Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 19:33
Static task
static1
Behavioral task
behavioral1
Sample
c97d26d33af41cbbcd4fe135a103b4b9_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c97d26d33af41cbbcd4fe135a103b4b9_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c97d26d33af41cbbcd4fe135a103b4b9_JaffaCakes118.html
-
Size
198KB
-
MD5
c97d26d33af41cbbcd4fe135a103b4b9
-
SHA1
6d5cd9ebd6cae0ca622353481e08bf3f5fe2767c
-
SHA256
f13d78798f88c2449cc5cd9413512868d2d63b14ccfacb0be4dc42de5ff25426
-
SHA512
c60c85d2327f45e52986a05a6b167d404daaa1374b7cd8c7c577f3eb3ff9b1b5a238019ae07a6c32fe4c4cb8a19013fc06751a53fe61b59697f84d792b00f59b
-
SSDEEP
3072:S1myfkMY+BES09JXAnyrZalI+Y6XXI6EyA8:S1jsMYod+X3oI+YS1tA8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3648 msedge.exe 3648 msedge.exe 1820 msedge.exe 1820 msedge.exe 3492 identity_helper.exe 3492 identity_helper.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe 1820 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1820 wrote to memory of 544 1820 msedge.exe 84 PID 1820 wrote to memory of 544 1820 msedge.exe 84 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 4168 1820 msedge.exe 87 PID 1820 wrote to memory of 3648 1820 msedge.exe 88 PID 1820 wrote to memory of 3648 1820 msedge.exe 88 PID 1820 wrote to memory of 5116 1820 msedge.exe 89 PID 1820 wrote to memory of 5116 1820 msedge.exe 89 PID 1820 wrote to memory of 5116 1820 msedge.exe 89 PID 1820 wrote to memory of 5116 1820 msedge.exe 89 PID 1820 wrote to memory of 5116 1820 msedge.exe 89 PID 1820 wrote to memory of 5116 1820 msedge.exe 89 PID 1820 wrote to memory of 5116 1820 msedge.exe 89 PID 1820 wrote to memory of 5116 1820 msedge.exe 89 PID 1820 wrote to memory of 5116 1820 msedge.exe 89 PID 1820 wrote to memory of 5116 1820 msedge.exe 89 PID 1820 wrote to memory of 5116 1820 msedge.exe 89 PID 1820 wrote to memory of 5116 1820 msedge.exe 89 PID 1820 wrote to memory of 5116 1820 msedge.exe 89 PID 1820 wrote to memory of 5116 1820 msedge.exe 89 PID 1820 wrote to memory of 5116 1820 msedge.exe 89 PID 1820 wrote to memory of 5116 1820 msedge.exe 89 PID 1820 wrote to memory of 5116 1820 msedge.exe 89 PID 1820 wrote to memory of 5116 1820 msedge.exe 89 PID 1820 wrote to memory of 5116 1820 msedge.exe 89 PID 1820 wrote to memory of 5116 1820 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c97d26d33af41cbbcd4fe135a103b4b9_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9b7b46f8,0x7ffa9b7b4708,0x7ffa9b7b47182⤵PID:544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,15993772813957485152,11183322338637823674,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:22⤵PID:4168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,15993772813957485152,11183322338637823674,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,15993772813957485152,11183322338637823674,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:82⤵PID:5116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15993772813957485152,11183322338637823674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:1564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15993772813957485152,11183322338637823674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:1276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,15993772813957485152,11183322338637823674,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:82⤵PID:3680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,15993772813957485152,11183322338637823674,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15993772813957485152,11183322338637823674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:12⤵PID:4956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15993772813957485152,11183322338637823674,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:12⤵PID:3956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15993772813957485152,11183322338637823674,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:12⤵PID:3188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,15993772813957485152,11183322338637823674,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:12⤵PID:3616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,15993772813957485152,11183322338637823674,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5188 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3364
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3956
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD56837505dae817f02bbb549d3910f76ec
SHA14bead1243a3ed4ba876f30031d11b7fcd4052b84
SHA256997f7c6bb1805cb785d5c0ce131c8cb2362e6dc77efb38c3980f69b7a789a649
SHA5124382a76e27e70b6ecc05c14e9a1b915e36ca661cb868042b28d59a7d807ae1ba069aa0e734648225dee2b6dc33626f58ee24df1cc451217fa093f46d5df616d4
-
Filesize
152B
MD5e15f9acde9d56006be268b4025f94b5b
SHA15d36b646b34f0a1d08b6020f12e548db96865906
SHA256045480199f3befc5d2eee18f84e92cc5bf8881b76ac168085a987878da798e0c
SHA51222d43f812391c9fafde0a4e247212e491765e8f049eb56d692f248623b7a52044ceab8e6977675c343d502b460666bd72a4ea970f9aaa7a6b8a6c3a880bcc255
-
Filesize
5KB
MD5cce5449c3a709fb4dd8becb2fa9bc1bf
SHA1cfe13abc83d1c3dc96d9a388ef1e24ee714d548b
SHA2562083d5ee4ae64a021ba3761dc11d74d9e8897df657b50e7e8b715645e60517ed
SHA512dbe4abee0f5dba0e765c6f17ccaae7ef73c3f79bfa8f1c3c9de00226e551ec25df116de34f1d210fb570eba6dbfecf72f207cab2872212bdbdc4f32276b995b4
-
Filesize
5KB
MD5fb8045684456892509474a267002a144
SHA1cceca7fcc63ae84b9fcb344559a1db008d2d78d3
SHA2562e0118ab147ea65e02eec2fa69ab408b4833d36f25da7dc9f6b82e689c108af4
SHA512d4d80175604b5e1729259dce67a1b3fc08c99403c64042c352b8c9889f4fb4ee14dc4688be2563888e32877c17f4b138a4e266d07bc965dc64c49ec409079858
-
Filesize
24KB
MD5e311e8070a5db17b6cab425cdb01bd27
SHA1ac533db7fa0902f34d02662fd029facbf4b8e8c6
SHA256b9aaa4c71488c3a8769cee7cf502ab93813fd6df60ff2172ba8cb7e1dec86532
SHA51287accdca84a2b2042e2c12381cd1bc0fb2d74bbb0c6a4d18f444212803ebc0b7184317df7f5fb3eac722d5d43d942dd62ee1d760f0b3fd18911df5bd04fa31c6
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD55632af8879833258e7a92b0942045828
SHA1a437948710f9170374f1213593473aca6a9c5454
SHA256a7e2be8d65899501fd7c56461c06fc0225c853292849f45b0f7e026d635ca099
SHA5126d11d05507df5d8d99418ac2c0b293a3c864c3d1e3feacb3b0ea7544c928169faa3a38dd639bfe7dbe9578b548b0df2d786faf872fe46a81395b13b71d69b660