Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10/08/2024, 11:53
Static task
static1
Behavioral task
behavioral1
Sample
85f3eab0163b189a2b2fc052c32a901e_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
85f3eab0163b189a2b2fc052c32a901e_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
85f3eab0163b189a2b2fc052c32a901e_JaffaCakes118.html
-
Size
51KB
-
MD5
85f3eab0163b189a2b2fc052c32a901e
-
SHA1
c7efe38132935c48bc1c75bda9886550e3699759
-
SHA256
d9a46cda421fd2b4064f3a6d8599c91b622418552cfacaca8115dc8777f34235
-
SHA512
1857e6aa45d42284dc572ef810eb25464e21912ee1f5010f28491fd986bb62eb4e04b2efa522c8fbbe1d514e5f05ea05e5292be2deb8838f2a844deaa2d93671
-
SSDEEP
768:S/YR49z3ZNh7YsxuaFvG/Es7nmu4eyTP9BzTJwLY6uwjg:S/l9bfisxu8kmu4eSPfiM6uwjg
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4256 msedge.exe 4256 msedge.exe 2652 msedge.exe 2652 msedge.exe 5072 identity_helper.exe 5072 identity_helper.exe 756 msedge.exe 756 msedge.exe 756 msedge.exe 756 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
pid Process 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe 2652 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2652 wrote to memory of 916 2652 msedge.exe 84 PID 2652 wrote to memory of 916 2652 msedge.exe 84 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 3940 2652 msedge.exe 85 PID 2652 wrote to memory of 4256 2652 msedge.exe 86 PID 2652 wrote to memory of 4256 2652 msedge.exe 86 PID 2652 wrote to memory of 3360 2652 msedge.exe 87 PID 2652 wrote to memory of 3360 2652 msedge.exe 87 PID 2652 wrote to memory of 3360 2652 msedge.exe 87 PID 2652 wrote to memory of 3360 2652 msedge.exe 87 PID 2652 wrote to memory of 3360 2652 msedge.exe 87 PID 2652 wrote to memory of 3360 2652 msedge.exe 87 PID 2652 wrote to memory of 3360 2652 msedge.exe 87 PID 2652 wrote to memory of 3360 2652 msedge.exe 87 PID 2652 wrote to memory of 3360 2652 msedge.exe 87 PID 2652 wrote to memory of 3360 2652 msedge.exe 87 PID 2652 wrote to memory of 3360 2652 msedge.exe 87 PID 2652 wrote to memory of 3360 2652 msedge.exe 87 PID 2652 wrote to memory of 3360 2652 msedge.exe 87 PID 2652 wrote to memory of 3360 2652 msedge.exe 87 PID 2652 wrote to memory of 3360 2652 msedge.exe 87 PID 2652 wrote to memory of 3360 2652 msedge.exe 87 PID 2652 wrote to memory of 3360 2652 msedge.exe 87 PID 2652 wrote to memory of 3360 2652 msedge.exe 87 PID 2652 wrote to memory of 3360 2652 msedge.exe 87 PID 2652 wrote to memory of 3360 2652 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\85f3eab0163b189a2b2fc052c32a901e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffaba0546f8,0x7ffaba054708,0x7ffaba0547182⤵PID:916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,10170511702883114732,16426017808225710974,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:22⤵PID:3940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,10170511702883114732,16426017808225710974,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,10170511702883114732,16426017808225710974,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:82⤵PID:3360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10170511702883114732,16426017808225710974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:4812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10170511702883114732,16426017808225710974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10170511702883114732,16426017808225710974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:12⤵PID:996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10170511702883114732,16426017808225710974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:12⤵PID:2440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10170511702883114732,16426017808225710974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:12⤵PID:4764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10170511702883114732,16426017808225710974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:12⤵PID:4664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10170511702883114732,16426017808225710974,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:12⤵PID:4708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,10170511702883114732,16426017808225710974,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:82⤵PID:3768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,10170511702883114732,16426017808225710974,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10170511702883114732,16426017808225710974,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:12⤵PID:2228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10170511702883114732,16426017808225710974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:12⤵PID:2256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10170511702883114732,16426017808225710974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1796 /prefetch:12⤵PID:528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,10170511702883114732,16426017808225710974,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:12⤵PID:3636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,10170511702883114732,16426017808225710974,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4588 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:756
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2076
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2872
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ecf7ca53c80b5245e35839009d12f866
SHA1a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA256882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
SHA512706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
-
Filesize
152B
MD54dd2754d1bea40445984d65abee82b21
SHA14b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA256183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
SHA51292d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
-
Filesize
6KB
MD5764c4dfcb40ddd51b439a24fd6301bdc
SHA198ee32e38164a32789751d3eec614694b0e50087
SHA256f2746365dbc30bb5447ae9dac053992bf5a2a471b119fea3aaad6de349563d56
SHA512326893ca467b08108430a31b106ba3171e01252a289a5eec7a5de0ff967412de40ed2f0729c3334f0c1ebb13b7163b9fbb4fd1fd95c5d9d42b29a7b83899df77
-
Filesize
6KB
MD5939323828c55bf64de04166db19bc8f0
SHA1f46d68c7e79c91f9f7760a0c6da9ed99a628d18a
SHA256849f15bc0d0c16281aa8b355e106f04465d8dbe99e6394e5c0a0cd4951d222e1
SHA5123a3e08d15664e94517b59c9183f09b33dd092abf5098cdd622bb7791559161871af6b37cb8ac6007ffb1c7322fa3eae37419cacf1c57480f8185e50cbad750b4
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD545dd12a1266029c7914d3a82c9b5f7bc
SHA11f231a3678c65b67ef7361f113c17a8174a641de
SHA256709f9899bf1d78cabd5b10c193969dabb97db66204d6bd579f8624476f4a0103
SHA512a046ab67140b00533df5983be41d89b5c38ea12e183dc3a71ffb191337e33c5e762ec520dab1ca768bec2a6c8cd2fc94a9d9f4ee888d86e8f5d2d7c64d1d4ddf