Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10/08/2024, 22:19
Static task
static1
Behavioral task
behavioral1
Sample
87e5898764cb4f0409421b032af228fb_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
87e5898764cb4f0409421b032af228fb_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
87e5898764cb4f0409421b032af228fb_JaffaCakes118.html
-
Size
833B
-
MD5
87e5898764cb4f0409421b032af228fb
-
SHA1
7353dce2b05c0c49896255d019265633af4fc8e7
-
SHA256
34978cd52fbfe0947e967a9851b74ec4b743252649f65fa61297cbfdede002f6
-
SHA512
db5edde83b5103a31aa91c1cdff74e82fe542b97a3f79a072e4052d8c45c4e7055bc93e253ddafbbe6403d84e977245fab7337b946f35e73bd9e8bf80504b4e6
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1936 msedge.exe 1936 msedge.exe 3704 msedge.exe 3704 msedge.exe 3464 identity_helper.exe 3464 identity_helper.exe 5048 msedge.exe 5048 msedge.exe 5048 msedge.exe 5048 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe 3704 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3704 wrote to memory of 3016 3704 msedge.exe 84 PID 3704 wrote to memory of 3016 3704 msedge.exe 84 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 228 3704 msedge.exe 85 PID 3704 wrote to memory of 1936 3704 msedge.exe 86 PID 3704 wrote to memory of 1936 3704 msedge.exe 86 PID 3704 wrote to memory of 1052 3704 msedge.exe 87 PID 3704 wrote to memory of 1052 3704 msedge.exe 87 PID 3704 wrote to memory of 1052 3704 msedge.exe 87 PID 3704 wrote to memory of 1052 3704 msedge.exe 87 PID 3704 wrote to memory of 1052 3704 msedge.exe 87 PID 3704 wrote to memory of 1052 3704 msedge.exe 87 PID 3704 wrote to memory of 1052 3704 msedge.exe 87 PID 3704 wrote to memory of 1052 3704 msedge.exe 87 PID 3704 wrote to memory of 1052 3704 msedge.exe 87 PID 3704 wrote to memory of 1052 3704 msedge.exe 87 PID 3704 wrote to memory of 1052 3704 msedge.exe 87 PID 3704 wrote to memory of 1052 3704 msedge.exe 87 PID 3704 wrote to memory of 1052 3704 msedge.exe 87 PID 3704 wrote to memory of 1052 3704 msedge.exe 87 PID 3704 wrote to memory of 1052 3704 msedge.exe 87 PID 3704 wrote to memory of 1052 3704 msedge.exe 87 PID 3704 wrote to memory of 1052 3704 msedge.exe 87 PID 3704 wrote to memory of 1052 3704 msedge.exe 87 PID 3704 wrote to memory of 1052 3704 msedge.exe 87 PID 3704 wrote to memory of 1052 3704 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\87e5898764cb4f0409421b032af228fb_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab75f46f8,0x7ffab75f4708,0x7ffab75f47182⤵PID:3016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,3267858459556870882,7553971497904726166,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:22⤵PID:228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,3267858459556870882,7553971497904726166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,3267858459556870882,7553971497904726166,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:82⤵PID:1052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,3267858459556870882,7553971497904726166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,3267858459556870882,7553971497904726166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:4344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,3267858459556870882,7553971497904726166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:82⤵PID:3240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,3267858459556870882,7553971497904726166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,3267858459556870882,7553971497904726166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:12⤵PID:2320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,3267858459556870882,7553971497904726166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2236 /prefetch:12⤵PID:2032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,3267858459556870882,7553971497904726166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:12⤵PID:2780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,3267858459556870882,7553971497904726166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:3380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,3267858459556870882,7553971497904726166,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5048
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:916
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4948
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d7114a6cd851f9bf56cf771c37d664a2
SHA1769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA256d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
SHA51233bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
-
Filesize
152B
MD5719923124ee00fb57378e0ebcbe894f7
SHA1cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA256aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
SHA512a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
-
Filesize
6KB
MD5560a5d90ca970410171f2ee846d7b273
SHA1234e01a85a473d442584c9b71b40672cfe7c8a4e
SHA2563c615ff18ab0f4aecfe3bb0bd097c5114b6aacb5f1e39b333db7cf783190bfea
SHA5129a6cf28fed4a3db2bcd787d8e5b89e0471e5823461ed4d217e7a4e3da1bcfbf0f7d38c38aab0b7ff5cc0dbf9bee83f00105f765d90aba782dc16f26b6eec62ab
-
Filesize
6KB
MD5e47527268340eebf8f55c412925a7617
SHA1d58cefc96b245372550b4816c18794477dc4e595
SHA2562e0be2385bbe245e48eeefea8da64a5b1100b1fe8f8919c9b06a3daf711245ca
SHA5121fc9191f222a0babb1cfcf9026ee299ec75ca77d6b92f8c12af852896648a7dafe07a84fdb5b0bf668ff000d3ea2bc5426bad634bc4b395737b6f3119957e17e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5415c0eeea6180cf0fa50189e07a767a8
SHA1381533cde20946766ed57874437d2d410f6854b5
SHA2566bc297eb2d7219a5394474be3bbd56c59f2e4e0b1958297e768d5e83c50a2a88
SHA512cf28cb46f5297b285f1f3dd62ad18b185b77c5fcad31d0b40f029608e540a2cafca3fff14e3f3fe29da5805cb7408f9acfcf5c731b7e634d7f0ae5c21f546816