Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12/07/2024, 12:19
Static task
static1
Behavioral task
behavioral1
Sample
3d59dfd9c63bd019a44aec74f5f8622d_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3d59dfd9c63bd019a44aec74f5f8622d_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
3d59dfd9c63bd019a44aec74f5f8622d_JaffaCakes118.html
-
Size
15KB
-
MD5
3d59dfd9c63bd019a44aec74f5f8622d
-
SHA1
78f628f9459aff61bb79fa97cba368a313e7cd63
-
SHA256
19d794827e94922d2bdd13663cc159743936cf169baa0b4320a602eab099c7cf
-
SHA512
23bf2300491575b51f5694c1fd3386da28fc5199a991c43e5ca35f1a31cc3980ef1eeab25ea0913cd4d89ab82ccd31febd9d1c4eedf282568b99ec2764e4d583
-
SSDEEP
384:5I/ZdzQ9Ve36SOOkHshaXlyNyI8YZFPHR:+/ZdM9MKSOOlaXEMI8YT5
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 720 msedge.exe 720 msedge.exe 1444 msedge.exe 1444 msedge.exe 2412 identity_helper.exe 2412 identity_helper.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe 1444 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1444 wrote to memory of 4480 1444 msedge.exe 83 PID 1444 wrote to memory of 4480 1444 msedge.exe 83 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 3636 1444 msedge.exe 84 PID 1444 wrote to memory of 720 1444 msedge.exe 85 PID 1444 wrote to memory of 720 1444 msedge.exe 85 PID 1444 wrote to memory of 844 1444 msedge.exe 86 PID 1444 wrote to memory of 844 1444 msedge.exe 86 PID 1444 wrote to memory of 844 1444 msedge.exe 86 PID 1444 wrote to memory of 844 1444 msedge.exe 86 PID 1444 wrote to memory of 844 1444 msedge.exe 86 PID 1444 wrote to memory of 844 1444 msedge.exe 86 PID 1444 wrote to memory of 844 1444 msedge.exe 86 PID 1444 wrote to memory of 844 1444 msedge.exe 86 PID 1444 wrote to memory of 844 1444 msedge.exe 86 PID 1444 wrote to memory of 844 1444 msedge.exe 86 PID 1444 wrote to memory of 844 1444 msedge.exe 86 PID 1444 wrote to memory of 844 1444 msedge.exe 86 PID 1444 wrote to memory of 844 1444 msedge.exe 86 PID 1444 wrote to memory of 844 1444 msedge.exe 86 PID 1444 wrote to memory of 844 1444 msedge.exe 86 PID 1444 wrote to memory of 844 1444 msedge.exe 86 PID 1444 wrote to memory of 844 1444 msedge.exe 86 PID 1444 wrote to memory of 844 1444 msedge.exe 86 PID 1444 wrote to memory of 844 1444 msedge.exe 86 PID 1444 wrote to memory of 844 1444 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3d59dfd9c63bd019a44aec74f5f8622d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba7e146f8,0x7ffba7e14708,0x7ffba7e147182⤵PID:4480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,14519096777403993486,9144082544711335826,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:22⤵PID:3636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,14519096777403993486,9144082544711335826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,14519096777403993486,9144082544711335826,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:82⤵PID:844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14519096777403993486,9144082544711335826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14519096777403993486,9144082544711335826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:3484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,14519096777403993486,9144082544711335826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:82⤵PID:4760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,14519096777403993486,9144082544711335826,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14519096777403993486,9144082544711335826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:12⤵PID:3020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14519096777403993486,9144082544711335826,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:12⤵PID:4424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14519096777403993486,9144082544711335826,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2520 /prefetch:12⤵PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14519096777403993486,9144082544711335826,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:12⤵PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,14519096777403993486,9144082544711335826,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4912 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1052
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1476
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4956
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5eaaad45aced1889a90a8aa4c39f92659
SHA15c0130d9e8d1a64c97924090d9a5258b8a31b83c
SHA2565e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b
SHA5120db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4
-
Filesize
152B
MD53ee50fb26a9d3f096c47ff8696c24321
SHA1a8c83e798d2a8b31fec0820560525e80dfa4fe66
SHA256d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f
SHA512479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5
-
Filesize
6KB
MD57ce4efa03d95582c8c86c6fb0aed4709
SHA1fecd8fbba27c53eb8b1d184e3ad247f879c7c008
SHA25627f80a149fd2ddb14672439bb50188e4a7a40760c33a2f3aebb86579f3cb707b
SHA5121597f1838fd83250698ff3ae51c7da0355c91e56bade8b2a704203fc78cfb88c89e3adf5e93883f522ec2ccb96fda3b4287eb4b7eaa97e5dd0e15fc6c734f0d8
-
Filesize
6KB
MD5cc6081727c03f438957b09c3c199798c
SHA13512fe40c5332f322cd0fdfb736b67058071ff2a
SHA2561b8795e1a83e745cae67e5bbb5dec0c0175ecc7e301f79feeb0eccf44f18cf82
SHA5129f4e4460eef59b0e1a736b4fee3ffdc896ce85fddc05dfb276aef6f04f95e13d66fb9ed542c4fb5e9674bd9c563d25e5526d318b03c4fa2e7bd49e55376396a9
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5032ea2471948cda328536ecad19f32a3
SHA1469a530d19cffe5ca5961bd9f89d59ee65ab5430
SHA2564e8fe612a0dfd266d53828d451382c01df05880bd6646a7ec2723296d605d3ea
SHA512fa3c73b2f4b1b3efced26dafc71f90a60b1fdb30970e9f7a8b1d937721ca2d351223b9a78045e6001eb51e3bae1b88f0395198c9ef440901e23be5261ab684bf