Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12/07/2024, 21:28
Static task
static1
Behavioral task
behavioral1
Sample
3ef335f78331dba2e5feee7354cb1afc_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3ef335f78331dba2e5feee7354cb1afc_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3ef335f78331dba2e5feee7354cb1afc_JaffaCakes118.html
-
Size
6KB
-
MD5
3ef335f78331dba2e5feee7354cb1afc
-
SHA1
e284149a9db5f171256fcd346ccaf8f7d7c04147
-
SHA256
438a5c436bede9d96b7a551baeed0d4aac411702a000bef2558a39d5723c6587
-
SHA512
83fff6967c8b2109bc882f70ffb32962c56ccb0dc8dad40c74a59ab0a6ea2ff2e7a015e9cb258e80deb07199d4b3a59e29ed841d029e2f4dd0880ed35ab3313d
-
SSDEEP
96:uzVs+ux7ZULLY1k9o84d12ef7CSTUkZcEZ7ru7f:csz7ZUAYS/Xb76f
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2480 msedge.exe 2480 msedge.exe 2880 msedge.exe 2880 msedge.exe 1836 identity_helper.exe 1836 identity_helper.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe 536 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe 2880 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2880 wrote to memory of 3312 2880 msedge.exe 83 PID 2880 wrote to memory of 3312 2880 msedge.exe 83 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2324 2880 msedge.exe 84 PID 2880 wrote to memory of 2480 2880 msedge.exe 85 PID 2880 wrote to memory of 2480 2880 msedge.exe 85 PID 2880 wrote to memory of 3908 2880 msedge.exe 86 PID 2880 wrote to memory of 3908 2880 msedge.exe 86 PID 2880 wrote to memory of 3908 2880 msedge.exe 86 PID 2880 wrote to memory of 3908 2880 msedge.exe 86 PID 2880 wrote to memory of 3908 2880 msedge.exe 86 PID 2880 wrote to memory of 3908 2880 msedge.exe 86 PID 2880 wrote to memory of 3908 2880 msedge.exe 86 PID 2880 wrote to memory of 3908 2880 msedge.exe 86 PID 2880 wrote to memory of 3908 2880 msedge.exe 86 PID 2880 wrote to memory of 3908 2880 msedge.exe 86 PID 2880 wrote to memory of 3908 2880 msedge.exe 86 PID 2880 wrote to memory of 3908 2880 msedge.exe 86 PID 2880 wrote to memory of 3908 2880 msedge.exe 86 PID 2880 wrote to memory of 3908 2880 msedge.exe 86 PID 2880 wrote to memory of 3908 2880 msedge.exe 86 PID 2880 wrote to memory of 3908 2880 msedge.exe 86 PID 2880 wrote to memory of 3908 2880 msedge.exe 86 PID 2880 wrote to memory of 3908 2880 msedge.exe 86 PID 2880 wrote to memory of 3908 2880 msedge.exe 86 PID 2880 wrote to memory of 3908 2880 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3ef335f78331dba2e5feee7354cb1afc_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98a9546f8,0x7ff98a954708,0x7ff98a9547182⤵PID:3312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,1457175939607660540,15240605223270786619,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:2324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,1457175939607660540,15240605223270786619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,1457175939607660540,15240605223270786619,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:82⤵PID:3908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1457175939607660540,15240605223270786619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:2208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1457175939607660540,15240605223270786619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:1340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,1457175939607660540,15240605223270786619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:82⤵PID:4640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,1457175939607660540,15240605223270786619,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1457175939607660540,15240605223270786619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:12⤵PID:4244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1457175939607660540,15240605223270786619,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:12⤵PID:1868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1457175939607660540,15240605223270786619,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:12⤵PID:3276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1457175939607660540,15240605223270786619,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:12⤵PID:1444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,1457175939607660540,15240605223270786619,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5404 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:536
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2004
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5100
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5eaaad45aced1889a90a8aa4c39f92659
SHA15c0130d9e8d1a64c97924090d9a5258b8a31b83c
SHA2565e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b
SHA5120db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4
-
Filesize
152B
MD53ee50fb26a9d3f096c47ff8696c24321
SHA1a8c83e798d2a8b31fec0820560525e80dfa4fe66
SHA256d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f
SHA512479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5
-
Filesize
6KB
MD51dbfea98cdc4d66127ea9d2ecf891e07
SHA10230681d7796140ed89f3388a0e7f31f3b5c6bd1
SHA25662f308b7ac1c6b221fe0c7744d963430554852482b77b6af2c7a725d384fbaa2
SHA512fc5b250c77094516fed48e63ce1830f48401888f348e4f061b384f16828b2780b10763cb34749fe579d9575b1e235ef231b0ad2ab9abbd667dce0eb8f03a8cc6
-
Filesize
6KB
MD5a77920d6d9b30763929922273649bba0
SHA187a02a6a5d3387edd5fae2eab513acc912dd9a7d
SHA25610a7eb93e9bdb2709fedb6ed59e045baf6d26f717800ebb2a37f09cddd37d9f8
SHA512f74172cb6f13477293ac6513910b29ee4b30e3fbcefc09f4daf36aceba83f0a6900b67cf46d2226bb7e8e48fcb3a01290786bfc1ae2010e256dec684de3d4dfb
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD54342c45f67e546483fa84a6b4c8161ab
SHA138613293d50ce95737a44cb116c7674e108e2955
SHA256a36b3be1ce27798ca48fa598d95c66b378eaa779069339db1530dc4cf126301f
SHA51286c6e24ee394164785050cb56dacefa3993f2e6f5b4bcf412b3035df1cc5d63b3ceb6bd6bc74c29df98692394f261aecffeed712907ac5cf4f8c306ff0042a2c