Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13/07/2024, 02:49
Static task
static1
Behavioral task
behavioral1
Sample
3fe534789702c055126750dff46800ee_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3fe534789702c055126750dff46800ee_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3fe534789702c055126750dff46800ee_JaffaCakes118.html
-
Size
6KB
-
MD5
3fe534789702c055126750dff46800ee
-
SHA1
bd66ac7b47046398baf52af5f565414bb173072e
-
SHA256
cabc0fc3ad9e1f6a9e4d94039e1b6940fbebb87b6e052895a0489ffb4e5635d3
-
SHA512
2fa9d9f5e9504536425840e9461785fa94415b3afc12609f4f1f4a02731e36f653b67351e8b49638b41ee911ec351c645097d6f683713244178cbc168946d9cd
-
SSDEEP
96:uzVs+ux7Q8LLY1k9o84d12ef7CSTUzbca1sLiYcYR16cEZ7ru7f:csz7Q8AYS/M4R4b76f
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3548 msedge.exe 3548 msedge.exe 1644 msedge.exe 1644 msedge.exe 1052 identity_helper.exe 1052 identity_helper.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe 1604 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe 1644 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1644 wrote to memory of 2176 1644 msedge.exe 83 PID 1644 wrote to memory of 2176 1644 msedge.exe 83 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3616 1644 msedge.exe 85 PID 1644 wrote to memory of 3548 1644 msedge.exe 86 PID 1644 wrote to memory of 3548 1644 msedge.exe 86 PID 1644 wrote to memory of 4620 1644 msedge.exe 87 PID 1644 wrote to memory of 4620 1644 msedge.exe 87 PID 1644 wrote to memory of 4620 1644 msedge.exe 87 PID 1644 wrote to memory of 4620 1644 msedge.exe 87 PID 1644 wrote to memory of 4620 1644 msedge.exe 87 PID 1644 wrote to memory of 4620 1644 msedge.exe 87 PID 1644 wrote to memory of 4620 1644 msedge.exe 87 PID 1644 wrote to memory of 4620 1644 msedge.exe 87 PID 1644 wrote to memory of 4620 1644 msedge.exe 87 PID 1644 wrote to memory of 4620 1644 msedge.exe 87 PID 1644 wrote to memory of 4620 1644 msedge.exe 87 PID 1644 wrote to memory of 4620 1644 msedge.exe 87 PID 1644 wrote to memory of 4620 1644 msedge.exe 87 PID 1644 wrote to memory of 4620 1644 msedge.exe 87 PID 1644 wrote to memory of 4620 1644 msedge.exe 87 PID 1644 wrote to memory of 4620 1644 msedge.exe 87 PID 1644 wrote to memory of 4620 1644 msedge.exe 87 PID 1644 wrote to memory of 4620 1644 msedge.exe 87 PID 1644 wrote to memory of 4620 1644 msedge.exe 87 PID 1644 wrote to memory of 4620 1644 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3fe534789702c055126750dff46800ee_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9923746f8,0x7ff992374708,0x7ff9923747182⤵PID:2176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,15514357691727318686,764190910340729664,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:22⤵PID:3616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,15514357691727318686,764190910340729664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,15514357691727318686,764190910340729664,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:82⤵PID:4620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15514357691727318686,764190910340729664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15514357691727318686,764190910340729664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:4360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,15514357691727318686,764190910340729664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:82⤵PID:3672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,15514357691727318686,764190910340729664,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15514357691727318686,764190910340729664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:12⤵PID:4712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15514357691727318686,764190910340729664,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:12⤵PID:3640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15514357691727318686,764190910340729664,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:12⤵PID:4700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15514357691727318686,764190910340729664,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:12⤵PID:2980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,15514357691727318686,764190910340729664,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1604
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4916
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5584971c8ba88c824fd51a05dddb45a98
SHA1b7c9489b4427652a9cdd754d1c1b6ac4034be421
SHA256e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307
SHA5125dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726
-
Filesize
152B
MD5b28ef7d9f6d74f055cc49876767c886c
SHA1d6b3267f36c340979f8fc3e012fdd02c468740bf
SHA256fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37
SHA512491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75
-
Filesize
6KB
MD5b222b40e44b96fe4c2a854e1b3e2e38e
SHA1f69037bdff7483f2a5f5e65df08a060fa0a6c05d
SHA256e6eb97f192dd787e5733227aef375cd60665a67c8e12ae25f17400fe498fb478
SHA5120ce77dc12e6148d3567fc865df624ee16b5cd81c7b70d9cc61f7f588710cd9ea8cea33183a8c46fd999c500226bb1b9fbd10f279f5cc4fe0f6aec331fc9746ed
-
Filesize
6KB
MD5aa4ead82770c3ef3f38d5de4df831160
SHA1edc3754babafbe6b6882bce097f5f0bb0acb08c8
SHA2564d7516c8100b4fe00c0a2eca1bc545f256373794b04feb347b28921ff8116a3b
SHA512f967cd3e41ee9282b08f46d675fee82d2be50f28974064af107d552b2f86578af8c9548b0db88b08b80001d70c77d094944ad6ddafddcafec3bbc60de7955885
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD59dd76f1d9eba20f8d12c819ad4014c2b
SHA1662f12d1ff21e06879e1f0b7da56c725e677ca0f
SHA2563952a9f075da853541101fe6c89a9423930c51e85634c2d2154d086fab2413e6
SHA5124b73478a01dafe151655cab24637fb628cb734cbcd63a75eda40d93083272781508290a13eeac720176538fce33c2d0575ef3cc80e064dee1590fce82fe61282