Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
01/08/2024, 22:58
Static task
static1
Behavioral task
behavioral1
Sample
82106da1ccc03a5323e029db59a0f44c_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
82106da1ccc03a5323e029db59a0f44c_JaffaCakes118.html
Resource
win10v2004-20240730-en
General
-
Target
82106da1ccc03a5323e029db59a0f44c_JaffaCakes118.html
-
Size
53KB
-
MD5
82106da1ccc03a5323e029db59a0f44c
-
SHA1
d22466cded5d1e2a2f34673874eb7044cffb6e3e
-
SHA256
c803b8f45733c25bc30441f9f5aa94580b57d817a789ff7bb91d8b0d683809d8
-
SHA512
5900e2ec395938e41db9b6c7de6f7c518c19a75111f743b634d5cf7fece885fb255ee5a7397c800558a9e3e8474dad964ec15568c2414b1f3df7bdefeab78746
-
SSDEEP
1536:9kgUiIakTqGivi+PyUKrunlYZ63Nj+q5VyvR0w2AzTICbbTo6/t9M/dNwIUTDmDG:9kgUiIakTqGivi+PyUKrunlYZ63Nj+q2
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4528 msedge.exe 4528 msedge.exe 4472 msedge.exe 4472 msedge.exe 3976 identity_helper.exe 3976 identity_helper.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe 1916 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe 4472 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4472 wrote to memory of 1768 4472 msedge.exe 83 PID 4472 wrote to memory of 1768 4472 msedge.exe 83 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 3192 4472 msedge.exe 84 PID 4472 wrote to memory of 4528 4472 msedge.exe 85 PID 4472 wrote to memory of 4528 4472 msedge.exe 85 PID 4472 wrote to memory of 1668 4472 msedge.exe 86 PID 4472 wrote to memory of 1668 4472 msedge.exe 86 PID 4472 wrote to memory of 1668 4472 msedge.exe 86 PID 4472 wrote to memory of 1668 4472 msedge.exe 86 PID 4472 wrote to memory of 1668 4472 msedge.exe 86 PID 4472 wrote to memory of 1668 4472 msedge.exe 86 PID 4472 wrote to memory of 1668 4472 msedge.exe 86 PID 4472 wrote to memory of 1668 4472 msedge.exe 86 PID 4472 wrote to memory of 1668 4472 msedge.exe 86 PID 4472 wrote to memory of 1668 4472 msedge.exe 86 PID 4472 wrote to memory of 1668 4472 msedge.exe 86 PID 4472 wrote to memory of 1668 4472 msedge.exe 86 PID 4472 wrote to memory of 1668 4472 msedge.exe 86 PID 4472 wrote to memory of 1668 4472 msedge.exe 86 PID 4472 wrote to memory of 1668 4472 msedge.exe 86 PID 4472 wrote to memory of 1668 4472 msedge.exe 86 PID 4472 wrote to memory of 1668 4472 msedge.exe 86 PID 4472 wrote to memory of 1668 4472 msedge.exe 86 PID 4472 wrote to memory of 1668 4472 msedge.exe 86 PID 4472 wrote to memory of 1668 4472 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\82106da1ccc03a5323e029db59a0f44c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa612e46f8,0x7ffa612e4708,0x7ffa612e47182⤵PID:1768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,9608619070874185654,17692530408613244336,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:22⤵PID:3192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,9608619070874185654,17692530408613244336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,9608619070874185654,17692530408613244336,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:82⤵PID:1668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9608619070874185654,17692530408613244336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:4696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9608619070874185654,17692530408613244336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:4908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9608619070874185654,17692530408613244336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:12⤵PID:3060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,9608619070874185654,17692530408613244336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:82⤵PID:2760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,9608619070874185654,17692530408613244336,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5280 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9608619070874185654,17692530408613244336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:12⤵PID:1572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9608619070874185654,17692530408613244336,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:12⤵PID:3852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9608619070874185654,17692530408613244336,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:12⤵PID:1996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9608619070874185654,17692530408613244336,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:12⤵PID:3496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,9608619070874185654,17692530408613244336,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5680 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1916
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4524
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3684
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5b55d2d2ff2a4d5d7eeaff5ebb96f3b4a
SHA112d94b9e84142b10d6347a2ff3b634a20f692c7a
SHA2563d249eae36cfc3837b043e4b8df670724fee5657b302c77d488f1da3d835f776
SHA5124dc2fe1eeaca5f9c91d548c70a44ffd12b806a385e22a3c5f724b6f749a15c9ccb3ac1a752c63225bd4d1d90f2b25d8004a15d3912ca6a3cb92fcba91248626f
-
Filesize
152B
MD594c981336abc388ca817dab46e7fc547
SHA12d0f8d89a31adb0aad5c599a195ff40ecf4b161f
SHA2564d44efbb5447fedc3cb21311290fe6a9d0e5a0e682387a1a341bd214df820ef2
SHA512f1c9c98f6642ea3b90c8667a4871d5a3b8c05eb0c50d5dc31e32704e0eeca1d33add414df485aced130523d6be824c48e37d0022b4d58db60006efe3e337fdbc
-
Filesize
403B
MD597c4e12da6b3c66e1789cb9c58dfa03f
SHA13ce0725e24384395454c32d2c7fb5508db2eab5e
SHA25614356dbcc5be27da489f46b8a41908085f605e8549772b4ab80a84b4dad294ce
SHA512433f6db91ec8ada1ef9b694c3b9d46d33d4d9523acbbb7cfb61188a44480929b16147e4342efe0aa6c929ec08b52fda8747fd1172e2f33a79bb034f8adb1475a
-
Filesize
6KB
MD5f8ff5e6c428d5456f7a9024752fbcfd3
SHA1033948155edc180369d47f26862a52a5d220d5f9
SHA2568f470f047e8d57165cb7d860004f7d7244c023efe70590455548c35a7a555566
SHA512a8c5e1e1f2141387f4a168dcff7f8312016ca302d0f27cafa56c7a02aa787b87a0e6d70de72b694e97b2d1cf4d13d3a4765c73e664a5525a01aa5d71e78b0304
-
Filesize
6KB
MD576b9af84739f03f6104938e09cdb8517
SHA1828746790f5724ff2704c4907639704d6ebdd2bc
SHA25626328c0041ed6b44cbedfc0386dc3ae8c3761ccbf88d04027a1f1bb548edeb61
SHA51222d82fa7295529e2feec2f52c8be7c269d7eab3892197390f1883a22ee55b8fcdbd9efc4f49c2f46f703442447ab70daf210caba5b940b4b37c2188492a32a11
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
10KB
MD50a4eec8e52999e0164547ca1d971267a
SHA1f027c7ec5214a93488b039806401041eb13ba1c5
SHA2564122e27623186ab34b7d9fcd1160207de14a29c5cce0d8603cd8f2048f31a842
SHA5125f4c522f649578302c46168fd5dd9957bdf203c5c74fea5286eea38cfa9c31f7b16597b5ef85a57b6d0eb76e0b398b6675d7a9f5e082d736a7fc873fb066e295