Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 11:34
Static task
static1
Behavioral task
behavioral1
Sample
aad9615fe252578f0ee393465faeb4e1_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
aad9615fe252578f0ee393465faeb4e1_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
aad9615fe252578f0ee393465faeb4e1_JaffaCakes118.html
-
Size
64KB
-
MD5
aad9615fe252578f0ee393465faeb4e1
-
SHA1
79f7e89a8aaf76d400bc02790e80d651b749fb34
-
SHA256
829b32e758713691d330d68e6b60a4cbb8d310ca6737e99ead4fb6ac11fb38a8
-
SHA512
bbb7be48ef8553e51bf497b7ab8c4e884b1d23d5896e77579599deee6ee3f00a502cb2708f6dab470819c9217a695eb7fab0029a3abcced4d5a4d0b08dc7c010
-
SSDEEP
1536:CE+mwcybcQIP80rhVo1OetFRRMRvtHDhxWsMj32ZafnMxBy1DZq6JXKfaspiIpe:CErFo1OetFReRvtHDhxWsMj32ZafnMxm
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2100 msedge.exe 2100 msedge.exe 612 msedge.exe 612 msedge.exe 2468 identity_helper.exe 2468 identity_helper.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe 612 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 612 wrote to memory of 3512 612 msedge.exe 84 PID 612 wrote to memory of 3512 612 msedge.exe 84 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 3732 612 msedge.exe 85 PID 612 wrote to memory of 2100 612 msedge.exe 86 PID 612 wrote to memory of 2100 612 msedge.exe 86 PID 612 wrote to memory of 1072 612 msedge.exe 87 PID 612 wrote to memory of 1072 612 msedge.exe 87 PID 612 wrote to memory of 1072 612 msedge.exe 87 PID 612 wrote to memory of 1072 612 msedge.exe 87 PID 612 wrote to memory of 1072 612 msedge.exe 87 PID 612 wrote to memory of 1072 612 msedge.exe 87 PID 612 wrote to memory of 1072 612 msedge.exe 87 PID 612 wrote to memory of 1072 612 msedge.exe 87 PID 612 wrote to memory of 1072 612 msedge.exe 87 PID 612 wrote to memory of 1072 612 msedge.exe 87 PID 612 wrote to memory of 1072 612 msedge.exe 87 PID 612 wrote to memory of 1072 612 msedge.exe 87 PID 612 wrote to memory of 1072 612 msedge.exe 87 PID 612 wrote to memory of 1072 612 msedge.exe 87 PID 612 wrote to memory of 1072 612 msedge.exe 87 PID 612 wrote to memory of 1072 612 msedge.exe 87 PID 612 wrote to memory of 1072 612 msedge.exe 87 PID 612 wrote to memory of 1072 612 msedge.exe 87 PID 612 wrote to memory of 1072 612 msedge.exe 87 PID 612 wrote to memory of 1072 612 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\aad9615fe252578f0ee393465faeb4e1_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e8a146f8,0x7ff8e8a14708,0x7ff8e8a147182⤵PID:3512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,12780637044124120068,16240821693835529592,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵PID:3732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,12780637044124120068,16240821693835529592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,12780637044124120068,16240821693835529592,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:82⤵PID:1072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12780637044124120068,16240821693835529592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:3676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12780637044124120068,16240821693835529592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:1604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12780637044124120068,16240821693835529592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:12⤵PID:4500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12780637044124120068,16240821693835529592,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:12⤵PID:1624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,12780637044124120068,16240821693835529592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:82⤵PID:2084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,12780637044124120068,16240821693835529592,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5740 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12780637044124120068,16240821693835529592,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:12⤵PID:2604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12780637044124120068,16240821693835529592,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:12⤵PID:2092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,12780637044124120068,16240821693835529592,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3688 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4412
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4984
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3016
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5111c361619c017b5d09a13a56938bd54
SHA1e02b363a8ceb95751623f25025a9299a2c931e07
SHA256d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc
SHA512fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2
-
Filesize
152B
MD5983cbc1f706a155d63496ebc4d66515e
SHA1223d0071718b80cad9239e58c5e8e64df6e2a2fe
SHA256cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c
SHA512d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd
-
Filesize
5KB
MD5c48301b69d547aa82243999a3b276896
SHA14509c8006701795338cab3a31c1fe3291689c06e
SHA2565d320490b3353af78d53636fb87af0c4eca20611ddcf7e484b1278b7ea4d4bfc
SHA5121a8eaf6600fb815bfe092f88ff92c56978d63169da8c58989ef8ee10e8aac643be2328f6259b8142c0575e64021d295fc82a07143fec1dbf8d2a8f47cc1d02c6
-
Filesize
6KB
MD505667570aa87e8bcb68a7acd227e31d0
SHA17132c9515f00e184e092b63d417a744388b5f925
SHA256004232b11014c7d0c45e1f82e98f09d0fb7742d2d936d22bb4465eeaff4a9d07
SHA512e88f7cf2d78077a31305f5069b7deda72bda1732d8db9ae1b89c2028ae228ec045598b36dde80bd2626ee9acc54a62e763c25909b4a6c4bd5488f5eba8d6638d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a16adb1d-73da-42e8-91d7-1995dc5b4e6b.tmp
Filesize303B
MD58afb1cd71d2cae3c95c8571ca1efbbd2
SHA14c2a2f45fef852b73c953a09d89f571d81d4cb7d
SHA2562d4aa4745215eedea0e0b85f6a60dc8331ce4c9054665ce66d378336113a918e
SHA512132c487b03e4a919147a2c255e210e12a55e3fe6a06b71f5560170db6035e5c3017487a32277b4db5c771bcae9213c14bc3f7d76943365eebf236a14de27136b
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD59c689574b646e7b06aa75448d90a59ef
SHA1e0eff70e47d69ddd1e661a4a8d245b815f219312
SHA256220943a7641d15f27a8c1d2803a36b0d29eb27151ab33aee9c25023bb3e7b2e0
SHA51202638fe2a8a75e97008ef956c3cc2267ee7610002d463b7b05e89c6945d4a2970e679043272a52fcfe23b7046af14dd66614eff5b1469e2c44eaf68143c1b3f4