Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2024, 05:20
Static task
static1
Behavioral task
behavioral1
Sample
832f038d442cd5b1362bc79acb8a6a18_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
832f038d442cd5b1362bc79acb8a6a18_JaffaCakes118.exe
Resource
win10v2004-20240730-en
General
-
Target
832f038d442cd5b1362bc79acb8a6a18_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
832f038d442cd5b1362bc79acb8a6a18
-
SHA1
4cddfc240477c3a6891306fba39db54be72c0154
-
SHA256
1502715aa09da19f9cda68f6434c51ed80dd049bb9375fa6e672e334157dd284
-
SHA512
81b206458fd34c8b74e104e00cab93a1d11fed5f383fcf73ad5465063282306b008bc3d44462937b53984513fc07187a869cbda8a7e517e345459b41cbc1902a
-
SSDEEP
24576:MejDKKiDkY2+AhEcy1BirYZqXMrDjUm84QeP3Cqkkkkkkk4:MeUDeyLZqcn3C6
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 832f038d442cd5b1362bc79acb8a6a18_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1920 msedge.exe 1920 msedge.exe 3272 msedge.exe 3272 msedge.exe 2512 identity_helper.exe 2512 identity_helper.exe 4780 msedge.exe 4780 msedge.exe 4780 msedge.exe 4780 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe 3272 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3644 wrote to memory of 3272 3644 832f038d442cd5b1362bc79acb8a6a18_JaffaCakes118.exe 86 PID 3644 wrote to memory of 3272 3644 832f038d442cd5b1362bc79acb8a6a18_JaffaCakes118.exe 86 PID 3272 wrote to memory of 1476 3272 msedge.exe 87 PID 3272 wrote to memory of 1476 3272 msedge.exe 87 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 4260 3272 msedge.exe 88 PID 3272 wrote to memory of 1920 3272 msedge.exe 89 PID 3272 wrote to memory of 1920 3272 msedge.exe 89 PID 3272 wrote to memory of 728 3272 msedge.exe 90 PID 3272 wrote to memory of 728 3272 msedge.exe 90 PID 3272 wrote to memory of 728 3272 msedge.exe 90 PID 3272 wrote to memory of 728 3272 msedge.exe 90 PID 3272 wrote to memory of 728 3272 msedge.exe 90 PID 3272 wrote to memory of 728 3272 msedge.exe 90 PID 3272 wrote to memory of 728 3272 msedge.exe 90 PID 3272 wrote to memory of 728 3272 msedge.exe 90 PID 3272 wrote to memory of 728 3272 msedge.exe 90 PID 3272 wrote to memory of 728 3272 msedge.exe 90 PID 3272 wrote to memory of 728 3272 msedge.exe 90 PID 3272 wrote to memory of 728 3272 msedge.exe 90 PID 3272 wrote to memory of 728 3272 msedge.exe 90 PID 3272 wrote to memory of 728 3272 msedge.exe 90 PID 3272 wrote to memory of 728 3272 msedge.exe 90 PID 3272 wrote to memory of 728 3272 msedge.exe 90 PID 3272 wrote to memory of 728 3272 msedge.exe 90 PID 3272 wrote to memory of 728 3272 msedge.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\832f038d442cd5b1362bc79acb8a6a18_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\832f038d442cd5b1362bc79acb8a6a18_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://contrev.net/redir320.html2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1dfa46f8,0x7fff1dfa4708,0x7fff1dfa47183⤵PID:1476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,8817132354171395063,4793969532672675609,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:23⤵PID:4260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,8817132354171395063,4793969532672675609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,8817132354171395063,4793969532672675609,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:83⤵PID:728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8817132354171395063,4793969532672675609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:13⤵PID:4640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8817132354171395063,4793969532672675609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:13⤵PID:3100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8817132354171395063,4793969532672675609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:13⤵PID:1512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8817132354171395063,4793969532672675609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:13⤵PID:3160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,8817132354171395063,4793969532672675609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3248 /prefetch:83⤵PID:700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,8817132354171395063,4793969532672675609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3248 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:2512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8817132354171395063,4793969532672675609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:13⤵PID:4332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8817132354171395063,4793969532672675609,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:13⤵PID:4308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,8817132354171395063,4793969532672675609,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:13⤵PID:2204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,8817132354171395063,4793969532672675609,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4780
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2348
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2400
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58d8ccfa6a8b1b15db876b848b8fdc102
SHA1dc7d92c35e9c84d8d78ac0aedc926214cee68135
SHA256b48f98046030e23b843422251481c3f19cfa0cf71fb36a8ff89dfcb152761f86
SHA5126ae61b6cf236082b9930686ad2650c3ce3fa337550363e0858062dbb399093b0ac6bbca3d4c40101e222ce764fa4fb704bfc591e6d5b0a6c165f170cd6c9d5b8
-
Filesize
152B
MD581e22c2898ac78c14a840076a8446b9d
SHA1ff5b7cca3ff2c4e77e6330e2c5e2b62bb56e9fe6
SHA256a5e570fc8d3a52027db48adf1301fe8dffc500a4bef04d0d6bff15fff78ade8d
SHA51219381615be8f53ccae56a21c29c314c3247ac78fd3cf838f52ca98757b54f945f0d178cfb44ea5ad42fc68b3d3e6e7ce4e4f40eb69f791fa5132f591c62388e6
-
Filesize
179B
MD5be584beb20b88aba4e02dd5f6ae403fb
SHA12c928bff533480c0b2633a74dc5eb0f44189db47
SHA256145abf902fae5e5a332a50d331515ce1d59e2879f4d575fea47bbc9001dcf679
SHA512b18b6122aa5baf51d6f718b437c912d5905446876301a3fe8696036f2a2c8da703ad0d51f11e824c3c0c956f81baad23e8cee2ed7a99b5b69918c8a38e347d7e
-
Filesize
6KB
MD50442c94574daacd150caff41415aa75e
SHA146e6e7b8e28e758a7df35429f9e7cd596431376c
SHA256a013240b5d5c51cde72194b10903283b6f07c45833983f01a51bf9c92306ef35
SHA512a6904768d0ae77284f7d4676948f77b4df32302c923bc030ec978313398d63b6c9c0a86bc988e1812cd87acb61cd1777d7796ddfaced558e5e873d97bbbefbb8
-
Filesize
6KB
MD58d9b19a2c61885e2f4b56c566f48abcb
SHA1746c895793b38a4c0a7029b94da8e98ade6f245b
SHA2563a9a3790cae8b38937e800194703b2ed47258a79f44d38176f737c6bb0f7977e
SHA512b2c9f8ae1c2dce3cf2bf56012f301326ab27cb14082407f53e20e5289fed6daa3123f863437bf72be155e9ead2fd9b2f274c2453686e6353e69ad082dc78e3b8
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD50e71c5b4e209d411b8a650f5b4de5e58
SHA1094b31cb8e60fe3efab716c3c8b06f99afd3522f
SHA2564358d6d9557147cdcdcfed93c5726c2791c77c27b3ff90baec589b5e1955efd9
SHA512d00dd3911baf41992045ccd109e4d4efb795241dee68b5ce4d8f0225c5465b3781920a4610a5149331ced7225216692526a505fe6f50944dd96890a6c0e7955e