Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 15:03
Static task
static1
Behavioral task
behavioral1
Sample
bc399c7b7a9d2c116937482326ad43a5_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bc399c7b7a9d2c116937482326ad43a5_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
bc399c7b7a9d2c116937482326ad43a5_JaffaCakes118.html
-
Size
19KB
-
MD5
bc399c7b7a9d2c116937482326ad43a5
-
SHA1
c9c25b05022038fd76a901235908b9be83b2c33b
-
SHA256
5bcd1a1cbf0e371fc38ce810369672c3a39167242d70c850787798be5b1e583f
-
SHA512
bf527eb6d4effc7e3906c04e43b60b9fb0576ba5744f7a7754e3c87e37252c8971323c805130136be22d9610da70cfa3edd5c730b1126312f535d495faf0bc48
-
SSDEEP
192:SIgsTkC3iDLHol8QbhhgSvgsbE3zZ+nUEu8FuBKrXnDRGmhkQLUfDjU8nQLk1NdO:SIdkC3inf0b77nDRGfQsNwQoMSGDZE
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1044 msedge.exe 1044 msedge.exe 4624 msedge.exe 4624 msedge.exe 4960 identity_helper.exe 4960 identity_helper.exe 3712 msedge.exe 3712 msedge.exe 3712 msedge.exe 3712 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe 4624 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4624 wrote to memory of 2252 4624 msedge.exe 84 PID 4624 wrote to memory of 2252 4624 msedge.exe 84 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 2372 4624 msedge.exe 85 PID 4624 wrote to memory of 1044 4624 msedge.exe 86 PID 4624 wrote to memory of 1044 4624 msedge.exe 86 PID 4624 wrote to memory of 3856 4624 msedge.exe 87 PID 4624 wrote to memory of 3856 4624 msedge.exe 87 PID 4624 wrote to memory of 3856 4624 msedge.exe 87 PID 4624 wrote to memory of 3856 4624 msedge.exe 87 PID 4624 wrote to memory of 3856 4624 msedge.exe 87 PID 4624 wrote to memory of 3856 4624 msedge.exe 87 PID 4624 wrote to memory of 3856 4624 msedge.exe 87 PID 4624 wrote to memory of 3856 4624 msedge.exe 87 PID 4624 wrote to memory of 3856 4624 msedge.exe 87 PID 4624 wrote to memory of 3856 4624 msedge.exe 87 PID 4624 wrote to memory of 3856 4624 msedge.exe 87 PID 4624 wrote to memory of 3856 4624 msedge.exe 87 PID 4624 wrote to memory of 3856 4624 msedge.exe 87 PID 4624 wrote to memory of 3856 4624 msedge.exe 87 PID 4624 wrote to memory of 3856 4624 msedge.exe 87 PID 4624 wrote to memory of 3856 4624 msedge.exe 87 PID 4624 wrote to memory of 3856 4624 msedge.exe 87 PID 4624 wrote to memory of 3856 4624 msedge.exe 87 PID 4624 wrote to memory of 3856 4624 msedge.exe 87 PID 4624 wrote to memory of 3856 4624 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bc399c7b7a9d2c116937482326ad43a5_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce0eb46f8,0x7ffce0eb4708,0x7ffce0eb47182⤵PID:2252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7012526735454889856,1306126679285721017,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:2372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,7012526735454889856,1306126679285721017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,7012526735454889856,1306126679285721017,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:82⤵PID:3856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7012526735454889856,1306126679285721017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:2468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7012526735454889856,1306126679285721017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2808 /prefetch:12⤵PID:1604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7012526735454889856,1306126679285721017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:82⤵PID:3536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7012526735454889856,1306126679285721017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7012526735454889856,1306126679285721017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:12⤵PID:4396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7012526735454889856,1306126679285721017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:12⤵PID:4560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7012526735454889856,1306126679285721017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:12⤵PID:1308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7012526735454889856,1306126679285721017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:12⤵PID:4864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7012526735454889856,1306126679285721017,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2912 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3712
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1708
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD553bc70ecb115bdbabe67620c416fe9b3
SHA1af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA256b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
SHA512cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
-
Filesize
152B
MD5e765f3d75e6b0e4a7119c8b14d47d8da
SHA1cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA256986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
SHA512a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
-
Filesize
5KB
MD58dfb37390058ef947f52191ee7359352
SHA19adce237a730211c36fdcf51a7868634702cc39c
SHA25688c04115a8d9694a41b05a0dcbebafc4b5f4fbce95f55cf1e19bcbcf8eee4b9d
SHA5122b61bc680544a1158868a99b4becb4be1e05ebe9ac5b4f09caa6210adb9dd2585acadb81e55133d8f2425887bf27cf9e9558dc95a613e1e81ed6cbbdfc3c7fe6
-
Filesize
6KB
MD53d030b107820f8c5061b55d21f5a1c33
SHA1040a92d258e0581fc5304553d0f0419485a8c9e6
SHA25671f32185d91b75823333dfdcd305b4aaca2a8366257aa8fdd3d2e2f57b2792ea
SHA5127e150e007261419ac5bb2293d1f8b9d1a50f6551e3c55bddfb3f6303c5a8056fd9dbb7bac4ebd7e64350498f4eac6a9e13dd305d10014aba12be9f950ecfa2c3
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5626fee2669f6364666c07139376d13e7
SHA1b8fef5fa6f255acb6fa8278aab74aab2fefabb0f
SHA2562d2d281517a2451542c524f6e9de392fd36408e18e571e40e3d7e5c909817321
SHA51281e1154264b21c6688e9c8f2aa130c28014479710818d985e1b92179efb04344719148de18b5db12535da4cfa66196db5c4ab79279266a626bc08fd516366eea