Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 11:41
Static task
static1
Behavioral task
behavioral1
Sample
6316de796eff839eaefeb5390ebbfb1d_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
6316de796eff839eaefeb5390ebbfb1d_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
6316de796eff839eaefeb5390ebbfb1d_JaffaCakes118.html
-
Size
4KB
-
MD5
6316de796eff839eaefeb5390ebbfb1d
-
SHA1
7d1ddafa146835adf6da0e3cd569b79f39f60559
-
SHA256
6b67e52b094c12a7349b18548c9b97b14167b64f100ebd487157fd3a52da94c6
-
SHA512
f4232ba39673523d8867350e8b314c5be07d6f825d406cbda3c1ba268a5afd22b90a63eef337c7cb5486691e787a27e1d3e6ed56d19ff405a488f987a0935358
-
SSDEEP
48:rrqgErfWDEPMjS5MoMBa4Mlu3rPCOebz4DyQuht0i5:SbfWEP+S5p8aDmrPpeb0DYhtZ5
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2520 msedge.exe 2520 msedge.exe 3036 msedge.exe 3036 msedge.exe 3944 identity_helper.exe 3944 identity_helper.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe 1184 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3036 wrote to memory of 1620 3036 msedge.exe 86 PID 3036 wrote to memory of 1620 3036 msedge.exe 86 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 3532 3036 msedge.exe 87 PID 3036 wrote to memory of 2520 3036 msedge.exe 88 PID 3036 wrote to memory of 2520 3036 msedge.exe 88 PID 3036 wrote to memory of 4920 3036 msedge.exe 89 PID 3036 wrote to memory of 4920 3036 msedge.exe 89 PID 3036 wrote to memory of 4920 3036 msedge.exe 89 PID 3036 wrote to memory of 4920 3036 msedge.exe 89 PID 3036 wrote to memory of 4920 3036 msedge.exe 89 PID 3036 wrote to memory of 4920 3036 msedge.exe 89 PID 3036 wrote to memory of 4920 3036 msedge.exe 89 PID 3036 wrote to memory of 4920 3036 msedge.exe 89 PID 3036 wrote to memory of 4920 3036 msedge.exe 89 PID 3036 wrote to memory of 4920 3036 msedge.exe 89 PID 3036 wrote to memory of 4920 3036 msedge.exe 89 PID 3036 wrote to memory of 4920 3036 msedge.exe 89 PID 3036 wrote to memory of 4920 3036 msedge.exe 89 PID 3036 wrote to memory of 4920 3036 msedge.exe 89 PID 3036 wrote to memory of 4920 3036 msedge.exe 89 PID 3036 wrote to memory of 4920 3036 msedge.exe 89 PID 3036 wrote to memory of 4920 3036 msedge.exe 89 PID 3036 wrote to memory of 4920 3036 msedge.exe 89 PID 3036 wrote to memory of 4920 3036 msedge.exe 89 PID 3036 wrote to memory of 4920 3036 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6316de796eff839eaefeb5390ebbfb1d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfe9146f8,0x7ffdfe914708,0x7ffdfe9147182⤵PID:1620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4144990728942797615,6361894530476286,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:3532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,4144990728942797615,6361894530476286,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,4144990728942797615,6361894530476286,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:82⤵PID:4920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4144990728942797615,6361894530476286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:12⤵PID:3276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4144990728942797615,6361894530476286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:3360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4144990728942797615,6361894530476286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:12⤵PID:4972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4144990728942797615,6361894530476286,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:82⤵PID:512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4144990728942797615,6361894530476286,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4144990728942797615,6361894530476286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:12⤵PID:3432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4144990728942797615,6361894530476286,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:12⤵PID:1768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4144990728942797615,6361894530476286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:12⤵PID:5152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4144990728942797615,6361894530476286,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:12⤵PID:5160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4144990728942797615,6361894530476286,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1184
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4552
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:872
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5584971c8ba88c824fd51a05dddb45a98
SHA1b7c9489b4427652a9cdd754d1c1b6ac4034be421
SHA256e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307
SHA5125dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726
-
Filesize
152B
MD5b28ef7d9f6d74f055cc49876767c886c
SHA1d6b3267f36c340979f8fc3e012fdd02c468740bf
SHA256fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37
SHA512491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75
-
Filesize
5KB
MD559b54596d888450c82010bd3af4ee2ef
SHA1131284a4543454c7b5fedf1153b022ab5577a3a2
SHA256555259e4df50c3ac6a7c30d30486ba7339d6a97e6d3e8f38c20164451d0abc11
SHA51288f5f97b88f345bfdef978d4f1ffe6e73e800d515bfdeff4a4bbdd2e86808b3427192b8706371695f2fd5d06749730574410ed080ce79bdba41c46450e226c8b
-
Filesize
6KB
MD5f68ca2fd363e02b677cdb46f8d75c4b2
SHA1b9a2fc0c45740ada940620351ddb766926d9d66c
SHA2568a9fc2261c45dbd69300360cd0033f0d634633d24dec2758cbf164df84ec927c
SHA5122736d7acd9c0ab28f62208f0b9b8832607e62979fd01fe92a80600d15f2b821ccfcd4ff194ee5a515f5a8a0408ee5216ae81862b20d160e35f93a92a82c14fd5
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5a2649d9f5368241771b0110dc68db29d
SHA1a9ec21bf44e934c06e4afdb21087ec9ef1c2c4ec
SHA2567cbc4f529987bf3d62130364203fd7c461728fa7e6246b66ab4e9f4aeb8bd1c4
SHA5124a8e10f53ffea609a39b27ccce3aa835fb392897429498befbe5c27370ed158c4365b021952e15dfee6c9c2c4cc4f5456b70e26437a5534c4fed1e7d5e10e932