Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 22:33
Static task
static1
Behavioral task
behavioral1
Sample
323e1fe9f661c5bd530b43f600750f47_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
323e1fe9f661c5bd530b43f600750f47_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
323e1fe9f661c5bd530b43f600750f47_JaffaCakes118.html
-
Size
6KB
-
MD5
323e1fe9f661c5bd530b43f600750f47
-
SHA1
a4b3a8f4e21d1a936b27722b6a4b8362c4aadaab
-
SHA256
16b7ee255c5896bffbb6632f665c3f08dea6228aa7c8175f8b66451ac2611cbf
-
SHA512
3290067648e3554d1719d5a58b80531a6aaa6ae560032f0c2a87d6d7de76f01599bcb71d03d16e972789f9d71e29f28d6d7b4974924b1d00c5d4576a04dceb65
-
SSDEEP
96:uzVs+ux7iFLLY1k9o84d12ef7CSTUsocEZ7ru7f:csz7iFAYS/ab76f
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2060 msedge.exe 2060 msedge.exe 2476 msedge.exe 2476 msedge.exe 3616 identity_helper.exe 3616 identity_helper.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe 1940 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2476 wrote to memory of 2068 2476 msedge.exe 82 PID 2476 wrote to memory of 2068 2476 msedge.exe 82 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 5044 2476 msedge.exe 83 PID 2476 wrote to memory of 2060 2476 msedge.exe 84 PID 2476 wrote to memory of 2060 2476 msedge.exe 84 PID 2476 wrote to memory of 412 2476 msedge.exe 85 PID 2476 wrote to memory of 412 2476 msedge.exe 85 PID 2476 wrote to memory of 412 2476 msedge.exe 85 PID 2476 wrote to memory of 412 2476 msedge.exe 85 PID 2476 wrote to memory of 412 2476 msedge.exe 85 PID 2476 wrote to memory of 412 2476 msedge.exe 85 PID 2476 wrote to memory of 412 2476 msedge.exe 85 PID 2476 wrote to memory of 412 2476 msedge.exe 85 PID 2476 wrote to memory of 412 2476 msedge.exe 85 PID 2476 wrote to memory of 412 2476 msedge.exe 85 PID 2476 wrote to memory of 412 2476 msedge.exe 85 PID 2476 wrote to memory of 412 2476 msedge.exe 85 PID 2476 wrote to memory of 412 2476 msedge.exe 85 PID 2476 wrote to memory of 412 2476 msedge.exe 85 PID 2476 wrote to memory of 412 2476 msedge.exe 85 PID 2476 wrote to memory of 412 2476 msedge.exe 85 PID 2476 wrote to memory of 412 2476 msedge.exe 85 PID 2476 wrote to memory of 412 2476 msedge.exe 85 PID 2476 wrote to memory of 412 2476 msedge.exe 85 PID 2476 wrote to memory of 412 2476 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\323e1fe9f661c5bd530b43f600750f47_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff88a7846f8,0x7ff88a784708,0x7ff88a7847182⤵PID:2068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,352694139264692513,6679151615862215367,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:5044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,352694139264692513,6679151615862215367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,352694139264692513,6679151615862215367,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:82⤵PID:412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,352694139264692513,6679151615862215367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:4504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,352694139264692513,6679151615862215367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:1860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,352694139264692513,6679151615862215367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:82⤵PID:3112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,352694139264692513,6679151615862215367,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,352694139264692513,6679151615862215367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:12⤵PID:5032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,352694139264692513,6679151615862215367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:12⤵PID:3624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,352694139264692513,6679151615862215367,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:12⤵PID:4524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,352694139264692513,6679151615862215367,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:12⤵PID:3984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,352694139264692513,6679151615862215367,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4812 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1940
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5052
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5210676dde5c0bd984dc057e2333e1075
SHA12d2f8c14ee48a2580f852db7ac605f81b5b1399a
SHA2562a89d71b4ddd34734b16d91ebd8ea68b760f321baccdd4963f91b8d3507a3fb5
SHA512aeb81804cac5b17a5d1e55327f62df7645e9bbbfa8cad1401e7382628341a939b7aedc749b2412c06174a9e3fcdd5248d6df9b5d3f56c53232d17e59277ab017
-
Filesize
152B
MD5f4e6521c03f1bc16d91d99c059cc5424
SHA1043665051c486192a6eefe6d0632cf34ae8e89ad
SHA2567759c346539367b2f80e78abca170f09731caa169e3462f11eda84c3f1ca63d1
SHA5120bb4f628da6d715910161439685052409be54435e192cb4105191472bb14a33724592df24686d1655e9ba9572bd3dff8f46e211c0310e16bfe2ac949c49fbc5e
-
Filesize
6KB
MD593713f326ed9ce13849c6417b53a6c21
SHA13752b6b669bb5364ac6d8d477f80ef46d41ea565
SHA2560bb1d9c2a14421fca074d5f0c7165b75476302bf4f97f08d6bf07d669f509c64
SHA5129aa173648775e475687cc1f2ed9cb9bf67b532251aa2e5a76889f8445b84492adcc70560e57c657f5ca35a8eee2873140e91b1e312a133fd4ff62993d6aa06c3
-
Filesize
6KB
MD549b3b5ec192ade35add16d4589479f64
SHA1251f8f200883e031f337227a2ad4147f5fde80f0
SHA2561c6281dfdc2eef1afddbb3ef370cc7143b0bc89c00cd9aafe029980840fa9b40
SHA5122972817e2948925661b9f56c7d57818eb4d6f892ac2928385347a0656e2da202ad843998da9d31369d2ff9746cb21354f94f0826e254c3741c6e4ae7db3f07ea
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD567ca5484631cabcab735184fd2e79167
SHA17a2db7062a604be902a23735c4fe3b653dbf404a
SHA256c642c1af6bc381a9ffd5acea597fa25977aefae5aec30a8952d76acf3202c372
SHA5121f2a7149c3b15cfe87163cf373ab71ac8c3c3508a3a4fa4afce06edb65e929f09be12815b2347cb8b51b5a6952230879d2456d36b36e83cd4216f41f67e9dac5