Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 01:34
Static task
static1
Behavioral task
behavioral1
Sample
03e7d68c3c2e905783d8df76827b9b30_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
03e7d68c3c2e905783d8df76827b9b30_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
03e7d68c3c2e905783d8df76827b9b30_JaffaCakes118.html
-
Size
26KB
-
MD5
03e7d68c3c2e905783d8df76827b9b30
-
SHA1
cb809595a4067c0453f8299cf3199e956cf7be48
-
SHA256
1f7c1f086ddcfccf419f48ebe6f24044c4803c5be6707f5b0759f03ced378376
-
SHA512
a7b89f500e38b2d029dcd0fd48414b730cfc252e42dfd8b01a45f4f811ce66c80228b2803615c5e8b4e7a131db995076bdd5ee3d7e019e058dd428c168d5ab34
-
SSDEEP
768:SwytDYRjBt32ZkuGybdeegwIrsu8I8F7bcxpcbcPFPu:SwytDYjBt32ZnGybdeezIrsu8I8F7bcU
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 748 msedge.exe 748 msedge.exe 4760 msedge.exe 4760 msedge.exe 4928 identity_helper.exe 4928 identity_helper.exe 2692 msedge.exe 2692 msedge.exe 2692 msedge.exe 2692 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe 4760 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4760 wrote to memory of 380 4760 msedge.exe 82 PID 4760 wrote to memory of 380 4760 msedge.exe 82 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 4632 4760 msedge.exe 83 PID 4760 wrote to memory of 748 4760 msedge.exe 84 PID 4760 wrote to memory of 748 4760 msedge.exe 84 PID 4760 wrote to memory of 1000 4760 msedge.exe 85 PID 4760 wrote to memory of 1000 4760 msedge.exe 85 PID 4760 wrote to memory of 1000 4760 msedge.exe 85 PID 4760 wrote to memory of 1000 4760 msedge.exe 85 PID 4760 wrote to memory of 1000 4760 msedge.exe 85 PID 4760 wrote to memory of 1000 4760 msedge.exe 85 PID 4760 wrote to memory of 1000 4760 msedge.exe 85 PID 4760 wrote to memory of 1000 4760 msedge.exe 85 PID 4760 wrote to memory of 1000 4760 msedge.exe 85 PID 4760 wrote to memory of 1000 4760 msedge.exe 85 PID 4760 wrote to memory of 1000 4760 msedge.exe 85 PID 4760 wrote to memory of 1000 4760 msedge.exe 85 PID 4760 wrote to memory of 1000 4760 msedge.exe 85 PID 4760 wrote to memory of 1000 4760 msedge.exe 85 PID 4760 wrote to memory of 1000 4760 msedge.exe 85 PID 4760 wrote to memory of 1000 4760 msedge.exe 85 PID 4760 wrote to memory of 1000 4760 msedge.exe 85 PID 4760 wrote to memory of 1000 4760 msedge.exe 85 PID 4760 wrote to memory of 1000 4760 msedge.exe 85 PID 4760 wrote to memory of 1000 4760 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\03e7d68c3c2e905783d8df76827b9b30_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbda5446f8,0x7ffbda544708,0x7ffbda5447182⤵PID:380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7950603478134117826,7556655836871524673,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:22⤵PID:4632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,7950603478134117826,7556655836871524673,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,7950603478134117826,7556655836871524673,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:82⤵PID:1000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7950603478134117826,7556655836871524673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:1528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7950603478134117826,7556655836871524673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:2980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7950603478134117826,7556655836871524673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:12⤵PID:3236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7950603478134117826,7556655836871524673,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:12⤵PID:3880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,7950603478134117826,7556655836871524673,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:82⤵PID:2380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,7950603478134117826,7556655836871524673,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5548 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7950603478134117826,7556655836871524673,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:12⤵PID:4680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7950603478134117826,7556655836871524673,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:12⤵PID:4788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7950603478134117826,7556655836871524673,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4156 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2692
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3652
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1608
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d4829218222c8bedb9ffe89dffd37095
SHA1aae577f33f413ec3d09f2e7ff5d9cc20a602241c
SHA25649239b229a2519583ba5d6de3702480b8a8ebf3cfaa8945100dbab25fcb02b7b
SHA51203e26a2e3de41b8a829b5543da504c7d7ccdc4c112d629efcac24dcda23acb50a52b5b99572b5efb2a01cf392a457cf9fac85663b3d63f7606be00dba218f8f1
-
Filesize
152B
MD515e9c4b4eefb3e1c08a010e748e10f58
SHA13172378f2c7a00553ce086dbf53fcf3126c5a724
SHA25607b56a769467e8b57f9b7acd9d32da266ca5000803758c18bb6818ac236c7000
SHA512811058b539e914a812c88543bb6657de736f691d18d6dadb5e1f6ced286780fb334dc5f575babbcf4fd2dceda30d1bf4004b374c5775e7f278346b100b29eb7e
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
5KB
MD569ca4b5d8a0aea4da7b7d3df66abb8fb
SHA18990a0001fceeea033f94e5a9d3ea735a56cfba0
SHA256467fbdcb92eea7b390958c55e5f3054ede45a3cac700cfe0da2140e34bd45ead
SHA512733e1c8aa19e61c5da027fde338d5f8e3a9e37c6195bfbca20ab3c1500ff8436b191aa8af8d2f5240cff45e174dbd627122b2c869c3b560f25b2722c868d30e8
-
Filesize
5KB
MD56d60c0b518cbbcf93f21190b6b450685
SHA121716d3b0ed386051f43df92403537e1e202dfad
SHA25636a7d90e807c87dc15f5abf5e5893e1c9c7a8fab62648230adf97d8f091a1510
SHA512b2013b48cd1bda50741e176eee528a37cf5bb5e52e613fa92ad56187e5d25f48b54a3634f4079b688d649e89e9aea4eb3fe7d7298120990350ed73323dc7de62
-
Filesize
24KB
MD57915ba0545666aa5833cf9f9f86d45d6
SHA1743ecc319bc2a54973582d4a5198042a48fbe8db
SHA256f8fcc045da13bde0f5dec3ada86342105cbff34ebc2442bcf51e8ed509a95b20
SHA512a53036251a22cdc95579ea8641c5574f1dc1f7dfd0390f00ebeafbbea0c1a2c0c3e6dba23bbbb8d8e2c77a3e1e816ccfaf84a97da1c334019c8df1414999d1f9
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5a239759ef5e5b2692e6d86b7bab812e2
SHA1a03f74f69b25d59d351c1b343af7f166c4824257
SHA25652aa5e593d1056d7283ad15923dc8f710ac52af433c725d67cfc80e5f0c82a04
SHA5125b1bdc754c100a18002e6a39efd1dc81e0691a31f96ce4c5dee635bceff7fc39a0f125b03587a019019723976ee81ddbcd2190e1de610f8a77d09698eea3ef94