Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 15:28
Static task
static1
Behavioral task
behavioral1
Sample
0b5b0ac59ed1bdfcf40954b3f963d6c9_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0b5b0ac59ed1bdfcf40954b3f963d6c9_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
0b5b0ac59ed1bdfcf40954b3f963d6c9_JaffaCakes118.html
-
Size
9KB
-
MD5
0b5b0ac59ed1bdfcf40954b3f963d6c9
-
SHA1
a84c59ad780476e7b1111fca6961865589642ca2
-
SHA256
119e97a237d9500ff9ba066ce0a5da46d1e6f3393008d26ec21e1d1cf1ed81d4
-
SHA512
3fd547f046455400e573b02e67ea7d17dc96002d5564bf8784253d8df2d247ef3a8ada2d7ffcf43327010344f0f5b04cb30d31ced61e0fdfa5a7dfbeed6e5c24
-
SSDEEP
192:2vwzGS2yJmae8YpUu4UsQWzqIBgd261lK0Dtg00NAgHfQS0SZ:I1lNy
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3596 msedge.exe 3596 msedge.exe 4924 msedge.exe 4924 msedge.exe 512 identity_helper.exe 512 identity_helper.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe 1836 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe 4924 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4924 wrote to memory of 5020 4924 msedge.exe 82 PID 4924 wrote to memory of 5020 4924 msedge.exe 82 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 1040 4924 msedge.exe 83 PID 4924 wrote to memory of 3596 4924 msedge.exe 84 PID 4924 wrote to memory of 3596 4924 msedge.exe 84 PID 4924 wrote to memory of 2172 4924 msedge.exe 85 PID 4924 wrote to memory of 2172 4924 msedge.exe 85 PID 4924 wrote to memory of 2172 4924 msedge.exe 85 PID 4924 wrote to memory of 2172 4924 msedge.exe 85 PID 4924 wrote to memory of 2172 4924 msedge.exe 85 PID 4924 wrote to memory of 2172 4924 msedge.exe 85 PID 4924 wrote to memory of 2172 4924 msedge.exe 85 PID 4924 wrote to memory of 2172 4924 msedge.exe 85 PID 4924 wrote to memory of 2172 4924 msedge.exe 85 PID 4924 wrote to memory of 2172 4924 msedge.exe 85 PID 4924 wrote to memory of 2172 4924 msedge.exe 85 PID 4924 wrote to memory of 2172 4924 msedge.exe 85 PID 4924 wrote to memory of 2172 4924 msedge.exe 85 PID 4924 wrote to memory of 2172 4924 msedge.exe 85 PID 4924 wrote to memory of 2172 4924 msedge.exe 85 PID 4924 wrote to memory of 2172 4924 msedge.exe 85 PID 4924 wrote to memory of 2172 4924 msedge.exe 85 PID 4924 wrote to memory of 2172 4924 msedge.exe 85 PID 4924 wrote to memory of 2172 4924 msedge.exe 85 PID 4924 wrote to memory of 2172 4924 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0b5b0ac59ed1bdfcf40954b3f963d6c9_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff849ee46f8,0x7ff849ee4708,0x7ff849ee47182⤵PID:5020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,12118622330506467397,16339976745655417769,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:1040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,12118622330506467397,16339976745655417769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,12118622330506467397,16339976745655417769,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:82⤵PID:2172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12118622330506467397,16339976745655417769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:2796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12118622330506467397,16339976745655417769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,12118622330506467397,16339976745655417769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 /prefetch:82⤵PID:1640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,12118622330506467397,16339976745655417769,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12118622330506467397,16339976745655417769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:12⤵PID:1528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12118622330506467397,16339976745655417769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:12⤵PID:1280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12118622330506467397,16339976745655417769,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:12⤵PID:3036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12118622330506467397,16339976745655417769,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:12⤵PID:264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,12118622330506467397,16339976745655417769,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1876 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1836
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4984
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1372
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5eeaa8087eba2f63f31e599f6a7b46ef4
SHA1f639519deee0766a39cfe258d2ac48e3a9d5ac03
SHA25650fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
SHA512eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
-
Filesize
152B
MD5b9569e123772ae290f9bac07e0d31748
SHA15806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA25620ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
SHA512cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
-
Filesize
5KB
MD5fbd9b7620eaffeb490003335fb93305b
SHA127973caf3e05482ae0d1239bb4f349230ae79018
SHA256b30d90f22cba0983067f9ea3c10c5f04b9ca95cb44c463a60d5a9f5c44b4ddda
SHA5125cb46de87ffa7ed648ebdf6528d3fac6c3469596fc60863e3be5fec34db793a50fad12eb5a665075e5f584532123e594efea1330c67d8c6622c9238dcd47ab66
-
Filesize
6KB
MD544949c02a66efc3b5aeae513369e7623
SHA13395c1481d4c211809d0708a4e5116dc5058ca11
SHA25684f7fc79dd7ac17b180154870633eabe494434bf2b1f67e2644f07adcc3278bd
SHA5122e4a9e266383cf663aad1816731be925526e7c04bdb3c22a07db81d22851fb8c7cff49c682630f94b84f5ec66b4df63e50d10afb8788c8f2e98cccbbef625bd4
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5d06fc25b95017f57744066aafb98cd6e
SHA13987bd6922bda21a83a71d030bf4188258efab19
SHA256f387d7d6d024b9af3206e825b8f3ca9de9eeabc7df6eddbc9a0381c51a95a8ce
SHA51231baf88a231560c6ba1c33515ddc7d3d04930a1bf94d045e4ef19c1b9bdaaa858b5d65c736b8836f9e171bea2d9a0e2116cbbec853e87ba3fde7dcd88cb5f0ce