Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240708-en -
resource tags
arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2024, 20:55
Static task
static1
Behavioral task
behavioral1
Sample
2dc46dc4ee6f64d23bf2197ef045f6c1_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2dc46dc4ee6f64d23bf2197ef045f6c1_JaffaCakes118.html
Resource
win10v2004-20240708-en
General
-
Target
2dc46dc4ee6f64d23bf2197ef045f6c1_JaffaCakes118.html
-
Size
11KB
-
MD5
2dc46dc4ee6f64d23bf2197ef045f6c1
-
SHA1
9f00c4d53b2d31406757107269f89f67d3325186
-
SHA256
5fbcf8686a5128475eb83101460ecf27139d29d913bc6033936dd4162e1ca216
-
SHA512
2d3d28f09a07b402c1cd22c97977190ccfa0a1013eaae9a75b783d27ad97758cbc8fd4d08b70b16cc7dabc24a2bb0f0c9742158608b080b5d458054073a6db24
-
SSDEEP
96:uzVs+ux7QHDLLY1k9o84d12ef7CSTU3wj3OlpKIoB9bRcEZ7ru7f:csz7QHDAYS/uBQzb76f
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2608 msedge.exe 2608 msedge.exe 620 msedge.exe 620 msedge.exe 3736 identity_helper.exe 3736 identity_helper.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe 540 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe 620 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 620 wrote to memory of 2136 620 msedge.exe 81 PID 620 wrote to memory of 2136 620 msedge.exe 81 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 3584 620 msedge.exe 83 PID 620 wrote to memory of 2608 620 msedge.exe 84 PID 620 wrote to memory of 2608 620 msedge.exe 84 PID 620 wrote to memory of 4732 620 msedge.exe 85 PID 620 wrote to memory of 4732 620 msedge.exe 85 PID 620 wrote to memory of 4732 620 msedge.exe 85 PID 620 wrote to memory of 4732 620 msedge.exe 85 PID 620 wrote to memory of 4732 620 msedge.exe 85 PID 620 wrote to memory of 4732 620 msedge.exe 85 PID 620 wrote to memory of 4732 620 msedge.exe 85 PID 620 wrote to memory of 4732 620 msedge.exe 85 PID 620 wrote to memory of 4732 620 msedge.exe 85 PID 620 wrote to memory of 4732 620 msedge.exe 85 PID 620 wrote to memory of 4732 620 msedge.exe 85 PID 620 wrote to memory of 4732 620 msedge.exe 85 PID 620 wrote to memory of 4732 620 msedge.exe 85 PID 620 wrote to memory of 4732 620 msedge.exe 85 PID 620 wrote to memory of 4732 620 msedge.exe 85 PID 620 wrote to memory of 4732 620 msedge.exe 85 PID 620 wrote to memory of 4732 620 msedge.exe 85 PID 620 wrote to memory of 4732 620 msedge.exe 85 PID 620 wrote to memory of 4732 620 msedge.exe 85 PID 620 wrote to memory of 4732 620 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2dc46dc4ee6f64d23bf2197ef045f6c1_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8319546f8,0x7ff831954708,0x7ff8319547182⤵PID:2136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,2958199745619722369,5747823377061761763,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵PID:3584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,2958199745619722369,5747823377061761763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,2958199745619722369,5747823377061761763,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:82⤵PID:4732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2958199745619722369,5747823377061761763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2156 /prefetch:12⤵PID:4108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2958199745619722369,5747823377061761763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,2958199745619722369,5747823377061761763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:82⤵PID:1940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,2958199745619722369,5747823377061761763,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2958199745619722369,5747823377061761763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:12⤵PID:3564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2958199745619722369,5747823377061761763,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:12⤵PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2958199745619722369,5747823377061761763,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:12⤵PID:1008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,2958199745619722369,5747823377061761763,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:12⤵PID:3896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,2958199745619722369,5747823377061761763,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:540
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4992
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4252
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD597f8be9c465b0ed67c2415868506c354
SHA1cdb221d6debcf55615d3b5f30796e32065046dd9
SHA256b606a1ee10b65eb9077e7d2f3b34a0d7a1ed6a4802a169fe55449c975332ee02
SHA512a0fe0ed30624658127316873137f4fc488a5916005e5e3f1f55b7d6442b54010c08d7037b94d0cf3c3316b1bb4acf91bad9e64ee6d15302e3cdd62bb18730542
-
Filesize
152B
MD56ae84fc1e66cbbb7e9d28b0e12d64550
SHA1100430bb653c896c11b94ac0bf2297a389ea5ad8
SHA256856a9c0ac8c29f738a3501b6bd007fd8cbbac211e461b91f4caff52dd41da75c
SHA5127fe7a8639d96118b843e67a6a6d397271b181dc6b049e6f7de77bee9c9214690b1b7f73164f7e463e117406dc978334ea02397fd639140598f60f89c6aaddbe8
-
Filesize
5KB
MD58ff1d29d949702806077103f2866f9e1
SHA1ce1a5639752ba592a3ef12fb7e52dfdd8b1185ef
SHA256eddcda5f51e16dcbd167655d7c02086a5846e35be43ebb39dbe083de0d78d8a9
SHA512a1c92115c69f5a077544c5015f3d0bdefade305ebe0daf417a45b47fa643e52d49f4458a81c2985029513f3291d849f71bee545e6d0465f6b8d0644e9bfd4cc3
-
Filesize
6KB
MD5ed8df54bd998c59987a4a2836b83bc6d
SHA1b1028f822e97e063f5109a458d912759ee030b62
SHA25695934be23c79e94dfb5917e2bbebd303bff99761da6d8f98b88d738e2017d02c
SHA51256b4ad3a87972299c738688ca3ccf0e37b9e34f98f813061be1dbd1cba5b841602ee54387f044b56d10c66051845c14f53403224e22254521e046979ca335fe9
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD5ca25be9406f75535d6844e618b260249
SHA1c39a89294260738d445b87907a98df13e7f40e1f
SHA25628a353aaebcdd7d197c27cf2abbb329b22bdcd828d1aeb0433692605e9cbd3e3
SHA512ca138f874531c1d1de9fd49863c71f04607996a1bd899b27bcb41b202f4548a399efc10e714c7c64a6c0da2c7ca927d1e02b066ccaa937189831854a7de4138c