Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2024, 19:49
Static task
static1
Behavioral task
behavioral1
Sample
c788e4ed8dc5d10c0856b25a00fefe0a_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c788e4ed8dc5d10c0856b25a00fefe0a_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c788e4ed8dc5d10c0856b25a00fefe0a_JaffaCakes118.html
-
Size
27KB
-
MD5
c788e4ed8dc5d10c0856b25a00fefe0a
-
SHA1
22a41dd7c6df8be806303c4ef5912ffb816e8252
-
SHA256
b73262500187fe090bc64762e54386631806679cb06ffdd26be38a4a77378d90
-
SHA512
3733ef5c3335b304403d34564ea633141ca1cb22e4fd6fbc103dfbed930447f98a5579306413127e94c8418d6a7768854ecae03d01695a3b48c2ab6c08a5186d
-
SSDEEP
192:uwHMb5nLGnQjxn5Q/ynQieZNninQOkEnt+cnQTbnxnQ9elBm60fnRQl7MB5qnYnl:2Q/I0rYn4SjUNI
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4716 msedge.exe 4716 msedge.exe 2680 msedge.exe 2680 msedge.exe 3420 identity_helper.exe 3420 identity_helper.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe 3124 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe 2680 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2680 wrote to memory of 4504 2680 msedge.exe 83 PID 2680 wrote to memory of 4504 2680 msedge.exe 83 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 1588 2680 msedge.exe 84 PID 2680 wrote to memory of 4716 2680 msedge.exe 85 PID 2680 wrote to memory of 4716 2680 msedge.exe 85 PID 2680 wrote to memory of 3248 2680 msedge.exe 86 PID 2680 wrote to memory of 3248 2680 msedge.exe 86 PID 2680 wrote to memory of 3248 2680 msedge.exe 86 PID 2680 wrote to memory of 3248 2680 msedge.exe 86 PID 2680 wrote to memory of 3248 2680 msedge.exe 86 PID 2680 wrote to memory of 3248 2680 msedge.exe 86 PID 2680 wrote to memory of 3248 2680 msedge.exe 86 PID 2680 wrote to memory of 3248 2680 msedge.exe 86 PID 2680 wrote to memory of 3248 2680 msedge.exe 86 PID 2680 wrote to memory of 3248 2680 msedge.exe 86 PID 2680 wrote to memory of 3248 2680 msedge.exe 86 PID 2680 wrote to memory of 3248 2680 msedge.exe 86 PID 2680 wrote to memory of 3248 2680 msedge.exe 86 PID 2680 wrote to memory of 3248 2680 msedge.exe 86 PID 2680 wrote to memory of 3248 2680 msedge.exe 86 PID 2680 wrote to memory of 3248 2680 msedge.exe 86 PID 2680 wrote to memory of 3248 2680 msedge.exe 86 PID 2680 wrote to memory of 3248 2680 msedge.exe 86 PID 2680 wrote to memory of 3248 2680 msedge.exe 86 PID 2680 wrote to memory of 3248 2680 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c788e4ed8dc5d10c0856b25a00fefe0a_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab96846f8,0x7ffab9684708,0x7ffab96847182⤵PID:4504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,9326265300182943491,9275082895144281439,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:1588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,9326265300182943491,9275082895144281439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,9326265300182943491,9275082895144281439,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:82⤵PID:3248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9326265300182943491,9275082895144281439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9326265300182943491,9275082895144281439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:2880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,9326265300182943491,9275082895144281439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1296 /prefetch:82⤵PID:4340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,9326265300182943491,9275082895144281439,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1296 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9326265300182943491,9275082895144281439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:12⤵PID:3756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9326265300182943491,9275082895144281439,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:12⤵PID:2364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9326265300182943491,9275082895144281439,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:12⤵PID:1564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,9326265300182943491,9275082895144281439,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:12⤵PID:3332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,9326265300182943491,9275082895144281439,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3640 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3124
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:656
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4272
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ff63763eedb406987ced076e36ec9acf
SHA116365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA2568f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
SHA512ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
-
Filesize
152B
MD52783c40400a8912a79cfd383da731086
SHA1001a131fe399c30973089e18358818090ca81789
SHA256331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
SHA512b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
-
Filesize
6KB
MD5ef173e9f6513e7c09db3e69ed80a3dcd
SHA149d9136d957675b26c52832930d00f68bd1f1b3d
SHA256a68aeb4e0c8315b50ccbb95407843269ba78c989f55b020d73fc10fa5bd4530e
SHA5123c1a9fa3cb14b1a1f3857490adc27cf176301611e9aa493e49325f9a4b9c551839b1eb60544a3e44d364a3ea34954d5d58c9181dcc9a3613ab33ab5a728b9f95
-
Filesize
5KB
MD5e8a45bd936ab4db51b8a87058212957f
SHA13683d38d99dcbe6e2af2f4feaa31f235fe8c38e1
SHA256ba71f9ffdca48d734665879c7cf5e92235fc3ddc5ff98563bddbbc84313c70aa
SHA5124ca806bc04868e8095141bead2639c32ab7ab8f6b29f5537138368f7687999e9dc017df0d829a25474cd048c7b82fa084f852653ed1a60b13a435243fcd468c1
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dee9af7e-b536-4e64-aa42-f35880016cb5.tmp
Filesize6KB
MD52705f5930e92c734b0e624e1abf4e672
SHA1ac8e1876e7d0df123254f7c57e4f975956bdf7f0
SHA256fabfee5db10faafe6a3da74a66537098bf0351ddbfc3426876947342a575362d
SHA51233659b9b25266828ed2ab709ab4f2a1b2f4f76b7782eb0275a8f5b91a530af4bc0c073f17065022206d72e7618fa64101f3bee8a70854521878ca1bf8a0a9eca
-
Filesize
10KB
MD58425863b8f3e019bbf924f87d6705e8c
SHA1b6bd755ea5bbef049865d0279c837784f544786a
SHA256c133ea8ed88b327949174afc2fb2351bfa40b561c991d2970308eac7c80420d5
SHA512bcdc5f30ccc9921c35cdaa2b862a488d5f246a2fe047332e4c7b58d30db69b275e33da2e03993383e793205665a6e44a0df6b1c6e03ca1d7f0c2ba707c7bd023