Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2024, 16:41
Static task
static1
Behavioral task
behavioral1
Sample
bf04805e9f7aa4d06437d71fa70c6a3b_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
bf04805e9f7aa4d06437d71fa70c6a3b_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
bf04805e9f7aa4d06437d71fa70c6a3b_JaffaCakes118.html
-
Size
199KB
-
MD5
bf04805e9f7aa4d06437d71fa70c6a3b
-
SHA1
db63defedcf5831e11257a20dbf6de1243c31945
-
SHA256
3edfc81a9b40f6e25d00980ecabedc8144a2c493eac8a12fdb02f554f6b97b1a
-
SHA512
ad124a1d3e82a452452dd6b3df7807c9ab27a39b63d13eb645db760f7d7e751b94784f855e0d9237eeae0d6f843ec82926d60d46eaf50def6211f98f1354b241
-
SSDEEP
3072:PC0VVuyfkMY+BES09JXAnyrZalI+YL/Ruz0XfLR:FV1sMYod+X3oI+YL/RXf1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1816 msedge.exe 1816 msedge.exe 5064 msedge.exe 5064 msedge.exe 4696 identity_helper.exe 4696 identity_helper.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe 2476 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe 5064 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5064 wrote to memory of 4372 5064 msedge.exe 84 PID 5064 wrote to memory of 4372 5064 msedge.exe 84 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 3260 5064 msedge.exe 85 PID 5064 wrote to memory of 1816 5064 msedge.exe 86 PID 5064 wrote to memory of 1816 5064 msedge.exe 86 PID 5064 wrote to memory of 828 5064 msedge.exe 87 PID 5064 wrote to memory of 828 5064 msedge.exe 87 PID 5064 wrote to memory of 828 5064 msedge.exe 87 PID 5064 wrote to memory of 828 5064 msedge.exe 87 PID 5064 wrote to memory of 828 5064 msedge.exe 87 PID 5064 wrote to memory of 828 5064 msedge.exe 87 PID 5064 wrote to memory of 828 5064 msedge.exe 87 PID 5064 wrote to memory of 828 5064 msedge.exe 87 PID 5064 wrote to memory of 828 5064 msedge.exe 87 PID 5064 wrote to memory of 828 5064 msedge.exe 87 PID 5064 wrote to memory of 828 5064 msedge.exe 87 PID 5064 wrote to memory of 828 5064 msedge.exe 87 PID 5064 wrote to memory of 828 5064 msedge.exe 87 PID 5064 wrote to memory of 828 5064 msedge.exe 87 PID 5064 wrote to memory of 828 5064 msedge.exe 87 PID 5064 wrote to memory of 828 5064 msedge.exe 87 PID 5064 wrote to memory of 828 5064 msedge.exe 87 PID 5064 wrote to memory of 828 5064 msedge.exe 87 PID 5064 wrote to memory of 828 5064 msedge.exe 87 PID 5064 wrote to memory of 828 5064 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bf04805e9f7aa4d06437d71fa70c6a3b_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbe2f46f8,0x7ffdbe2f4708,0x7ffdbe2f47182⤵PID:4372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,1119772391494486109,17664812023184395431,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:3260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,1119772391494486109,17664812023184395431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,1119772391494486109,17664812023184395431,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:82⤵PID:828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1119772391494486109,17664812023184395431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1119772391494486109,17664812023184395431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:3152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,1119772391494486109,17664812023184395431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:82⤵PID:552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,1119772391494486109,17664812023184395431,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1119772391494486109,17664812023184395431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:12⤵PID:3448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1119772391494486109,17664812023184395431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:12⤵PID:1712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1119772391494486109,17664812023184395431,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:4264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1119772391494486109,17664812023184395431,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:12⤵PID:1208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,1119772391494486109,17664812023184395431,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4920 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2476
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1640
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD553bc70ecb115bdbabe67620c416fe9b3
SHA1af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA256b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
SHA512cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
-
Filesize
152B
MD5e765f3d75e6b0e4a7119c8b14d47d8da
SHA1cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA256986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
SHA512a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
-
Filesize
5KB
MD5d12575631f7fa84968b8cc75f9a7680b
SHA1e4381195a654f53fb58da037d11e6061e3a2506f
SHA2563e9e7c7dcc3f81aa8f335e2aa877fb1d4a5b78051f72064bbf141fb842c91b05
SHA512c5f375a215f251fb50ebcb2871116ea8c92fc3cefd224f5413071f7e9ebc3fc549cf13899ef993e74dfab78f24a17ca56ef4c7de9be2bc3c594d1d817d25bcbf
-
Filesize
6KB
MD5289615e1886543512ca8ef214341ab9d
SHA14d9a5d6d049fef0676f0179e92a1928d78a96bab
SHA25663a234d8f712e94406fa5d04ab970f1017d63f81d0250676eebd82d6f3439d92
SHA512b4402d7ea9848f393a78f3a981cf79d62280b1df1f017f3d0f1189d8c22633fad7667e0a2c44317ff6fcaf2a7216247899bcb6bb3fd37ab745344806fcea9536
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD5a9b747eeb45a12de0444ffdfbcb1af47
SHA16a276c53e2b71525bafed96f8172644a68846bce
SHA256fb1e26967f71605eeeb1b8103714a62227e6af541456f52bb7edcc0be485519c
SHA512d5007e91e08f81cebfc27cce545f7bf55e2256d07fc8659350ebdffaa209f183a859215a78d57000cdef63c509cb18eb9b2872877ad57a4aa98036fd589410e8