Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 00:06
Static task
static1
Behavioral task
behavioral1
Sample
71d09c3b95631be6b36d733048317344_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
71d09c3b95631be6b36d733048317344_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
71d09c3b95631be6b36d733048317344_JaffaCakes118.html
-
Size
8KB
-
MD5
71d09c3b95631be6b36d733048317344
-
SHA1
43e959c7e0c43cbcbd20718d2bcfd59d9a099e4c
-
SHA256
263b2790fe23e7ad18e1f7ce4852634f48711525d380d2e86c10ebba1423783b
-
SHA512
a5e0f0c1ff9afe8693d0fe6d0a92c6fd40fd56b72610268f2f8808db04ff03a4049442ef0801dd1fd5f61b8304db67c5673140f2bfa1bd568a4edcc7739ac01d
-
SSDEEP
192:/fNS+9Ib2dk1+qrVWocs3QDroGvQzBoizWJTvQuiOolq:D1qrVWo33yJvWBlgvnBo8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3636 msedge.exe 3636 msedge.exe 3308 msedge.exe 3308 msedge.exe 3480 identity_helper.exe 3480 identity_helper.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe 1004 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3308 wrote to memory of 1152 3308 msedge.exe 84 PID 3308 wrote to memory of 1152 3308 msedge.exe 84 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3068 3308 msedge.exe 85 PID 3308 wrote to memory of 3636 3308 msedge.exe 86 PID 3308 wrote to memory of 3636 3308 msedge.exe 86 PID 3308 wrote to memory of 4516 3308 msedge.exe 87 PID 3308 wrote to memory of 4516 3308 msedge.exe 87 PID 3308 wrote to memory of 4516 3308 msedge.exe 87 PID 3308 wrote to memory of 4516 3308 msedge.exe 87 PID 3308 wrote to memory of 4516 3308 msedge.exe 87 PID 3308 wrote to memory of 4516 3308 msedge.exe 87 PID 3308 wrote to memory of 4516 3308 msedge.exe 87 PID 3308 wrote to memory of 4516 3308 msedge.exe 87 PID 3308 wrote to memory of 4516 3308 msedge.exe 87 PID 3308 wrote to memory of 4516 3308 msedge.exe 87 PID 3308 wrote to memory of 4516 3308 msedge.exe 87 PID 3308 wrote to memory of 4516 3308 msedge.exe 87 PID 3308 wrote to memory of 4516 3308 msedge.exe 87 PID 3308 wrote to memory of 4516 3308 msedge.exe 87 PID 3308 wrote to memory of 4516 3308 msedge.exe 87 PID 3308 wrote to memory of 4516 3308 msedge.exe 87 PID 3308 wrote to memory of 4516 3308 msedge.exe 87 PID 3308 wrote to memory of 4516 3308 msedge.exe 87 PID 3308 wrote to memory of 4516 3308 msedge.exe 87 PID 3308 wrote to memory of 4516 3308 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\71d09c3b95631be6b36d733048317344_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff942d246f8,0x7ff942d24708,0x7ff942d247182⤵PID:1152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7409378663536869304,15746747168264621757,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:3068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,7409378663536869304,15746747168264621757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,7409378663536869304,15746747168264621757,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:82⤵PID:4516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7409378663536869304,15746747168264621757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:3632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7409378663536869304,15746747168264621757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:3004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7409378663536869304,15746747168264621757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:12⤵PID:2544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7409378663536869304,15746747168264621757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:82⤵PID:3488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7409378663536869304,15746747168264621757,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7409378663536869304,15746747168264621757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:12⤵PID:1572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7409378663536869304,15746747168264621757,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:12⤵PID:4304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7409378663536869304,15746747168264621757,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:12⤵PID:3680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7409378663536869304,15746747168264621757,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:12⤵PID:4000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7409378663536869304,15746747168264621757,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5472 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1004
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:368
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52f842025e22e522658c640cfc7edc529
SHA14c2b24b02709acdd159f1b9bbeb396e52af27033
SHA2561191573f2a7c12f0b9b8460e06dc36ca5386305eb8c883ebbbc8eb15f4d8e23e
SHA5126e4393fd43984722229020ef662fc5981f253de31f13f30fadd6660bbc9ededcbfd163f132f6adaf42d435873322a5d0d3eea60060cf0e7f2e256262632c5d05
-
Filesize
152B
MD554aadd2d8ec66e446f1edb466b99ba8d
SHA1a94f02b035dc918d8d9a46e6886413f15be5bff0
SHA2561971045943002ef01930add9ba1a96a92ddc10d6c581ce29e33c38c2120b130e
SHA5127e077f903463da60b5587aed4f5352060df400ebda713b602b88c15cb2f91076531ea07546a9352df772656065e0bf27bd285905a60f036a5c5951076d35e994
-
Filesize
5KB
MD530de940264b547922878be4d47733138
SHA1c3540c229ae4b13142fc3840e634acd32365da34
SHA256408b22d4e38cc4d31ccf9fefd8ab58e8fa963afd2f93fe0f7c72bad71744e3a6
SHA5128ae6a6a320804dfc6300481e6d5900df984c75a2d5743cf8d0679b1a25cacc0797d666f4f78482082a52e045f55907db935b3fc71bcd1c77990018718a4817fa
-
Filesize
6KB
MD51f4766d12c464769c8ce15e4a9ba2a13
SHA1a02b2fcee9bf1a3dba76ad09e9a8639ff8fdd293
SHA2567fdc71d60a1019982933f75813bf9750e241e71d1c8b1985280514fd9bfe983b
SHA5128df56c118e7125bf328b9a5c7a4792d6fad287f3c1096eadc4b94523e2b1ed0269ed29f78761c9be5794b3dff5a129fb63896d086705c27ae646eab6cb67ab9e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5ff037c39144abf8dfcf248205d0da4b0
SHA1a4bfdd3b7f72594847c27d6ad645291d6e2ca62c
SHA2562a54404c6cbcf715792fa0497edf9ba9f68e11d27db9de6ea0591c80136b3b8b
SHA512a6cb6f7fd9ea102138b667de96e525bcf4af4740a5416eba9e838a167006eee2266242e525b65eb685ffd2def51723805847d9d30a94318536efabaebf453323