Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 10:06
Static task
static1
Behavioral task
behavioral1
Sample
6723dcda964e36538f52bcc4f27b0d7c_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6723dcda964e36538f52bcc4f27b0d7c_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
6723dcda964e36538f52bcc4f27b0d7c_JaffaCakes118.html
-
Size
18KB
-
MD5
6723dcda964e36538f52bcc4f27b0d7c
-
SHA1
a562b0db86d8658526aa74dd700dde22e40840d7
-
SHA256
7186d0f67d93091fe0cff461ef5965599476e2bf0225417ab2d3399349647074
-
SHA512
e4cf4f3ea226bea8e57219b102a568090f3143168261835941e3a713b78bc6afe8c81d0d7ca5ed8376d7fc9375f6eea61622dddbec2bb5b85e9e24ef06a5d0b9
-
SSDEEP
192:FRcR3G15c254wNNHoVIsSFXYHNXIQOiVuo8leh84+XH697SIRqRBxEiTerL1:Fa4r54ENHQIsSClTgXH697SIRviy1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1740 msedge.exe 1740 msedge.exe 3540 msedge.exe 3540 msedge.exe 3832 identity_helper.exe 3832 identity_helper.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe 2448 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe 3540 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3540 wrote to memory of 4612 3540 msedge.exe 84 PID 3540 wrote to memory of 4612 3540 msedge.exe 84 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 3524 3540 msedge.exe 85 PID 3540 wrote to memory of 1740 3540 msedge.exe 86 PID 3540 wrote to memory of 1740 3540 msedge.exe 86 PID 3540 wrote to memory of 464 3540 msedge.exe 87 PID 3540 wrote to memory of 464 3540 msedge.exe 87 PID 3540 wrote to memory of 464 3540 msedge.exe 87 PID 3540 wrote to memory of 464 3540 msedge.exe 87 PID 3540 wrote to memory of 464 3540 msedge.exe 87 PID 3540 wrote to memory of 464 3540 msedge.exe 87 PID 3540 wrote to memory of 464 3540 msedge.exe 87 PID 3540 wrote to memory of 464 3540 msedge.exe 87 PID 3540 wrote to memory of 464 3540 msedge.exe 87 PID 3540 wrote to memory of 464 3540 msedge.exe 87 PID 3540 wrote to memory of 464 3540 msedge.exe 87 PID 3540 wrote to memory of 464 3540 msedge.exe 87 PID 3540 wrote to memory of 464 3540 msedge.exe 87 PID 3540 wrote to memory of 464 3540 msedge.exe 87 PID 3540 wrote to memory of 464 3540 msedge.exe 87 PID 3540 wrote to memory of 464 3540 msedge.exe 87 PID 3540 wrote to memory of 464 3540 msedge.exe 87 PID 3540 wrote to memory of 464 3540 msedge.exe 87 PID 3540 wrote to memory of 464 3540 msedge.exe 87 PID 3540 wrote to memory of 464 3540 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6723dcda964e36538f52bcc4f27b0d7c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd16f946f8,0x7ffd16f94708,0x7ffd16f947182⤵PID:4612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,4926379616345220797,16662127205813661777,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:22⤵PID:3524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,4926379616345220797,16662127205813661777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,4926379616345220797,16662127205813661777,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:82⤵PID:464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4926379616345220797,16662127205813661777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:2108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4926379616345220797,16662127205813661777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:2220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4926379616345220797,16662127205813661777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:12⤵PID:4140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4926379616345220797,16662127205813661777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:12⤵PID:3568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4926379616345220797,16662127205813661777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:12⤵PID:3856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,4926379616345220797,16662127205813661777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:82⤵PID:2972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,4926379616345220797,16662127205813661777,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4926379616345220797,16662127205813661777,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:12⤵PID:3728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4926379616345220797,16662127205813661777,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:12⤵PID:436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,4926379616345220797,16662127205813661777,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1304 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2448
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1888
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4588
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5584971c8ba88c824fd51a05dddb45a98
SHA1b7c9489b4427652a9cdd754d1c1b6ac4034be421
SHA256e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307
SHA5125dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726
-
Filesize
152B
MD5b28ef7d9f6d74f055cc49876767c886c
SHA1d6b3267f36c340979f8fc3e012fdd02c468740bf
SHA256fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37
SHA512491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75
-
Filesize
308B
MD513f0344e60c04aa113974a9ef3b02caa
SHA176f1c1280a3f8f3c139d34ee44b7863891e3025b
SHA2566b901e952e3891a3842b7a57508311462d50ce84e54aed65259cb4119bfd8e9f
SHA512feae5c1072442aaed10cabe89c686bb6e068128c2b18512ba646eaa5a91ebaa6cd61c878cb0afd42fec78e786d0919ab2131e6e8c93343f180401dbefe632cce
-
Filesize
5KB
MD5f0296b23e3a00e14616995808460e27e
SHA1c8d8e41f9572dc6ee5602701e6152e259f10cca0
SHA2565b6a716984ac1eb1c184742b43bc16ea420738e6e803a27a78231e216dad4707
SHA512928b44dcaa22092ca8882abc32e306445052f314540f44d74cb540355b389e6b0b425eb4b30122cee672fe01dfa21d1ebc2f21d92a24580790f45cb8a4300e3c
-
Filesize
6KB
MD5371066844a7c85ba1ee0c00c7f2a9c62
SHA1dd0bea51982bf8f2298f64dce435cb497c96b0b1
SHA25682de40274b75714ebabe4b7de9419333e25a3921877eccac2886142b9ce62291
SHA512f22cef53fc38d60f7e76c6bb0ab717630b70f56346e5f80322846a701da148d6ab0b8ee3dde6d70ed002f9539d0eae35a8207246b4d98030db48ea9e6b55f598
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD537a16ab45e6b888c679a3dadf2202d4d
SHA16e31fc183df62121ca2eaf091f30ce9f09770dce
SHA256a2d72519b3601a971eeb4eae78a871b15c952b9239224687d3e89ccfcdabcf66
SHA5125ccf3ec70fe5ac31dc734ac8cdae9215a1f4fbb34c48f345ddbf7aa7a9585a40a5cd28766f1f77254de922910575eec8c63770487561efaa24f12f4c7a85a77c