Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 00:31
Static task
static1
Behavioral task
behavioral1
Sample
27c6e3b5bc4a27eac76de47bea13caa5_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
27c6e3b5bc4a27eac76de47bea13caa5_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
27c6e3b5bc4a27eac76de47bea13caa5_JaffaCakes118.html
-
Size
53KB
-
MD5
27c6e3b5bc4a27eac76de47bea13caa5
-
SHA1
d3eefb5858e7238423c41b6b31682330c1346a42
-
SHA256
baf1759efaf44edba7632522f01099dfd4397023debaaae229cd22a3bd9f1c0e
-
SHA512
02c80edbea5496de0996cb85443b1950de6603006d3aa7c9b385f7926ec48f0ac38be883a03364650c9d60eb1f5d29fcf04ddae149087fb1357613dbff2ed1e8
-
SSDEEP
1536:CkgUiIakTqGivi+PyUfrunlYQ63Nj+q5Vy0R0w2AzTICbbqoh/t9M/dNwIUTDmDV:CkgUiIakTqGivi+PyUfrunlYQ63Nj+qm
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 876 msedge.exe 876 msedge.exe 3428 msedge.exe 3428 msedge.exe 4792 identity_helper.exe 4792 identity_helper.exe 3508 msedge.exe 3508 msedge.exe 3508 msedge.exe 3508 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe 3428 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3428 wrote to memory of 4468 3428 msedge.exe 84 PID 3428 wrote to memory of 4468 3428 msedge.exe 84 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 1048 3428 msedge.exe 85 PID 3428 wrote to memory of 876 3428 msedge.exe 86 PID 3428 wrote to memory of 876 3428 msedge.exe 86 PID 3428 wrote to memory of 2684 3428 msedge.exe 87 PID 3428 wrote to memory of 2684 3428 msedge.exe 87 PID 3428 wrote to memory of 2684 3428 msedge.exe 87 PID 3428 wrote to memory of 2684 3428 msedge.exe 87 PID 3428 wrote to memory of 2684 3428 msedge.exe 87 PID 3428 wrote to memory of 2684 3428 msedge.exe 87 PID 3428 wrote to memory of 2684 3428 msedge.exe 87 PID 3428 wrote to memory of 2684 3428 msedge.exe 87 PID 3428 wrote to memory of 2684 3428 msedge.exe 87 PID 3428 wrote to memory of 2684 3428 msedge.exe 87 PID 3428 wrote to memory of 2684 3428 msedge.exe 87 PID 3428 wrote to memory of 2684 3428 msedge.exe 87 PID 3428 wrote to memory of 2684 3428 msedge.exe 87 PID 3428 wrote to memory of 2684 3428 msedge.exe 87 PID 3428 wrote to memory of 2684 3428 msedge.exe 87 PID 3428 wrote to memory of 2684 3428 msedge.exe 87 PID 3428 wrote to memory of 2684 3428 msedge.exe 87 PID 3428 wrote to memory of 2684 3428 msedge.exe 87 PID 3428 wrote to memory of 2684 3428 msedge.exe 87 PID 3428 wrote to memory of 2684 3428 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\27c6e3b5bc4a27eac76de47bea13caa5_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff996cd46f8,0x7ff996cd4708,0x7ff996cd47182⤵PID:4468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10255111523104792656,13497258340986236705,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:22⤵PID:1048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,10255111523104792656,13497258340986236705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,10255111523104792656,13497258340986236705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:82⤵PID:2684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10255111523104792656,13497258340986236705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:4932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10255111523104792656,13497258340986236705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:3884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10255111523104792656,13497258340986236705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:12⤵PID:2196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,10255111523104792656,13497258340986236705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:82⤵PID:4532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,10255111523104792656,13497258340986236705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5764 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10255111523104792656,13497258340986236705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:12⤵PID:4292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10255111523104792656,13497258340986236705,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:12⤵PID:4308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10255111523104792656,13497258340986236705,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:12⤵PID:3444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,10255111523104792656,13497258340986236705,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:12⤵PID:3852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,10255111523104792656,13497258340986236705,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3060 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3508
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4312
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2568
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556a4f78e21616a6e19da57228569489b
SHA121bfabbfc294d5f2aa1da825c5590d760483bc76
SHA256d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb
SHA512c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b
-
Filesize
152B
MD5e443ee4336fcf13c698b8ab5f3c173d0
SHA19bf70b16f03820cbe3158e1f1396b07b8ac9d75a
SHA25679e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b
SHA512cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd
-
Filesize
6KB
MD5be95cacea74222fa61c38e8ee679e06e
SHA1aab05778557df88ad3f80abab2742c20c0fa87d8
SHA256837842ed7dff9ad5b8abdb982e08c2062a5ecaaaf1756bb09eac52d7967a0f64
SHA512956abc9229b003f68164f78e5791cc8e5b800130d06b7c252eec830c388f965f6673601a2dd1403ae2b7dd1d1c6f157a1f0e05638a8c4972018309210e13ef4f
-
Filesize
6KB
MD50ce21ce9c8d7510c0f80e51f64d141cd
SHA13a57a133d5753e6fe3c004e9a251aa4672fce590
SHA2564a791beac0ca04749597e4a36a6ac93fca755c89e6df0291f70fddb0a9b1e43a
SHA512180cdfd33155882f82accb055d82758e25966de1f590db393cd173ff0b430825832a3e15a569813d6c9b218e8f30aab66b4ab8a2dd1cdff0b3d3972dde6f270b
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5e737f9f7266ff76528f67640c62ffba1
SHA1361c4c9aab3ff1a5d7697c4fbe215efeee60d284
SHA2564b3514a278ab1a5c842b1f21a358199d3862b0cb5929d1453e31ee9cd622a5a6
SHA512e8b217a74faaf997699a599d42b89a4573608885b81085100213abddde201572c9d51e122d3d9b9a35b694a0c5696691db7e28a753b48c011fc6dc5b290d0389