Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13/07/2024, 04:22
Static task
static1
Behavioral task
behavioral1
Sample
402d791a760b691c488a7169a9b94fd4_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
402d791a760b691c488a7169a9b94fd4_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
402d791a760b691c488a7169a9b94fd4_JaffaCakes118.html
-
Size
13KB
-
MD5
402d791a760b691c488a7169a9b94fd4
-
SHA1
7b7a08b227618ab92bc9c6c0edf653dab729b071
-
SHA256
1b25fd023e36d6c66a71f41dcb2ff7a1ac414a77706645b5b36dc9cc306375d6
-
SHA512
236c2746dc871477551183ee338997789cb6b7d14c0ea1e4ab364f15de8d11f2964808bfd2deb546910526b70d658517bf2fc83f103ba7d155ed9a290fcb4c44
-
SSDEEP
192:YYl3Yak/aQFdEaB/1SfqNIHw6TOxvwSi5u7JzhPlDh7MhrEMWeOP1F9lvhVb:JG5jeEuydwvIJzhHMhrELeKl7
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5080 msedge.exe 5080 msedge.exe 1068 msedge.exe 1068 msedge.exe 4016 identity_helper.exe 4016 identity_helper.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe 1068 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1068 wrote to memory of 800 1068 msedge.exe 83 PID 1068 wrote to memory of 800 1068 msedge.exe 83 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5072 1068 msedge.exe 84 PID 1068 wrote to memory of 5080 1068 msedge.exe 85 PID 1068 wrote to memory of 5080 1068 msedge.exe 85 PID 1068 wrote to memory of 3372 1068 msedge.exe 86 PID 1068 wrote to memory of 3372 1068 msedge.exe 86 PID 1068 wrote to memory of 3372 1068 msedge.exe 86 PID 1068 wrote to memory of 3372 1068 msedge.exe 86 PID 1068 wrote to memory of 3372 1068 msedge.exe 86 PID 1068 wrote to memory of 3372 1068 msedge.exe 86 PID 1068 wrote to memory of 3372 1068 msedge.exe 86 PID 1068 wrote to memory of 3372 1068 msedge.exe 86 PID 1068 wrote to memory of 3372 1068 msedge.exe 86 PID 1068 wrote to memory of 3372 1068 msedge.exe 86 PID 1068 wrote to memory of 3372 1068 msedge.exe 86 PID 1068 wrote to memory of 3372 1068 msedge.exe 86 PID 1068 wrote to memory of 3372 1068 msedge.exe 86 PID 1068 wrote to memory of 3372 1068 msedge.exe 86 PID 1068 wrote to memory of 3372 1068 msedge.exe 86 PID 1068 wrote to memory of 3372 1068 msedge.exe 86 PID 1068 wrote to memory of 3372 1068 msedge.exe 86 PID 1068 wrote to memory of 3372 1068 msedge.exe 86 PID 1068 wrote to memory of 3372 1068 msedge.exe 86 PID 1068 wrote to memory of 3372 1068 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\402d791a760b691c488a7169a9b94fd4_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae4c846f8,0x7ffae4c84708,0x7ffae4c847182⤵PID:800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,925209075065419216,6669020148249015382,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:22⤵PID:5072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,925209075065419216,6669020148249015382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,925209075065419216,6669020148249015382,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:82⤵PID:3372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,925209075065419216,6669020148249015382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,925209075065419216,6669020148249015382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,925209075065419216,6669020148249015382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:12⤵PID:2496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,925209075065419216,6669020148249015382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:12⤵PID:4144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,925209075065419216,6669020148249015382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:82⤵PID:796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,925209075065419216,6669020148249015382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,925209075065419216,6669020148249015382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:12⤵PID:4156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,925209075065419216,6669020148249015382,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:12⤵PID:3888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,925209075065419216,6669020148249015382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:12⤵PID:2004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,925209075065419216,6669020148249015382,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:12⤵PID:4528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,925209075065419216,6669020148249015382,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5176 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2380
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4588
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d406f3135e11b0a0829109c1090a41dc
SHA1810f00e803c17274f9af074fc6c47849ad6e873e
SHA25691f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4
SHA5122b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409
-
Filesize
152B
MD57f37f119665df6beaa925337bbff0e84
SHA1c2601d11f8aa77e12ab3508479cbf20c27cbd865
SHA2561073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027
SHA5128e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817
-
Filesize
263B
MD5d07b49395d854c3c92ca901ded117fbe
SHA19f90663333a6c4cfc94c28b92ec46a2d8a944832
SHA256978e1647855413f3f78a31125d5cbe1ed4fec2eb6d1f310519e745b9de4a2387
SHA51269b65df427e8decfced49100e450e3fa6d47eba0ad37b2d7a117fa8635e7ceb818ca2179110d148b9a81bd1d60df42acff940e33f6464889dea5b5c454c686ea
-
Filesize
6KB
MD58d757c0be9750b31ddbb936e11e387ee
SHA1a1abb75629d8a997e35ec218d7676cd8d89c4a5b
SHA2569b65de27c0641d2cebcce3f3e205a47acde468ebd6b3dc9402f46562d2739206
SHA51264e960446c9bdddb7040e095fc7fec2a4bbe28a68546c1effe9a0c704032d2648a5968b470e99af66ad866a24da1f48000657b8151e574c8cfead4e2180cba44
-
Filesize
6KB
MD52973ad3d6158bba0cc129b0680cc6382
SHA1290bfda980a1b244b829c04866d414adf817124c
SHA256e98ff0b07cc58919aa140a523807b2b89e253e8a8544e881fa9f9c77a780db68
SHA512fab7aefaa08fdc14c8ec57109edeb66c1a05d649aaefdb712fc13ec941bd8418a3b8b2b6ab06ee5484957113543d52a098b2fdbf9ebd0f8b833983600a42b198
-
Filesize
6KB
MD5e775620b51c84b17f40bca96e76bd07d
SHA10288773dae394daf9548669d5d27879061ac1688
SHA256ea45554c1ed4df6153ba8e4e21efe9472733421d0526129f1015060394004e82
SHA5124708c21c3a917fcaa0a95e56ec26d2aef9316579cb1ed763e47fd5ed797ca537371baa899a2cb57b1de3c34960a7420ea371a72579f5d3d93d03949766d39391
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD5dbecc25155d8039caf1c133c2c1223a9
SHA10df4229aeb7ddf720bacc32897d4ddf11d046e8b
SHA2562141dac56b4d88c323b836bb0ee7a9c9ded9a751adc2f8341451cb7f8a67883a
SHA5122ca5fae050afddd8d947cfaed53a4ced66753bc3cd89f7ec6a2bb9a184bbd3ea10c426722f456cfd86df551fd6112970a4d0cee7646658eeb068a2a3929ea310