Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240708-en -
resource tags
arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 13:18
Static task
static1
Behavioral task
behavioral1
Sample
30889fefcf4e806262d247274dd58f32_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
30889fefcf4e806262d247274dd58f32_JaffaCakes118.html
Resource
win10v2004-20240708-en
General
-
Target
30889fefcf4e806262d247274dd58f32_JaffaCakes118.html
-
Size
22KB
-
MD5
30889fefcf4e806262d247274dd58f32
-
SHA1
fa1b6836efa838093922e25daf28c24df05aa24d
-
SHA256
d31473e3e5403db16d9e4ccc4c0038c283b85227650caf727d830fcf220188c4
-
SHA512
54f98930efb200aa082b4f6889a019f0c2db6c9f2c27149907cdb9d0125c17f1d05c86f3c09a5061054f73da3ed215e51657ba1d65870f2a11df18ffe70b8160
-
SSDEEP
384:KIBkqQJ52sABXOevNb3LYTFkOHzM4K7F1W9zAQ16hy:Kq0J52sSZWkd4KRCt
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1488 msedge.exe 1488 msedge.exe 1592 msedge.exe 1592 msedge.exe 2736 identity_helper.exe 2736 identity_helper.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe 3316 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe 1592 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1592 wrote to memory of 1244 1592 msedge.exe 82 PID 1592 wrote to memory of 1244 1592 msedge.exe 82 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 624 1592 msedge.exe 84 PID 1592 wrote to memory of 1488 1592 msedge.exe 85 PID 1592 wrote to memory of 1488 1592 msedge.exe 85 PID 1592 wrote to memory of 3144 1592 msedge.exe 86 PID 1592 wrote to memory of 3144 1592 msedge.exe 86 PID 1592 wrote to memory of 3144 1592 msedge.exe 86 PID 1592 wrote to memory of 3144 1592 msedge.exe 86 PID 1592 wrote to memory of 3144 1592 msedge.exe 86 PID 1592 wrote to memory of 3144 1592 msedge.exe 86 PID 1592 wrote to memory of 3144 1592 msedge.exe 86 PID 1592 wrote to memory of 3144 1592 msedge.exe 86 PID 1592 wrote to memory of 3144 1592 msedge.exe 86 PID 1592 wrote to memory of 3144 1592 msedge.exe 86 PID 1592 wrote to memory of 3144 1592 msedge.exe 86 PID 1592 wrote to memory of 3144 1592 msedge.exe 86 PID 1592 wrote to memory of 3144 1592 msedge.exe 86 PID 1592 wrote to memory of 3144 1592 msedge.exe 86 PID 1592 wrote to memory of 3144 1592 msedge.exe 86 PID 1592 wrote to memory of 3144 1592 msedge.exe 86 PID 1592 wrote to memory of 3144 1592 msedge.exe 86 PID 1592 wrote to memory of 3144 1592 msedge.exe 86 PID 1592 wrote to memory of 3144 1592 msedge.exe 86 PID 1592 wrote to memory of 3144 1592 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\30889fefcf4e806262d247274dd58f32_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc5ad46f8,0x7ffcc5ad4708,0x7ffcc5ad47182⤵PID:1244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,18312678802457506559,11366225977265726206,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:22⤵PID:624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,18312678802457506559,11366225977265726206,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,18312678802457506559,11366225977265726206,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:82⤵PID:3144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,18312678802457506559,11366225977265726206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:3532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,18312678802457506559,11366225977265726206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:12⤵PID:1532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,18312678802457506559,11366225977265726206,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:82⤵PID:940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,18312678802457506559,11366225977265726206,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,18312678802457506559,11366225977265726206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:12⤵PID:5036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,18312678802457506559,11366225977265726206,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:12⤵PID:1640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,18312678802457506559,11366225977265726206,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:12⤵PID:4060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,18312678802457506559,11366225977265726206,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:12⤵PID:3920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,18312678802457506559,11366225977265726206,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3316
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4868
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1920
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD597f8be9c465b0ed67c2415868506c354
SHA1cdb221d6debcf55615d3b5f30796e32065046dd9
SHA256b606a1ee10b65eb9077e7d2f3b34a0d7a1ed6a4802a169fe55449c975332ee02
SHA512a0fe0ed30624658127316873137f4fc488a5916005e5e3f1f55b7d6442b54010c08d7037b94d0cf3c3316b1bb4acf91bad9e64ee6d15302e3cdd62bb18730542
-
Filesize
152B
MD56ae84fc1e66cbbb7e9d28b0e12d64550
SHA1100430bb653c896c11b94ac0bf2297a389ea5ad8
SHA256856a9c0ac8c29f738a3501b6bd007fd8cbbac211e461b91f4caff52dd41da75c
SHA5127fe7a8639d96118b843e67a6a6d397271b181dc6b049e6f7de77bee9c9214690b1b7f73164f7e463e117406dc978334ea02397fd639140598f60f89c6aaddbe8
-
Filesize
6KB
MD5d0d50305e94f2deeb3fc8592dee44ca5
SHA189be4b13577ae036a184839fc6d99e05195d268d
SHA25668c7ead1245b1e34980e31eda8bcf0f1e3cd46eb316d2922f94dbfd3ab951458
SHA51215cfb9392a069442bd2ed4ef2a13090a0f8a3b6144ad8514661c29e2cf5c6c139a901cc966306bd44dbb71130567cb78d2616abece4dd0ee4a67b513b5981a7e
-
Filesize
6KB
MD578defb2e78bb246bdbb14f935d5958cf
SHA1db48a3e76e66c38cbc5e31c5ad698f3e8aa91ce0
SHA2566798bc39d90b0b72d8d22c680f291c1b6f33f2a5725c9190c7d3a31ceaee1e08
SHA5120ef3a1ece51729f9fafc79703d9666aa830d5833fcee6daa658c0cb1cc3cc03c8ec7fe325652af90811d9a819deefbdc2bb916dc35a80a4c106c8ed551318ed3
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD59459cf70cb16976d8da6d25884ef96fb
SHA17b3feda9a12757c09c222047e8fc59c3873b72ec
SHA25636fd6e780af9903c76122d489ac937c02c9d72b1c8f5028a6298bc82ea6cc688
SHA5122888ee987acb618294c07a196dadae45d5c09c2a722dd3a8de2a41837b3645304de7ddec14f6dc7331eb808e5ede3006e1c90092771628393f4a549371e45e30