Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 08:54
Static task
static1
Behavioral task
behavioral1
Sample
735f3be28d4edc8d1aabe3932897efb2_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
735f3be28d4edc8d1aabe3932897efb2_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
735f3be28d4edc8d1aabe3932897efb2_JaffaCakes118.html
-
Size
9KB
-
MD5
735f3be28d4edc8d1aabe3932897efb2
-
SHA1
3eced761b99881512d2fdfa735849f60aef619f5
-
SHA256
28945e03f27d352f9a4843d33269ed40735cd435b1fa757a349691b39012089e
-
SHA512
98ca53c3d097c13ac05157379af9ca2dbf30d87482220708fa3ceb42b8eaee0a473816844f9886c2d2af174e92bb6a7027c480393f19814d423c17491eee87b6
-
SSDEEP
96:uzVs+ux7lCLLY1k9o84d12ef7CSTUazfzx57FBcM/Nd/QeuupJxv+yUGyY+eCxYp:csz7lCAYS/wkjYFTXb76f
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1764 msedge.exe 1764 msedge.exe 4700 msedge.exe 4700 msedge.exe 4356 identity_helper.exe 4356 identity_helper.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe 4700 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4700 wrote to memory of 5080 4700 msedge.exe 84 PID 4700 wrote to memory of 5080 4700 msedge.exe 84 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1752 4700 msedge.exe 85 PID 4700 wrote to memory of 1764 4700 msedge.exe 86 PID 4700 wrote to memory of 1764 4700 msedge.exe 86 PID 4700 wrote to memory of 5092 4700 msedge.exe 87 PID 4700 wrote to memory of 5092 4700 msedge.exe 87 PID 4700 wrote to memory of 5092 4700 msedge.exe 87 PID 4700 wrote to memory of 5092 4700 msedge.exe 87 PID 4700 wrote to memory of 5092 4700 msedge.exe 87 PID 4700 wrote to memory of 5092 4700 msedge.exe 87 PID 4700 wrote to memory of 5092 4700 msedge.exe 87 PID 4700 wrote to memory of 5092 4700 msedge.exe 87 PID 4700 wrote to memory of 5092 4700 msedge.exe 87 PID 4700 wrote to memory of 5092 4700 msedge.exe 87 PID 4700 wrote to memory of 5092 4700 msedge.exe 87 PID 4700 wrote to memory of 5092 4700 msedge.exe 87 PID 4700 wrote to memory of 5092 4700 msedge.exe 87 PID 4700 wrote to memory of 5092 4700 msedge.exe 87 PID 4700 wrote to memory of 5092 4700 msedge.exe 87 PID 4700 wrote to memory of 5092 4700 msedge.exe 87 PID 4700 wrote to memory of 5092 4700 msedge.exe 87 PID 4700 wrote to memory of 5092 4700 msedge.exe 87 PID 4700 wrote to memory of 5092 4700 msedge.exe 87 PID 4700 wrote to memory of 5092 4700 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\735f3be28d4edc8d1aabe3932897efb2_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8461446f8,0x7ff846144708,0x7ff8461447182⤵PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,14048565984761910826,16304005500155034542,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵PID:1752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,14048565984761910826,16304005500155034542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,14048565984761910826,16304005500155034542,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:82⤵PID:5092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14048565984761910826,16304005500155034542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:1372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14048565984761910826,16304005500155034542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:1336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,14048565984761910826,16304005500155034542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:82⤵PID:3648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,14048565984761910826,16304005500155034542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14048565984761910826,16304005500155034542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:12⤵PID:1360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14048565984761910826,16304005500155034542,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:12⤵PID:4004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14048565984761910826,16304005500155034542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵PID:776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,14048565984761910826,16304005500155034542,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:3420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,14048565984761910826,16304005500155034542,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4884 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2300
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5004
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD56c86c838cf1dc704d2be375f04e1e6c6
SHA1ad2911a13a3addc86cc46d4329b2b1621cbe7e35
SHA256dff0886331bb45ec7711af92ab10be76291fde729dff23ca3270c86fb6e606bb
SHA512a120248263919c687f09615fed56c7cac825c8c93c104488632cebc1abfa338c39ebdc191e5f0c45ff30f054f08d4c02d12b013de6322490197606ce0c0b4f37
-
Filesize
152B
MD527f3335bf37563e4537db3624ee378da
SHA157543abc3d97c2a2b251b446820894f4b0111aeb
SHA256494425284ba12ee2fb07890e268be7890b258e1b1e5ecfa4a4dbc3411ab93b1a
SHA5122bef861f9d2d916272f6014110fdee84afced515710c9d69b3c310f6bf41728d1b2d41fee3c86441ff96c08c7d474f9326e992b9164b9a3f13627f7d24d0c485
-
Filesize
5KB
MD57db761483f2865f6746d409d02990a5d
SHA173f3fff0b09d29fce94f27d8c472d22f722d52df
SHA2566990ea62a2fa4188918fd6e8d2b92bcbf543367d39f4fa62592b8c2dc317a668
SHA51282758d9404761b4b932489be78c4fb318d60167ab80a00026dd8a8a97afd40dc12d158bbc778676075e534a216340ceb118278c0a52cc01d811a45a5bb2b251e
-
Filesize
6KB
MD527c9934d636294a548038da22249e3cf
SHA1fd7348ceb3a3b7fa670c6994689f10d058d6a4f7
SHA256b250f9c5e977091627d836511e4a76894c940b6a37172f4b8673c21878bdfe82
SHA512716e94abb3cbf113a96163aa6374e7861bcab4e9d080ae917960c21c6a29d74332e34aa66237c70489c8989f35ceb6fb87a1ed9d43fc5e84c8d64b7e9ae87dbe
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5d2e4bd9f8a5a7e694ea3bd4649c52a63
SHA14eed37ed0c70941e6563e9339ebf326caf1ea952
SHA2568f6953723b7d0f5ed2b866441a75341570bdbf5f30da9d5d468ab5aad1dfa108
SHA512d2eaa299fdf53cd1bc339895f2172517734f8145a6a49809e33765fb01da97fc1315de04f3081de12cccb3ff5dd656b863fcc1538aa12ac827f565287ce92224