Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/08/2024, 17:18
Static task
static1
Behavioral task
behavioral1
Sample
96f47374ccd4615c06566b48f1402235_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
96f47374ccd4615c06566b48f1402235_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
96f47374ccd4615c06566b48f1402235_JaffaCakes118.html
-
Size
6KB
-
MD5
96f47374ccd4615c06566b48f1402235
-
SHA1
ed2233a119e252045bb3dc17cb2e13fca3e73567
-
SHA256
e0744bce15f82a206914e90b9d086c54509697e676f52e913d4ae25d84f35a61
-
SHA512
bdf4d2b474508243825c053fc4d5087c00b98e8af39ccc2f02705452157a716034660907540a1e043b2389f53f35693be29abc207504501c390ae05e0973a7ff
-
SSDEEP
96:uzVs+ux7S1LLY1k9o84d12ef7CSTU3weAXwcEZ7ru7f:csz7S1AYS/uCXwb76f
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4608 msedge.exe 4608 msedge.exe 1608 msedge.exe 1608 msedge.exe 2080 identity_helper.exe 2080 identity_helper.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe 4088 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe 1608 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1608 wrote to memory of 4964 1608 msedge.exe 84 PID 1608 wrote to memory of 4964 1608 msedge.exe 84 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 3448 1608 msedge.exe 85 PID 1608 wrote to memory of 4608 1608 msedge.exe 86 PID 1608 wrote to memory of 4608 1608 msedge.exe 86 PID 1608 wrote to memory of 4892 1608 msedge.exe 87 PID 1608 wrote to memory of 4892 1608 msedge.exe 87 PID 1608 wrote to memory of 4892 1608 msedge.exe 87 PID 1608 wrote to memory of 4892 1608 msedge.exe 87 PID 1608 wrote to memory of 4892 1608 msedge.exe 87 PID 1608 wrote to memory of 4892 1608 msedge.exe 87 PID 1608 wrote to memory of 4892 1608 msedge.exe 87 PID 1608 wrote to memory of 4892 1608 msedge.exe 87 PID 1608 wrote to memory of 4892 1608 msedge.exe 87 PID 1608 wrote to memory of 4892 1608 msedge.exe 87 PID 1608 wrote to memory of 4892 1608 msedge.exe 87 PID 1608 wrote to memory of 4892 1608 msedge.exe 87 PID 1608 wrote to memory of 4892 1608 msedge.exe 87 PID 1608 wrote to memory of 4892 1608 msedge.exe 87 PID 1608 wrote to memory of 4892 1608 msedge.exe 87 PID 1608 wrote to memory of 4892 1608 msedge.exe 87 PID 1608 wrote to memory of 4892 1608 msedge.exe 87 PID 1608 wrote to memory of 4892 1608 msedge.exe 87 PID 1608 wrote to memory of 4892 1608 msedge.exe 87 PID 1608 wrote to memory of 4892 1608 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\96f47374ccd4615c06566b48f1402235_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff84d6646f8,0x7ff84d664708,0x7ff84d6647182⤵PID:4964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,5726192780928893052,3875373947644918382,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:22⤵PID:3448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,5726192780928893052,3875373947644918382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1944,5726192780928893052,3875373947644918382,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:82⤵PID:4892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,5726192780928893052,3875373947644918382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:4080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,5726192780928893052,3875373947644918382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:12⤵PID:2868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,5726192780928893052,3875373947644918382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:82⤵PID:4584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,5726192780928893052,3875373947644918382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,5726192780928893052,3875373947644918382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:12⤵PID:512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,5726192780928893052,3875373947644918382,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:12⤵PID:4332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,5726192780928893052,3875373947644918382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:12⤵PID:400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,5726192780928893052,3875373947644918382,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:12⤵PID:3552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,5726192780928893052,3875373947644918382,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3128 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4088
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:636
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3164
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e4f80e7950cbd3bb11257d2000cb885e
SHA110ac643904d539042d8f7aa4a312b13ec2106035
SHA2561184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124
SHA5122b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0
-
Filesize
152B
MD52dc1a9f2f3f8c3cfe51bb29b078166c5
SHA1eaf3c3dad3c8dc6f18dc3e055b415da78b704402
SHA256dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa
SHA512682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25
-
Filesize
6KB
MD50521415f99272af9d0ab6f13f24703d5
SHA10cc9396afc1353f7790c4ec81c58f7fd44686302
SHA2566722fd1e2c873812c18a6b521d80a2677f506007c98bf62bd6e57286556f3594
SHA5120a6c6995c94988dd548f512d2bb85fdf804767830c9475a168facc86a9eccac9fc234093ee73826c921cb24ab1682d19164d950d4aab8b666c9380e807f29029
-
Filesize
6KB
MD58c1744429a5e09fa7c23c09b8cd43c19
SHA124f7a7c4302bad2c3eff353a278e253d95fecff7
SHA256082ea2715e2cb13c210ebe08667477a46e77e95ac2e26ab1d822e8aedf868dba
SHA512762d9df88dcdc0a9b980b0c7d99a941c84eec630035f649144d87c692e649dec3b91d2cdec331b14710f31fa81ce225fc2054d5c1ac1d0e4a13680bd7cf47010
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD576e5d76ed3d5043e9d97788494ff613a
SHA1864e197fb4f40808528469bc2f3912065c62065a
SHA2565e12294e4730e87acc4d444f836de2ae7397aa491d303a37cf6e7b4bcb860e57
SHA51298540416c704b3165e343e9949745391025107cfb0d8b791ac92662a12f4cbbb99ccb0be11d4a35784a22d0d4d885c9ce26357e1decd14d2fd9ec87ce60c04ac