Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 20:35
Static task
static1
Behavioral task
behavioral1
Sample
d2c9b0c7a9d872a137ea980a457643e7_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d2c9b0c7a9d872a137ea980a457643e7_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d2c9b0c7a9d872a137ea980a457643e7_JaffaCakes118.html
-
Size
810B
-
MD5
d2c9b0c7a9d872a137ea980a457643e7
-
SHA1
52edffe92d273783b206c80dc5574604d060e3b1
-
SHA256
461b2abe48968aa4ea1505af76ad159876d18f1856238d86be667a972c41d71a
-
SHA512
c16b421d6802eba20f06644ec65a6070a0f4db59a20644143f92d925fee9bc04631947632f6b7233f38ccd9878973efaf4aa38291ba1c761fc7453606323946d
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3148 msedge.exe 3148 msedge.exe 4928 msedge.exe 4928 msedge.exe 64 identity_helper.exe 64 identity_helper.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe 3036 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
pid Process 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe 4928 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4928 wrote to memory of 2912 4928 msedge.exe 83 PID 4928 wrote to memory of 2912 4928 msedge.exe 83 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3712 4928 msedge.exe 84 PID 4928 wrote to memory of 3148 4928 msedge.exe 85 PID 4928 wrote to memory of 3148 4928 msedge.exe 85 PID 4928 wrote to memory of 2412 4928 msedge.exe 86 PID 4928 wrote to memory of 2412 4928 msedge.exe 86 PID 4928 wrote to memory of 2412 4928 msedge.exe 86 PID 4928 wrote to memory of 2412 4928 msedge.exe 86 PID 4928 wrote to memory of 2412 4928 msedge.exe 86 PID 4928 wrote to memory of 2412 4928 msedge.exe 86 PID 4928 wrote to memory of 2412 4928 msedge.exe 86 PID 4928 wrote to memory of 2412 4928 msedge.exe 86 PID 4928 wrote to memory of 2412 4928 msedge.exe 86 PID 4928 wrote to memory of 2412 4928 msedge.exe 86 PID 4928 wrote to memory of 2412 4928 msedge.exe 86 PID 4928 wrote to memory of 2412 4928 msedge.exe 86 PID 4928 wrote to memory of 2412 4928 msedge.exe 86 PID 4928 wrote to memory of 2412 4928 msedge.exe 86 PID 4928 wrote to memory of 2412 4928 msedge.exe 86 PID 4928 wrote to memory of 2412 4928 msedge.exe 86 PID 4928 wrote to memory of 2412 4928 msedge.exe 86 PID 4928 wrote to memory of 2412 4928 msedge.exe 86 PID 4928 wrote to memory of 2412 4928 msedge.exe 86 PID 4928 wrote to memory of 2412 4928 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d2c9b0c7a9d872a137ea980a457643e7_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf8ae46f8,0x7ffbf8ae4708,0x7ffbf8ae47182⤵PID:2912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,711544414972427755,12805142130095875493,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:22⤵PID:3712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,711544414972427755,12805142130095875493,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,711544414972427755,12805142130095875493,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:82⤵PID:2412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,711544414972427755,12805142130095875493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:4584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,711544414972427755,12805142130095875493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:4396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,711544414972427755,12805142130095875493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:12⤵PID:1464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,711544414972427755,12805142130095875493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:12⤵PID:4576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,711544414972427755,12805142130095875493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:3780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,711544414972427755,12805142130095875493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:12⤵PID:3700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,711544414972427755,12805142130095875493,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:12⤵PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,711544414972427755,12805142130095875493,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:82⤵PID:1292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,711544414972427755,12805142130095875493,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:64
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,711544414972427755,12805142130095875493,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:3496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,711544414972427755,12805142130095875493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:12⤵PID:3948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,711544414972427755,12805142130095875493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:12⤵PID:4008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,711544414972427755,12805142130095875493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:12⤵PID:4816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,711544414972427755,12805142130095875493,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5384 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3036
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4940
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ecf7ca53c80b5245e35839009d12f866
SHA1a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA256882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
SHA512706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
-
Filesize
152B
MD54dd2754d1bea40445984d65abee82b21
SHA14b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA256183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
SHA51292d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
6KB
MD5a274e11bdfce2959b4f204d6ffc805c7
SHA1178f215366d552eed5bc800dbcce74d54ca65e55
SHA256e44b6533ca3774a726b9dc876aa721796febf8bf1751887f02bf2359776b3f8e
SHA5129ebf2439a873d124f92f163b57d3fb78773f60abcfbc27cdf28fc1e66e5a88ca8643465e1e4cc9b7805b38f667df9585689fa75d45d20b772d7a567b055d3c07
-
Filesize
5KB
MD556ace9094f0ff874a09155cee0b5af9b
SHA1e507934c41d560fef3c253f98b5b90838d5a9246
SHA256c38154071712a75b4f32e841ddc7a03e2f08b3bf0d6827e7d6d7f629cacb8cdd
SHA5120d5f64fe6f2b61c9217f46f6084c78fde6abae693d7c29266938ae913b682681e67736e312bb9c28563b66fe9a6ec8fd100f0f7a223c26e36ab65a8f1bf825f9
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD55cf7ea825d8903f516fa90262c29c942
SHA15ebe6986875fbfe8956b377608fb8875026c0c5b
SHA25685b884c0d71688c738208cbb53f804a6bdc0ca74e934a5fb88a15223f862026e
SHA5121c24e2b67ab9e9c0281970bc894f252d326e30c963e6e4656245ccc8efd537dd85a11c071d08f64aec8c453ebeb1749dac1baeced7491e8c8c219e4d572bf1f0