Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
22/08/2024, 22:53
Static task
static1
Behavioral task
behavioral1
Sample
b96189e2a7ccffc2fae6a9d1c2faa8f0_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b96189e2a7ccffc2fae6a9d1c2faa8f0_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
b96189e2a7ccffc2fae6a9d1c2faa8f0_JaffaCakes118.html
-
Size
18KB
-
MD5
b96189e2a7ccffc2fae6a9d1c2faa8f0
-
SHA1
0f62bea10ecee3ef5cbf0205c481e7b55790649e
-
SHA256
2e26b585b29ad3f8448ec5c22960ee35a8cb74b642726dbf3909cf70ce36b126
-
SHA512
4c596d5e0376c9745ef4efebb22f719a594248e0cce80a2e9434b9f90313eed9ac6700ce5fe7d338ff602476045c8450aa5f9852deba130f7105db8cb2454dbe
-
SSDEEP
192:VQ5cVZ7oxovwLd554ba08EFhI04YLXar4dWZSj0VuPfKuHciXOdJgU/hLallNK:e5cVZeNzeMt0dWZSj0VuPf0EK
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2676 msedge.exe 2676 msedge.exe 3196 msedge.exe 3196 msedge.exe 2532 identity_helper.exe 2532 identity_helper.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe 1040 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe 3196 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3196 wrote to memory of 2432 3196 msedge.exe 84 PID 3196 wrote to memory of 2432 3196 msedge.exe 84 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 3840 3196 msedge.exe 85 PID 3196 wrote to memory of 2676 3196 msedge.exe 86 PID 3196 wrote to memory of 2676 3196 msedge.exe 86 PID 3196 wrote to memory of 3164 3196 msedge.exe 87 PID 3196 wrote to memory of 3164 3196 msedge.exe 87 PID 3196 wrote to memory of 3164 3196 msedge.exe 87 PID 3196 wrote to memory of 3164 3196 msedge.exe 87 PID 3196 wrote to memory of 3164 3196 msedge.exe 87 PID 3196 wrote to memory of 3164 3196 msedge.exe 87 PID 3196 wrote to memory of 3164 3196 msedge.exe 87 PID 3196 wrote to memory of 3164 3196 msedge.exe 87 PID 3196 wrote to memory of 3164 3196 msedge.exe 87 PID 3196 wrote to memory of 3164 3196 msedge.exe 87 PID 3196 wrote to memory of 3164 3196 msedge.exe 87 PID 3196 wrote to memory of 3164 3196 msedge.exe 87 PID 3196 wrote to memory of 3164 3196 msedge.exe 87 PID 3196 wrote to memory of 3164 3196 msedge.exe 87 PID 3196 wrote to memory of 3164 3196 msedge.exe 87 PID 3196 wrote to memory of 3164 3196 msedge.exe 87 PID 3196 wrote to memory of 3164 3196 msedge.exe 87 PID 3196 wrote to memory of 3164 3196 msedge.exe 87 PID 3196 wrote to memory of 3164 3196 msedge.exe 87 PID 3196 wrote to memory of 3164 3196 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b96189e2a7ccffc2fae6a9d1c2faa8f0_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85f8b46f8,0x7ff85f8b4708,0x7ff85f8b47182⤵PID:2432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,7047776338351178493,16920672085061407488,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:22⤵PID:3840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,7047776338351178493,16920672085061407488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,7047776338351178493,16920672085061407488,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:82⤵PID:3164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7047776338351178493,16920672085061407488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:2184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7047776338351178493,16920672085061407488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:3964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7047776338351178493,16920672085061407488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:12⤵PID:2600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7047776338351178493,16920672085061407488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4360 /prefetch:12⤵PID:404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,7047776338351178493,16920672085061407488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:82⤵PID:4872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,7047776338351178493,16920672085061407488,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7047776338351178493,16920672085061407488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2748 /prefetch:12⤵PID:716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7047776338351178493,16920672085061407488,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:12⤵PID:3008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7047776338351178493,16920672085061407488,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:12⤵PID:4124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,7047776338351178493,16920672085061407488,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:12⤵PID:3844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,7047776338351178493,16920672085061407488,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1040
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:912
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4732
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59b008261dda31857d68792b46af6dd6d
SHA1e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA2569ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
SHA51278853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
-
Filesize
152B
MD50446fcdd21b016db1f468971fb82a488
SHA1726b91562bb75f80981f381e3c69d7d832c87c9d
SHA25662c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
SHA5121df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
-
Filesize
180B
MD5c84c0c73943c0c4bd67fd8caa7a142a3
SHA1cdcfac9b1764b8e29b5c17eac7130be75070c9fd
SHA2560dd04037a5851d42bb2ad8f6002ed117739f5bd788c76e77412c45aa2f20128c
SHA5120f7e8729b66bc60e9ea32a13eff477e3a3600089a58da2a1dec44050718e2082c5d13ee47123a70f03972f3902c8a2fedcf8373880b1bbb4614f53b1f15ed7dc
-
Filesize
5KB
MD5e214aa96da76b3c69d392900f7da69a5
SHA13a67ce3fa52c7422fb64f38c97fe78269a3c4fd0
SHA256e980de734b945bf5affb10f35d2713eb97e45077e5be55fbb467654eb205aeb2
SHA512244c0d5660ac568280b208a87931c7551ff89bf1b887148d1ef53ea21683df6388f0e0b75db5bf1ea3bbb59cf2b641226380226738c422ccaff7da0daf3dda01
-
Filesize
6KB
MD582a5f66d75943fd07ddec64ec2d7b241
SHA18f7d5ba37440df4c679c885521ccbccdf4828441
SHA25677bc1ab16a2b5a5caa73ac3cc51c5fc53287d0119234e6dcc10b74c17a055680
SHA51236ae6e7efe8ba25b91be4d731215f97745554e8e896672b5e5de8a478bfd17fc907910330b4a40f7a9717d45ed39e6af6403692fb356f5fe7599bf3e71d3a4b4
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD53d247854e33e3777c962bb9bc9b48dbf
SHA1b535937a94653799aa37fde2a889bd7f7cfc1a5a
SHA2568b810d6285f4ada312b994263647c2431675d6d3559521d23c031e130e4a4346
SHA512e60f30faa81c36594b0d74f788291e38a6cffe81d0480aa226c662ce29a3eb62b950a356090d34f093b1d3bbde712ca60888dd2aa23242b1de5257201f2e00a8