to memory of 4636 3740 msedge.exe 84 PID 3740 wrote to memory of 4636 3740 msedge.exe 84 PID 3740 wrote to memory of 4652 3740 msedge.exe 85 PID 3740 wrote to memory of 4652 3740 msedge.exe 85 PID 3740 wrote to memory of 4652 3740 msedge.exe 85 PID 3740 wrote to memory of 4652 3740 msedge.exe 85 PID 3740 wrote to memory of 4652 3740 msedge.exe 85 PID 3740 wrote to memory of 4652 3740 msedge.exe 85 PID 3740 wrote to memory of 4652 3740 msedge.exe 85 PID 3740 wrote to memory of 4652 3740 msedge.exe 85 PID 3740 wrote to memory of 4652 3740 msedge.exe 85 PID 3740 wrote to memory of 4652 3740 msedge.exe 85 PID 3740 wrote to memory of 4652 3740 msedge.exe 85 PID 3740 wrote to memory of 4652 3740 msedge.exe 85 PID 3740 wrote to memory of 4652 3740 msedge.exe 85 PID 3740 wrote to memory of 4652 3740 msedge.exe 85 PID 3740 wrote to memory of 4652 3740 msedge.exe 85 PID 3740 wrote to memory of 4652 3740 msedge.exe 85 PID 3740 wrote to memory of 4652 3740 msedge.exe 85 PID 3740 wrote to memory of 4652 3740 msedge.exe 85 PID 3740 wrote to memory of 4652 3740 msedge.exe 85 PID 3740 wrote to memory of 4652 3740 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2922c6e7c00b0b799ddc2fc279a39e6f_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbffa146f8,0x7ffbffa14708,0x7ffbffa147182⤵PID:768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,10971002167567211277,121882830993231054,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:22⤵PID:4936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,10971002167567211277,121882830993231054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,10971002167567211277,121882830993231054,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:82⤵PID:4652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,10971002167567211277,121882830993231054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:2968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,10971002167567211277,121882830993231054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,10971002167567211277,121882830993231054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:82⤵PID:2236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,10971002167567211277,121882830993231054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,10971002167567211277,121882830993231054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:12⤵PID:2776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,10971002167567211277,121882830993231054,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:12⤵PID:1672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,10971002167567211277,121882830993231054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:12⤵PID:2700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,10971002167567211277,121882830993231054,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:12⤵PID:816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,10971002167567211277,121882830993231054,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1952
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3200
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:932
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e81c757cdb64c4fd5c91e6ade1a16308
SHA119dc7ff5e8551a2b08874131d962b697bb84ad9b
SHA25682141d451d07bdb68991f33c59129214dd6d3d10158aeb7a1dc81efbc5fb12b3
SHA512ba8de0b3b04fec5a96d361459dde0941b1b70f5be231fdec94806efa3ecf1e8faf8e27b1800fa606dc4a82e29d4cf5109b94109e5ad242ddf9f4671e2acbcfbd
-
Filesize
152B
MD52e57ec8bd99545e47a55d581964d0549
SHA1bd7055ea7df7696298a94dedfc91136e3b530db8
SHA256a50ba35608edc2f3360cc71be0d4b29bba0e3382d1f08f24df5322ce2ad2443c
SHA5126b9b73d983c472149629c842e16e4f7c2f8a0a3bb6dd64837ef647db810ef1beb3a02b15dc1eec2c5de8aee6b3ca195c7d26c432705061c5b0ec7841a5bbf106
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\49a17332-9d97-4468-bb0e-57d6e4535a0f.tmp
Filesize6KB
MD51598dedec8e74014fb82c66edccd167b
SHA1ba61c6f29f0c50682648ba55670031956b62a4d0
SHA2564979c29b0e17901113d842b4ee84c90018979b7d72ba7db0743784c119f1a75d
SHA512d9a9240557426d85a4bb7504d4d6e16a55680eabd27a46a7241fd408992475ec5481192439c0ccc9b2e784e4336daf672371169ed108942742803e5b066402da
-
Filesize
6KB
MD51788a9718034d3718d95f0ce1825e6e1
SHA1481b0b1273eb48ec602e066e02b8a43c1e0a1de1
SHA256cc3eaa14fa8e5784b9f2375721367ad9989ef4370bf028a05523f3ad93573105
SHA5122c555ec1b4e59211f8fe4fc8ffe4c129a83d5a288e95a99d8091a598a397cf5a0d1d5f027f12d4b12537cf5ff0dba9754271eb55cef2aa79f66487b9de00909d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5222cba937efc656bbe7e65b6be38854b
SHA1822cae13bdced0787e332d59441fb722fc904732
SHA256b9f69452453a7488e03e287ffc1b6114d354c790d881928afecb5313e322c304
SHA512e85e1fab25b026e47978c912e02e1bdc57f08312ad0a1473b3cc79f28c641cb21f163563172a5d5e934edd1b50b2022b9ef8bb53845c2d0cc6a4223c5bfaf18b