Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 20:56
Static task
static1
Behavioral task
behavioral1
Sample
c190e139b9d1c104d9b1262b37e37836_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c190e139b9d1c104d9b1262b37e37836_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c190e139b9d1c104d9b1262b37e37836_JaffaCakes118.html
-
Size
24KB
-
MD5
c190e139b9d1c104d9b1262b37e37836
-
SHA1
5cb13a581c45931064fc8a7a334406ea17d79499
-
SHA256
f48ab5939f93bf6f12f7a7bacecbb6c815c88ad797375d3ca21a9be1fb65a708
-
SHA512
e61b4f5940cef163636416ca631b015726e3d8337c2fefb346cd6a8ec5d53b7d8a56a22b669198ec8e5d0133c99d9b1fdff2fe52043c0f647093e604bf203021
-
SSDEEP
192:bkXQC1FtECVM/bD+d8wDdfecVuuGyDCFtbXRXtTT9Tl9TojS+Es1l0ZLz8q8c3l:bkXQC1FtEgM/b6scVNCk5KLz/8c1
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4128 msedge.exe 4128 msedge.exe 4580 msedge.exe 4580 msedge.exe 4036 identity_helper.exe 4036 identity_helper.exe 3292 msedge.exe 3292 msedge.exe 3292 msedge.exe 3292 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe 4580 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4580 wrote to memory of 4372 4580 msedge.exe 84 PID 4580 wrote to memory of 4372 4580 msedge.exe 84 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 1940 4580 msedge.exe 85 PID 4580 wrote to memory of 4128 4580 msedge.exe 86 PID 4580 wrote to memory of 4128 4580 msedge.exe 86 PID 4580 wrote to memory of 4352 4580 msedge.exe 87 PID 4580 wrote to memory of 4352 4580 msedge.exe 87 PID 4580 wrote to memory of 4352 4580 msedge.exe 87 PID 4580 wrote to memory of 4352 4580 msedge.exe 87 PID 4580 wrote to memory of 4352 4580 msedge.exe 87 PID 4580 wrote to memory of 4352 4580 msedge.exe 87 PID 4580 wrote to memory of 4352 4580 msedge.exe 87 PID 4580 wrote to memory of 4352 4580 msedge.exe 87 PID 4580 wrote to memory of 4352 4580 msedge.exe 87 PID 4580 wrote to memory of 4352 4580 msedge.exe 87 PID 4580 wrote to memory of 4352 4580 msedge.exe 87 PID 4580 wrote to memory of 4352 4580 msedge.exe 87 PID 4580 wrote to memory of 4352 4580 msedge.exe 87 PID 4580 wrote to memory of 4352 4580 msedge.exe 87 PID 4580 wrote to memory of 4352 4580 msedge.exe 87 PID 4580 wrote to memory of 4352 4580 msedge.exe 87 PID 4580 wrote to memory of 4352 4580 msedge.exe 87 PID 4580 wrote to memory of 4352 4580 msedge.exe 87 PID 4580 wrote to memory of 4352 4580 msedge.exe 87 PID 4580 wrote to memory of 4352 4580 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c190e139b9d1c104d9b1262b37e37836_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbe2f46f8,0x7ffdbe2f4708,0x7ffdbe2f47182⤵PID:4372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,5979682781994131012,14960349501725536729,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:1940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,5979682781994131012,14960349501725536729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,5979682781994131012,14960349501725536729,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:82⤵PID:4352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5979682781994131012,14960349501725536729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:3900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5979682781994131012,14960349501725536729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:2888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,5979682781994131012,14960349501725536729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:82⤵PID:1424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,5979682781994131012,14960349501725536729,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5979682781994131012,14960349501725536729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:12⤵PID:4740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5979682781994131012,14960349501725536729,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:12⤵PID:3872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5979682781994131012,14960349501725536729,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:3760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,5979682781994131012,14960349501725536729,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:12⤵PID:4020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,5979682781994131012,14960349501725536729,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3292
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3152
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD553bc70ecb115bdbabe67620c416fe9b3
SHA1af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA256b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
SHA512cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
-
Filesize
152B
MD5e765f3d75e6b0e4a7119c8b14d47d8da
SHA1cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA256986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
SHA512a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
-
Filesize
5KB
MD5a5945cc2de0607391851283ba6eeb1a1
SHA114e0eaf7db0898679ef5c772328e9a19dbfccd74
SHA25629371a0a7999c22e9d0f7d9ae32f4037a512d7233dc71b811c561a4069759f64
SHA512872be9fdbdebe21887284097fa64e04a00853e4005f22ed379ff80ef787fff9026f80200c118ceeb99976da580edfe62cbfd85a247097f0a9731ad50edc6fea6
-
Filesize
6KB
MD52f0345eca4be20437dfb96e07da692f4
SHA1c417ef51757f896df49bc735c7badac0be8b48d6
SHA25626153d6c8558a92647f64ec793f60f8793d57e1bd3e660d97036a2be64f22960
SHA512f71ae72f568e820723caa0430115744b31c4aff40b0f1e2acf82575e980e31c643c89f88d0d7dfb792e75965257bcdae805baa01010a723702dca506115ac188
-
Filesize
6KB
MD5a256042cf31e450ca7fd9a533fe2aa0a
SHA1a9b18770b8bd3faadd562e35ca0dd662807accdf
SHA256da58fd84d8dd469acb4a2f55421fefd2898d95c024cb720478d1b02bbe6e57be
SHA51226c387110e5beac5f858dafcb9babd142db66a14886c256a3352ba3f357e7bb5d8d2ad0907c08e2ae26cf949c38b2642988fbe803d28c2c1bf2ed09b54e6c242
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD517c26deb3a8c99929b5172a9da11d079
SHA1cc4c65be3e499ec0a925ae6105ccdc3ff38053f3
SHA256c5e54876b6ce0884da480a21a7290a8ba41e8771d047e4907fdef2768df19135
SHA5120dd56d06edd0454da3a3f46c8b332a9d616ae3c5e6ee263ca038b409e05dfddd3b66eee48dfe69d15c73a44d35247d9ccce15765b6fea7c55ec7645059e7dcdb