Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240708-en -
resource tags
arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 09:12
Static task
static1
Behavioral task
behavioral1
Sample
2bc6c4d2352235cfe6e68b28a6d5385b_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2bc6c4d2352235cfe6e68b28a6d5385b_JaffaCakes118.html
Resource
win10v2004-20240708-en
General
-
Target
2bc6c4d2352235cfe6e68b28a6d5385b_JaffaCakes118.html
-
Size
53KB
-
MD5
2bc6c4d2352235cfe6e68b28a6d5385b
-
SHA1
d384b7779d1076785cbeb29f81f171c5bb405b5e
-
SHA256
cf57936f76a9c741f26ca9786c6a4a5be8c5897966855d863bf32d614f266def
-
SHA512
0c82f0b843e7cd7e36e0b78d55de6c380fb6b145eb6f83539235f4d5ab33087c48a1a24a1946e64008ec7e603a5f4cdf9bd01ddc8f2aa22f135af161f274f72d
-
SSDEEP
1536:CkgUiIakTqGivi+PyUprunlY963Nj+q5Vy0R0w2AzTICbbCoe/t9M/dNwIUTDmDl:CkgUiIakTqGivi+PyUprunlY963Nj+q7
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 752 msedge.exe 752 msedge.exe 2092 msedge.exe 2092 msedge.exe 3500 identity_helper.exe 3500 identity_helper.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe 2604 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe 2092 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2092 wrote to memory of 4616 2092 msedge.exe 81 PID 2092 wrote to memory of 4616 2092 msedge.exe 81 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 4092 2092 msedge.exe 82 PID 2092 wrote to memory of 752 2092 msedge.exe 83 PID 2092 wrote to memory of 752 2092 msedge.exe 83 PID 2092 wrote to memory of 3040 2092 msedge.exe 84 PID 2092 wrote to memory of 3040 2092 msedge.exe 84 PID 2092 wrote to memory of 3040 2092 msedge.exe 84 PID 2092 wrote to memory of 3040 2092 msedge.exe 84 PID 2092 wrote to memory of 3040 2092 msedge.exe 84 PID 2092 wrote to memory of 3040 2092 msedge.exe 84 PID 2092 wrote to memory of 3040 2092 msedge.exe 84 PID 2092 wrote to memory of 3040 2092 msedge.exe 84 PID 2092 wrote to memory of 3040 2092 msedge.exe 84 PID 2092 wrote to memory of 3040 2092 msedge.exe 84 PID 2092 wrote to memory of 3040 2092 msedge.exe 84 PID 2092 wrote to memory of 3040 2092 msedge.exe 84 PID 2092 wrote to memory of 3040 2092 msedge.exe 84 PID 2092 wrote to memory of 3040 2092 msedge.exe 84 PID 2092 wrote to memory of 3040 2092 msedge.exe 84 PID 2092 wrote to memory of 3040 2092 msedge.exe 84 PID 2092 wrote to memory of 3040 2092 msedge.exe 84 PID 2092 wrote to memory of 3040 2092 msedge.exe 84 PID 2092 wrote to memory of 3040 2092 msedge.exe 84 PID 2092 wrote to memory of 3040 2092 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2bc6c4d2352235cfe6e68b28a6d5385b_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde77a46f8,0x7ffde77a4708,0x7ffde77a47182⤵PID:4616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9146650166308717098,16740669580973490129,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:4092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,9146650166308717098,16740669580973490129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,9146650166308717098,16740669580973490129,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:82⤵PID:3040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9146650166308717098,16740669580973490129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:1152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9146650166308717098,16740669580973490129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:12⤵PID:2344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9146650166308717098,16740669580973490129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:12⤵PID:3208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,9146650166308717098,16740669580973490129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:82⤵PID:3744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,9146650166308717098,16740669580973490129,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9146650166308717098,16740669580973490129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:12⤵PID:4000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9146650166308717098,16740669580973490129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:12⤵PID:2588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9146650166308717098,16740669580973490129,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:12⤵PID:2964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,9146650166308717098,16740669580973490129,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:12⤵PID:1900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,9146650166308717098,16740669580973490129,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5512 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2604
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2192
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD597f8be9c465b0ed67c2415868506c354
SHA1cdb221d6debcf55615d3b5f30796e32065046dd9
SHA256b606a1ee10b65eb9077e7d2f3b34a0d7a1ed6a4802a169fe55449c975332ee02
SHA512a0fe0ed30624658127316873137f4fc488a5916005e5e3f1f55b7d6442b54010c08d7037b94d0cf3c3316b1bb4acf91bad9e64ee6d15302e3cdd62bb18730542
-
Filesize
152B
MD56ae84fc1e66cbbb7e9d28b0e12d64550
SHA1100430bb653c896c11b94ac0bf2297a389ea5ad8
SHA256856a9c0ac8c29f738a3501b6bd007fd8cbbac211e461b91f4caff52dd41da75c
SHA5127fe7a8639d96118b843e67a6a6d397271b181dc6b049e6f7de77bee9c9214690b1b7f73164f7e463e117406dc978334ea02397fd639140598f60f89c6aaddbe8
-
Filesize
403B
MD5b9afbee6be8a8cad0adc452d8ff810d5
SHA144f7f817fc0c67ec295cc1933fb26e64938f60b6
SHA256ee219dc20cfdc4c340486724fd9d42184de33639c5728d44f5bae5cec0877372
SHA51296a6eedcdfa1af7528038d51adb68feccdedb3250909e3d56aac9446ba4272f55c8af9fa90ce96261d4a2df75d48d8968d050537895b5d68eacef8c173fe2dbd
-
Filesize
6KB
MD5e71b56fcc468b34fbbbd35a061862955
SHA1f5641de5d09a7218729934efdaf9c05d1fe005a3
SHA256429c11a564848d25b18b74852258f9d71a7f3422094291f9bab4d40a41aefb4f
SHA512cbddfb119cbe1f800d54aaba797a0a40f978eef4f37eebf8d5d81d8c8b807be4d95e85d621446c62009b68062b118259bf59b312585c5434427a436ad7214e4d
-
Filesize
6KB
MD5f3f2a671b2a4b59865ba995621203d10
SHA1ab7f22bcc0ee5b5616ee60382ca119c3f93a14c8
SHA256a96f342f957c618fb3a860906891e9726b08c47bb3b133e7185a2647bb5b8821
SHA512c6f496acbecebc975bb751e77c6c830a7350104c25836d17e0c18e455d5d9a1895b0020bb082509f63bf584d5c2380bbf9744d4823a290c405da314ce67af5d5
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5157fb0e5c707ad7ee612762b1c19a5d3
SHA15ae496b6366a1f4ec5e9bda1d8264bde999ca786
SHA256b6602ee9423d98202f232ffae86fbd652d3c86c0e00442b5c99915a7ea69f319
SHA5123c8b046a6223814e15d3b3704ea00f322997521f0717175ab3ffdc9a30d5ef95c212d007feca43b1089728794644a5403f98d9ea3633845ecc442296174dcb4b