Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 13:03
Static task
static1
Behavioral task
behavioral1
Sample
80d3d1ef1c88e47ceb92bce45364db52_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
80d3d1ef1c88e47ceb92bce45364db52_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
80d3d1ef1c88e47ceb92bce45364db52_JaffaCakes118.exe
-
Size
200KB
-
MD5
80d3d1ef1c88e47ceb92bce45364db52
-
SHA1
9bd2e1f0e51bd5b134d32dd1fdfb3dcc36bcd5a3
-
SHA256
24f03f95db73c5543937122461a71a8dc87670b69729d5f7991ac8a00d5a5173
-
SHA512
d46e63a1653dc8c090a348949749589f317f5059411f7351b86944c41dc321261d1dab8079c083ad7f5ca83f0322618b0e8c7720dde109fb253aad2078d8d2cf
-
SSDEEP
6144:Sz+92mhAMJ/cPl3iwTaozlx/LVXHSPF0Mfi:SK2mhAMJ/cPllT7VX5
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 80d3d1ef1c88e47ceb92bce45364db52_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1184 wsmallstub.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1184 wsmallstub.exe 1184 wsmallstub.exe 1428 msedge.exe 1428 msedge.exe 3764 msedge.exe 3764 msedge.exe 2540 identity_helper.exe 2540 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe 3764 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1184 wsmallstub.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4572 wrote to memory of 1184 4572 80d3d1ef1c88e47ceb92bce45364db52_JaffaCakes118.exe 82 PID 4572 wrote to memory of 1184 4572 80d3d1ef1c88e47ceb92bce45364db52_JaffaCakes118.exe 82 PID 4572 wrote to memory of 1184 4572 80d3d1ef1c88e47ceb92bce45364db52_JaffaCakes118.exe 82 PID 1184 wrote to memory of 3764 1184 wsmallstub.exe 98 PID 1184 wrote to memory of 3764 1184 wsmallstub.exe 98 PID 3764 wrote to memory of 1588 3764 msedge.exe 99 PID 3764 wrote to memory of 1588 3764 msedge.exe 99 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1748 3764 msedge.exe 100 PID 3764 wrote to memory of 1428 3764 msedge.exe 101 PID 3764 wrote to memory of 1428 3764 msedge.exe 101 PID 3764 wrote to memory of 3148 3764 msedge.exe 102 PID 3764 wrote to memory of 3148 3764 msedge.exe 102 PID 3764 wrote to memory of 3148 3764 msedge.exe 102 PID 3764 wrote to memory of 3148 3764 msedge.exe 102 PID 3764 wrote to memory of 3148 3764 msedge.exe 102 PID 3764 wrote to memory of 3148 3764 msedge.exe 102 PID 3764 wrote to memory of 3148 3764 msedge.exe 102 PID 3764 wrote to memory of 3148 3764 msedge.exe 102 PID 3764 wrote to memory of 3148 3764 msedge.exe 102 PID 3764 wrote to memory of 3148 3764 msedge.exe 102 PID 3764 wrote to memory of 3148 3764 msedge.exe 102 PID 3764 wrote to memory of 3148 3764 msedge.exe 102 PID 3764 wrote to memory of 3148 3764 msedge.exe 102 PID 3764 wrote to memory of 3148 3764 msedge.exe 102 PID 3764 wrote to memory of 3148 3764 msedge.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\80d3d1ef1c88e47ceb92bce45364db52_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\80d3d1ef1c88e47ceb92bce45364db52_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\wsmallstub.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\wsmallstub.exe" "C:\Users\Admin\AppData\Local\Temp\80d3d1ef1c88e47ceb92bce45364db52_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ct246728.ourtoolbar.com/ie/?IsOrganic=true&RequesterId=DMStub3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8edc746f8,0x7ff8edc74708,0x7ff8edc747184⤵PID:1588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,1487672033239875297,9133420051407544507,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:24⤵PID:1748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1952,1487672033239875297,9133420051407544507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:1428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1952,1487672033239875297,9133420051407544507,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:84⤵PID:3148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,1487672033239875297,9133420051407544507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:14⤵PID:4392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,1487672033239875297,9133420051407544507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:14⤵PID:1336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,1487672033239875297,9133420051407544507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:84⤵PID:3712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,1487672033239875297,9133420051407544507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:2540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,1487672033239875297,9133420051407544507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:14⤵PID:1848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,1487672033239875297,9133420051407544507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:14⤵PID:1332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,1487672033239875297,9133420051407544507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:14⤵PID:3828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,1487672033239875297,9133420051407544507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:14⤵PID:4432
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2536
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD598fbbff6a6a1a2d390718aabf20657de
SHA1d15eb780caa6de7ba9324198f50cf145b5f35f3f
SHA2564ec3f3854472c3edf57658862170f8140badbc283cc7f2a3c040b3970ffa64e1
SHA51289e6142ea7dd885cf803e78b32af111991f7460838502c86d40979cff3e23b409ce98fea8fbefa3dd7cee2bbdcf2ca12d1f06bc8edb8eaca41eb33351ac59d7b
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize120B
MD5b1fd5648cff0caa5b307844f71c0ae00
SHA13ba1541fe8d0a2edbc21152fe5b07f3ae03ab578
SHA256e0b5af8ef7edcc667aa5bc45a4a7db7dca1a723a65d10607de70d23b979d3acf
SHA512314b5167e526c166a5bc55b3aa9c370bd2bc8d646a8a567b0aa1ef6d632acef4c1a72f0992dd549d867f0dafb59af4a347f9557e77d41f3ab1167c5eae255aca
-
Filesize
638B
MD5255a7f2eeeafbe3be7bcf49ce25482ae
SHA1c87c1b7de14a9aed1fb2f77dbed993cc5d9456c2
SHA2561ab2d5bad01c88651319a50b396c75cc7d46b5d8d06570a455315b31c227df37
SHA512d617fbbae58a32c43c0949a5238c3e5a82a53d487e959acda22275b8785c02f195208f2554655d09fa78729ecae9f00b4261529a356f4020827a76dceef4a9c3
-
Filesize
5KB
MD59bb94af235f333b416e1bfda359ed432
SHA1ff619940917fec3620ea54602ccfa877a3baf1f5
SHA2569e09fc59dad4f92dff9703d46ae3bd1c7d7ef3eef6869908175ebda7f47e4f27
SHA5127d1390543e61c648406045a1c93abfd9f1471e6ebf98cae584d6006b5b1df7491610694dbc711738281fb262f307119a83636c292f5b12490f3b275c02709bdf
-
Filesize
6KB
MD5c21c81c7be21cdcda862fa27d4cb784f
SHA119ea97560b278f615127fb9826a60570309c6989
SHA2562dca0acbd48badd811c8e578be1a16df356cc922c69a72c18924c47144ae393c
SHA5122a34729aa0c006bdf69e305985bd9d28932e9f7f7390ac48f8c3b6cb83c2ba5acd72364d2bbb6ffd50bde21f5f784c0ebfd52b0e797f97b0baa29d9e10239718
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
1KB
MD5f31ab27282cf444ef1f263320be6b705
SHA1bde4d76ffc88d14e1128b4928ddd4639a7744b84
SHA2561a3ec42f393635307ae2e369ef50a8eb0fbbe02cd2f82c4c6d3486d294ddcceb
SHA512f6b803b087444de0cc6fa832c4be491c738c0d643895d844a861357e2b29257fe7ba91f2e4e61ee715a5b533b0449c14428f79ec651f3cfa3823eaaaa99ca367
-
Filesize
3KB
MD5a5ac78bfd8368777da3adc467c521a08
SHA1cddb90665bfdee156dd4993680ef18f511aee9a5
SHA2566f99bff6e083f2fb83a3ee78acc7c3152c34a59fec0807846dfe7498251c26d8
SHA5122156fa8e601d5dfbf07e1aa550540d7fb753c00b614e567297030eb40361b85575c5a73403b02fe7ddbc28118a250ad9984732bef2588eeac6951c3896d9a98d
-
Filesize
238KB
MD5bebe87e70601cbc95c4a6bad2a2e986d
SHA1f9620534bf97ff4ecaadd3afc3808d3abecdac65
SHA256f1fe856f82e455e19d17f09e0b8529993aa540d4231c07065f0c28ecf0f25dd4
SHA512dae6eabf8314529be871d56c4c573cc114309d77a5223f48227d0c13964cd6606efbe413e8b1fdd7624be89fc31be8caa7d299ed2e659f9c4e1982f21e1cffd2