Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 13:03
Static task
static1
Behavioral task
behavioral1
Sample
784783a9e8c965f71736cdc452aff58f_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
784783a9e8c965f71736cdc452aff58f_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
784783a9e8c965f71736cdc452aff58f_JaffaCakes118.html
-
Size
1KB
-
MD5
784783a9e8c965f71736cdc452aff58f
-
SHA1
7aac800358a73cd5b365988c24291ce33febf420
-
SHA256
c231e509cb73c00200a7b933310867cc6cdb42eae36396476835043f6f2e858b
-
SHA512
c3faa061c09048e3e39da462a33c4a55a69b6748273e1a82e59fd9dad10bd017cf6fbb634cf8202497aa184103fead03cbd75b31452f24a780d4f430733cd163
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3296 msedge.exe 3296 msedge.exe 1540 msedge.exe 1540 msedge.exe 2548 identity_helper.exe 2548 identity_helper.exe 4712 msedge.exe 4712 msedge.exe 4712 msedge.exe 4712 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe 1540 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1540 wrote to memory of 3240 1540 msedge.exe 84 PID 1540 wrote to memory of 3240 1540 msedge.exe 84 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 1360 1540 msedge.exe 85 PID 1540 wrote to memory of 3296 1540 msedge.exe 86 PID 1540 wrote to memory of 3296 1540 msedge.exe 86 PID 1540 wrote to memory of 4292 1540 msedge.exe 87 PID 1540 wrote to memory of 4292 1540 msedge.exe 87 PID 1540 wrote to memory of 4292 1540 msedge.exe 87 PID 1540 wrote to memory of 4292 1540 msedge.exe 87 PID 1540 wrote to memory of 4292 1540 msedge.exe 87 PID 1540 wrote to memory of 4292 1540 msedge.exe 87 PID 1540 wrote to memory of 4292 1540 msedge.exe 87 PID 1540 wrote to memory of 4292 1540 msedge.exe 87 PID 1540 wrote to memory of 4292 1540 msedge.exe 87 PID 1540 wrote to memory of 4292 1540 msedge.exe 87 PID 1540 wrote to memory of 4292 1540 msedge.exe 87 PID 1540 wrote to memory of 4292 1540 msedge.exe 87 PID 1540 wrote to memory of 4292 1540 msedge.exe 87 PID 1540 wrote to memory of 4292 1540 msedge.exe 87 PID 1540 wrote to memory of 4292 1540 msedge.exe 87 PID 1540 wrote to memory of 4292 1540 msedge.exe 87 PID 1540 wrote to memory of 4292 1540 msedge.exe 87 PID 1540 wrote to memory of 4292 1540 msedge.exe 87 PID 1540 wrote to memory of 4292 1540 msedge.exe 87 PID 1540 wrote to memory of 4292 1540 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\784783a9e8c965f71736cdc452aff58f_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0xe4,0x7ffc82e546f8,0x7ffc82e54708,0x7ffc82e547182⤵PID:3240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,7096723656486866605,16193661206034064176,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:1360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,7096723656486866605,16193661206034064176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,7096723656486866605,16193661206034064176,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:82⤵PID:4292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7096723656486866605,16193661206034064176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:1232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7096723656486866605,16193661206034064176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:5008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,7096723656486866605,16193661206034064176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:82⤵PID:4164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,7096723656486866605,16193661206034064176,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7096723656486866605,16193661206034064176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:12⤵PID:2764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7096723656486866605,16193661206034064176,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:12⤵PID:2876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7096723656486866605,16193661206034064176,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4464 /prefetch:12⤵PID:4716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,7096723656486866605,16193661206034064176,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:12⤵PID:3352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,7096723656486866605,16193661206034064176,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3068 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4712
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1172
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD575c9f57baeefeecd6c184627de951c1e
SHA152e0468e13cbfc9f15fc62cc27ce14367a996cff
SHA256648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f
SHA512c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15
-
Filesize
152B
MD510fa19df148444a77ceec60cabd2ce21
SHA1685b599c497668166ede4945d8885d204fd8d70f
SHA256c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b
SHA5123518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef
-
Filesize
5KB
MD5351132bab12420944f46d5c13166fa2d
SHA16bb934e15d24bb4cee472b1e2b21d85dc5a2f89e
SHA25695894a0553eade94b53de4ae53dbdf8e334d32a5d9cced11bbbda7f126d1499d
SHA5123b0981433ae197338a40e9481d7fc768ac103994f51f24d30fa7d83282be76827c6d20323af542a7aa91bd9f65f240f63cb82c5d2ff824db7ff9f65271dc007e
-
Filesize
6KB
MD51818cfbc1f1f3b6b625c60a006ccbd3d
SHA132e7deb456a3e3f43c63992c6021aa9504bc647e
SHA2563c1c008cd1fb66fd413cea3137e001c10a0beb6b187e6850dab55baf2af0888b
SHA5128de6e3ade0fcc2f89ed6a371595d414b2ce05d25fd0cc2fe8c2349d16fadd87d17afa966970b78ebba2ee5b9b7c730839a1b638b9ce329e2127282497fb64973
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5a6faba54c5de1322b82e5d0bdabd41d7
SHA1e5b510dea4ebb5bead7f3fcae7cacf37a740429a
SHA2566fb3244e8bb89dd15470d495fe9eb10f206c5c3b1c3a8f4131da3ff5f7acf79f
SHA5129750811e96587fd5ffcc8ace6b46f033d5d658047a9226f37f37b97c7d04aaa6d1ec321e4141e8bd4ec6a71a3c1ceca8a4079e5bd097fe5c3288ac87a11c42d6