Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 20:48
Static task
static1
Behavioral task
behavioral1
Sample
2dbfbc891444a26907c029f9415895e6_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2dbfbc891444a26907c029f9415895e6_JaffaCakes118.html
Resource
win10v2004-20240704-en
General
-
Target
2dbfbc891444a26907c029f9415895e6_JaffaCakes118.html
-
Size
1KB
-
MD5
2dbfbc891444a26907c029f9415895e6
-
SHA1
f1781646cf13038b1fce1720bc77ce42dd5e5f1a
-
SHA256
2c9c6656e1d266b2b05afaaf054072598a3dbc5da2f494d44bf19c3b804968da
-
SHA512
e5b7d348d3e4bc77bf61f7c34cbe3db8fb4b9cfcce64c6f5c40be4385556857150e4982299338ada7f3df89bd704ad396767c8f1429c4ac06e44eae3b7d620ea
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4652 msedge.exe 4652 msedge.exe 2136 msedge.exe 2136 msedge.exe 1800 identity_helper.exe 1800 identity_helper.exe 2056 msedge.exe 2056 msedge.exe 2056 msedge.exe 2056 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe 2136 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2136 wrote to memory of 4784 2136 msedge.exe 82 PID 2136 wrote to memory of 4784 2136 msedge.exe 82 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 3328 2136 msedge.exe 83 PID 2136 wrote to memory of 4652 2136 msedge.exe 84 PID 2136 wrote to memory of 4652 2136 msedge.exe 84 PID 2136 wrote to memory of 5056 2136 msedge.exe 85 PID 2136 wrote to memory of 5056 2136 msedge.exe 85 PID 2136 wrote to memory of 5056 2136 msedge.exe 85 PID 2136 wrote to memory of 5056 2136 msedge.exe 85 PID 2136 wrote to memory of 5056 2136 msedge.exe 85 PID 2136 wrote to memory of 5056 2136 msedge.exe 85 PID 2136 wrote to memory of 5056 2136 msedge.exe 85 PID 2136 wrote to memory of 5056 2136 msedge.exe 85 PID 2136 wrote to memory of 5056 2136 msedge.exe 85 PID 2136 wrote to memory of 5056 2136 msedge.exe 85 PID 2136 wrote to memory of 5056 2136 msedge.exe 85 PID 2136 wrote to memory of 5056 2136 msedge.exe 85 PID 2136 wrote to memory of 5056 2136 msedge.exe 85 PID 2136 wrote to memory of 5056 2136 msedge.exe 85 PID 2136 wrote to memory of 5056 2136 msedge.exe 85 PID 2136 wrote to memory of 5056 2136 msedge.exe 85 PID 2136 wrote to memory of 5056 2136 msedge.exe 85 PID 2136 wrote to memory of 5056 2136 msedge.exe 85 PID 2136 wrote to memory of 5056 2136 msedge.exe 85 PID 2136 wrote to memory of 5056 2136 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2dbfbc891444a26907c029f9415895e6_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde6a246f8,0x7ffde6a24708,0x7ffde6a247182⤵PID:4784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,8912601419469681131,14452665908778125227,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:22⤵PID:3328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,8912601419469681131,14452665908778125227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,8912601419469681131,14452665908778125227,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:82⤵PID:5056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,8912601419469681131,14452665908778125227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:4884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,8912601419469681131,14452665908778125227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:2588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,8912601419469681131,14452665908778125227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:12⤵PID:2412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,8912601419469681131,14452665908778125227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:82⤵PID:3632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,8912601419469681131,14452665908778125227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,8912601419469681131,14452665908778125227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:12⤵PID:3200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,8912601419469681131,14452665908778125227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:12⤵PID:740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,8912601419469681131,14452665908778125227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:12⤵PID:624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,8912601419469681131,14452665908778125227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:12⤵PID:448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,8912601419469681131,14452665908778125227,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2056
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3188
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5de1d175f3af722d1feb1c205f4e92d1e
SHA1019cf8527a9b94bd0b35418bf7be8348be5a1c39
SHA2561b99cae942ebf99c31795fa279d51b1a2379ca0af7b27bd3c58ea6c78a033924
SHA512f0dcd08afd3c6a761cc1afa2846ec23fb5438d6127ebd535a754498debabd0b1ebd04858d1b98be92faf14b512f982b1f3dcbb702860e96877eb835f763f9734
-
Filesize
152B
MD506b496d28461d5c01fc81bc2be6a9978
SHA136e7a9d9c7a924d5bb448d68038c7fe5e6cbf5aa
SHA256e4a2d1395627095b0fa55e977e527ccb5b71dff3cd2d138df498f50f9f5ab507
SHA5126488a807c978d38d65010583c1e5582548ab8102ebd68ee827e603c9bdfcdbb9f98a488d31414a829409f6edca8bd2eb4aadd4ff31b144de41249fa63a26bc91
-
Filesize
6KB
MD59e3404df10e7a58674d4874e49a5e124
SHA1f7cbfefbf898995a520e1bd0f04f024713b4ebc9
SHA256663d3cb286235a0db04f1638c84bb91c59175302c62d9e6e30fcfd5cf445d973
SHA512fb928baa5098dabaf1c6b5fa83cbf25d83378e0cb0d67bf3a8830414656a1de472bf1a79523dde3d35f93053b5fe0b330f03735adf89d4f6c9839bfc07781af9
-
Filesize
6KB
MD5cc84f02196fc1526bd96924e8879f1a6
SHA15aae2cf24f51f023bc8bb4b15ccc773145295f9d
SHA256e7b418ff403ad3efec5e98f3399de9fee6d68c6cd89381c127ed9e32e48b1a50
SHA5121f350c4a04eca0d70ca46d2f2cc30386ad28d5e67617d508cf9ae2b147391291416660188cffbee90b30440187510a6263d57807a1e6e2676d7272c2d96b2e76
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5106fd99ba3ddb316673c2650533a2423
SHA16b74431f57f6d52741d792b58dcd794c4501d622
SHA256b4e15a166ef786f2df1902a44fdf3e5a72db0276d77574659286bd06029bfbd8
SHA5123d66c82ad265d54f502955dfc7f8fbe45162449c03edd9906f98b1a45ca817873180db6dcb574ca7e5779b5e3f6fdc3252efe8245743853864baf8403d6a406b