Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 10:36
Static task
static1
Behavioral task
behavioral1
Sample
2c01877ab5ebce52652b9f670daea89d_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2c01877ab5ebce52652b9f670daea89d_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2c01877ab5ebce52652b9f670daea89d_JaffaCakes118.html
-
Size
6KB
-
MD5
2c01877ab5ebce52652b9f670daea89d
-
SHA1
ef1e27824360de87681c00c042763aa9433260e4
-
SHA256
2d0eb2b21cf245d60fb854eea69f2c96992d3cf94c99fdba8c9ba471aa81f900
-
SHA512
db483413e79d14bb30ffd72d3caa133cda642411a03a666fd937b820ebc39707d4e315d56542ad0f6d39d25eeb5f8695d2ba2c0facce55feffe49277af217a11
-
SSDEEP
96:uzVs+ux7JjLLY1k9o84d12ef7CSTUFtMoRS0ocEZ7ru7f:csz7JjAYS/UMoCb76f
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 460 msedge.exe 460 msedge.exe 2700 msedge.exe 2700 msedge.exe 1816 identity_helper.exe 1816 identity_helper.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe 1652 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe 2700 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2700 wrote to memory of 2208 2700 msedge.exe 82 PID 2700 wrote to memory of 2208 2700 msedge.exe 82 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 2736 2700 msedge.exe 83 PID 2700 wrote to memory of 460 2700 msedge.exe 84 PID 2700 wrote to memory of 460 2700 msedge.exe 84 PID 2700 wrote to memory of 3572 2700 msedge.exe 85 PID 2700 wrote to memory of 3572 2700 msedge.exe 85 PID 2700 wrote to memory of 3572 2700 msedge.exe 85 PID 2700 wrote to memory of 3572 2700 msedge.exe 85 PID 2700 wrote to memory of 3572 2700 msedge.exe 85 PID 2700 wrote to memory of 3572 2700 msedge.exe 85 PID 2700 wrote to memory of 3572 2700 msedge.exe 85 PID 2700 wrote to memory of 3572 2700 msedge.exe 85 PID 2700 wrote to memory of 3572 2700 msedge.exe 85 PID 2700 wrote to memory of 3572 2700 msedge.exe 85 PID 2700 wrote to memory of 3572 2700 msedge.exe 85 PID 2700 wrote to memory of 3572 2700 msedge.exe 85 PID 2700 wrote to memory of 3572 2700 msedge.exe 85 PID 2700 wrote to memory of 3572 2700 msedge.exe 85 PID 2700 wrote to memory of 3572 2700 msedge.exe 85 PID 2700 wrote to memory of 3572 2700 msedge.exe 85 PID 2700 wrote to memory of 3572 2700 msedge.exe 85 PID 2700 wrote to memory of 3572 2700 msedge.exe 85 PID 2700 wrote to memory of 3572 2700 msedge.exe 85 PID 2700 wrote to memory of 3572 2700 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2c01877ab5ebce52652b9f670daea89d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff52a246f8,0x7fff52a24708,0x7fff52a247182⤵PID:2208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,10914763158799181521,10998312229611546692,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:22⤵PID:2736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,10914763158799181521,10998312229611546692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,10914763158799181521,10998312229611546692,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:82⤵PID:3572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10914763158799181521,10998312229611546692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:1836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10914763158799181521,10998312229611546692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,10914763158799181521,10998312229611546692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 /prefetch:82⤵PID:3108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,10914763158799181521,10998312229611546692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10914763158799181521,10998312229611546692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:12⤵PID:1156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10914763158799181521,10998312229611546692,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:12⤵PID:1252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10914763158799181521,10998312229611546692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:12⤵PID:2276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,10914763158799181521,10998312229611546692,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:12⤵PID:2680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,10914763158799181521,10998312229611546692,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1652
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1492
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2512
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e1fe3a26bd35b84102bb4203f31e74c7
SHA145fdfa8433789b575eb64e116718e62e0e0cf4a0
SHA25626e0d51529de906dd285ba48288e25eaf5213c0f0bab9bc5f119ecbc5e1b93ee
SHA512d528db2e9b917d4fbe24b1b5c6f4cb274f4f91c84f63e5119e041fa89ae0cd01a370e314f8b6aca9d6fa958e79feabc720f4b54b3d8aed69aab11fa84cad36bd
-
Filesize
152B
MD52915233ace3b11bc8898c958f245aa9a
SHA168c6aa983da303b825d656ac3284081db682f702
SHA256b2cb442f2ca27619c8df087f56fcbbb53186c53f8fd131af886ee3712220477e
SHA512e3f1b70d39b615e212f84d587ee816598236ee6ce144d919593894fcce4a0900343a9e8b837a0d1bd10921fff1c976c84c4a570eda776fe84d374a69e7a54890
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5962c6eb-ab5e-4524-83c1-81244a43ee2d.tmp
Filesize6KB
MD57aab0033a26b311cef91d344df772144
SHA140dd0148d4964234b98a244d3b938c37ecd02545
SHA256762327fbbea453649fd70ddc6b631e8340f90d5ef21f4aadaa70e0a9db0ff70d
SHA5120023e364150d5fe547fc7a43a8f6db8207f3762a8a0aa6c8e754b4c2d64f1f68704de4f640303bc774cb166a4a93f1118fde3532afa19fe8d5c75a929eaba7b1
-
Filesize
6KB
MD5ef01de80637398e5bcfd34f28542b1e7
SHA18ce310990eb5cf5fd58c9d3b7b4b246fb6f4b906
SHA25640444924b199017224098a8fc1b392d186fe7e366f4b3fe1ff91424555a31501
SHA5122f38e666a3b446fd8394a1f2b3de6e167e8f2627074dc5af0614f4da0753a1328e671ad28197588d89c172468e57595cc39d02c79bfaa70b225951d58d166d2e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD562e449ba1a23e7e696dbff4b7cd40e70
SHA147d189068726b40809ebb85fef12f94ae53f58b6
SHA256ba64a2d70949670687cd4c281009264581f00736b9cc680c7a3239de474ecfe3
SHA5129816171cf77a60467fac48e4b76e3b024a64a101f6c540d93cfc0754a2cb4707bea503fc1592c160106a536c3f36c4668bf01eb6db389aa5c7d33a616a59750b