Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 12:11
Static task
static1
Behavioral task
behavioral1
Sample
d4545c356808fc169c4f81810c3fb331_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d4545c356808fc169c4f81810c3fb331_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d4545c356808fc169c4f81810c3fb331_JaffaCakes118.html
-
Size
486KB
-
MD5
d4545c356808fc169c4f81810c3fb331
-
SHA1
07e5a3ddd3e33ed46deb86c21a0db5d42384a64a
-
SHA256
f74fdd465566a41ae85619cb4c7a687af2052d9bb601065dc604cf566e2d2268
-
SHA512
99f44239780114199196343567d03974d7d884dd6d23e7d90f72e262a65db6efe9d1d8d181cba174c35723db9b25123d3c60956de2e0a6c1482499b487c5b527
-
SSDEEP
12288:kfyuIZ83pREwaJXBmzrYqz3up5jusbfO1c/vB:ii832Bmqp7
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1760 msedge.exe 1760 msedge.exe 720 msedge.exe 720 msedge.exe 1352 identity_helper.exe 1352 identity_helper.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe 4028 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe 720 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 720 wrote to memory of 3764 720 msedge.exe 83 PID 720 wrote to memory of 3764 720 msedge.exe 83 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 2836 720 msedge.exe 84 PID 720 wrote to memory of 1760 720 msedge.exe 85 PID 720 wrote to memory of 1760 720 msedge.exe 85 PID 720 wrote to memory of 4852 720 msedge.exe 86 PID 720 wrote to memory of 4852 720 msedge.exe 86 PID 720 wrote to memory of 4852 720 msedge.exe 86 PID 720 wrote to memory of 4852 720 msedge.exe 86 PID 720 wrote to memory of 4852 720 msedge.exe 86 PID 720 wrote to memory of 4852 720 msedge.exe 86 PID 720 wrote to memory of 4852 720 msedge.exe 86 PID 720 wrote to memory of 4852 720 msedge.exe 86 PID 720 wrote to memory of 4852 720 msedge.exe 86 PID 720 wrote to memory of 4852 720 msedge.exe 86 PID 720 wrote to memory of 4852 720 msedge.exe 86 PID 720 wrote to memory of 4852 720 msedge.exe 86 PID 720 wrote to memory of 4852 720 msedge.exe 86 PID 720 wrote to memory of 4852 720 msedge.exe 86 PID 720 wrote to memory of 4852 720 msedge.exe 86 PID 720 wrote to memory of 4852 720 msedge.exe 86 PID 720 wrote to memory of 4852 720 msedge.exe 86 PID 720 wrote to memory of 4852 720 msedge.exe 86 PID 720 wrote to memory of 4852 720 msedge.exe 86 PID 720 wrote to memory of 4852 720 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d4545c356808fc169c4f81810c3fb331_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa198346f8,0x7ffa19834708,0x7ffa198347182⤵PID:3764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,13526078986115731143,16304168591345831405,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:22⤵PID:2836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,13526078986115731143,16304168591345831405,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,13526078986115731143,16304168591345831405,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:82⤵PID:4852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13526078986115731143,16304168591345831405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:12⤵PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13526078986115731143,16304168591345831405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:12⤵PID:864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,13526078986115731143,16304168591345831405,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 /prefetch:82⤵PID:4636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,13526078986115731143,16304168591345831405,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13526078986115731143,16304168591345831405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:12⤵PID:2108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13526078986115731143,16304168591345831405,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:12⤵PID:692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13526078986115731143,16304168591345831405,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:1216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13526078986115731143,16304168591345831405,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:12⤵PID:4148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,13526078986115731143,16304168591345831405,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4028
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2740
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1584
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59e3fc58a8fb86c93d19e1500b873ef6f
SHA1c6aae5f4e26f5570db5e14bba8d5061867a33b56
SHA256828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4
SHA512e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e
-
Filesize
152B
MD527304926d60324abe74d7a4b571c35ea
SHA178b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1
SHA2567039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de
SHA512f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd
-
Filesize
326B
MD51aac375b60827b9859d42965b9701704
SHA19147ba7c2472942aadc3808fa6e108fd02db0161
SHA2564458d711bd3329b93eef1f32fd1d8dc86b204d0dc4d25e298c84a9d4029f4645
SHA512f1252f9318554833230d72fea3a846693f025c5c75b4bca736f092c0106348c86f37c6bca3085fc8dcb4eaf74baeda59952e415f255820d70a8764030b2795d4
-
Filesize
5KB
MD5824e231bdf8697e669a439e093afae15
SHA1655e2c40720bf287a780f4a75a20d40bdd23e85e
SHA2560d86a76727a998d744a2a4f7dc21cd61b46d5cc44922d11ad376ce2e21fad107
SHA512a11669da04b65a1d1183f728fb06ac0aab98ed990c33ba9474b3875ad412598798cc3f5905505bf38019320d5619546324a45f964eef8a138134598b744f5114
-
Filesize
6KB
MD57d079d46fc5c9ab3db5e8af3e346f566
SHA1ed9ad1384ef58870e31cb3d479865707e56af4f4
SHA256a7c58c8ade2e60b6298cee63a80abcc4ae80d51d049d65697e8d7e7ce59ea079
SHA512c44fdfca3ebb0b253a33341b1b84cc2d400bd5476016b14befed022b06f5d7ddf38c14e2a9978183fc604b746eabca72e4798f55db1d51e6282f42ac30110eeb
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD50589a1b1f4c1724e50bb04dc8efda937
SHA18011ca897da42b0d9d9042ede2b237c8661a5fb9
SHA2560f39511fe6426100cd5b2a85684499ed2233f78fa2d97f0bc9acebd7a699eaca
SHA51295c9f29a6e904d9bc67b77000b9577afbc58f6ceb505f10180c078a96d94bf6e505a16bdf1ae5c86df5a0e1e8cd6273f453eaa3aed9ac8b4cb062c1de77ed9a1