Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/09/2024, 04:43
Static task
static1
Behavioral task
behavioral1
Sample
d5ab778f346e150fe76fed669d5310b3_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d5ab778f346e150fe76fed669d5310b3_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d5ab778f346e150fe76fed669d5310b3_JaffaCakes118.html
-
Size
37KB
-
MD5
d5ab778f346e150fe76fed669d5310b3
-
SHA1
1c07b3b7d5e6394bf627e1e715f1c2eaf68b7517
-
SHA256
ba0157b5c5929edcfa5b3dc1350a74e5c1456a281c14adffe3b65e128dbc0b1d
-
SHA512
c95f2c971df32e6bd40b3d4e5896810cd2647182e5c2bf17933c4780007832ac5a965938b70fd4d2f0b34cacb76ae4f62c3dc66d9c0f9ed80d17fa4abec074aa
-
SSDEEP
768:D/bVFRFQW81D4RA+vEOjz6rdG2Gil54RZfPGnf3Gu34ani6781DdRA4vEOjq6h8q:zRFQW81D4RA+vEOjz6raA7IaiC81DdRv
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3916 msedge.exe 3916 msedge.exe 3660 msedge.exe 3660 msedge.exe 1160 identity_helper.exe 1160 identity_helper.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe 1656 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe 3660 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3660 wrote to memory of 4660 3660 msedge.exe 85 PID 3660 wrote to memory of 4660 3660 msedge.exe 85 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3892 3660 msedge.exe 86 PID 3660 wrote to memory of 3916 3660 msedge.exe 87 PID 3660 wrote to memory of 3916 3660 msedge.exe 87 PID 3660 wrote to memory of 2076 3660 msedge.exe 88 PID 3660 wrote to memory of 2076 3660 msedge.exe 88 PID 3660 wrote to memory of 2076 3660 msedge.exe 88 PID 3660 wrote to memory of 2076 3660 msedge.exe 88 PID 3660 wrote to memory of 2076 3660 msedge.exe 88 PID 3660 wrote to memory of 2076 3660 msedge.exe 88 PID 3660 wrote to memory of 2076 3660 msedge.exe 88 PID 3660 wrote to memory of 2076 3660 msedge.exe 88 PID 3660 wrote to memory of 2076 3660 msedge.exe 88 PID 3660 wrote to memory of 2076 3660 msedge.exe 88 PID 3660 wrote to memory of 2076 3660 msedge.exe 88 PID 3660 wrote to memory of 2076 3660 msedge.exe 88 PID 3660 wrote to memory of 2076 3660 msedge.exe 88 PID 3660 wrote to memory of 2076 3660 msedge.exe 88 PID 3660 wrote to memory of 2076 3660 msedge.exe 88 PID 3660 wrote to memory of 2076 3660 msedge.exe 88 PID 3660 wrote to memory of 2076 3660 msedge.exe 88 PID 3660 wrote to memory of 2076 3660 msedge.exe 88 PID 3660 wrote to memory of 2076 3660 msedge.exe 88 PID 3660 wrote to memory of 2076 3660 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d5ab778f346e150fe76fed669d5310b3_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0a3046f8,0x7ffa0a304708,0x7ffa0a3047182⤵PID:4660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13225602034041984656,5209564068857473744,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:3892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,13225602034041984656,5209564068857473744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,13225602034041984656,5209564068857473744,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:82⤵PID:2076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13225602034041984656,5209564068857473744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:12⤵PID:940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13225602034041984656,5209564068857473744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:3760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,13225602034041984656,5209564068857473744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6052 /prefetch:82⤵PID:3372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,13225602034041984656,5209564068857473744,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6052 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13225602034041984656,5209564068857473744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:12⤵PID:4460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13225602034041984656,5209564068857473744,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:12⤵PID:1768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13225602034041984656,5209564068857473744,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:4584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13225602034041984656,5209564068857473744,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:12⤵PID:4016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13225602034041984656,5209564068857473744,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3044 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1656
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2240
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD553bc70ecb115bdbabe67620c416fe9b3
SHA1af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA256b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
SHA512cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
-
Filesize
152B
MD5e765f3d75e6b0e4a7119c8b14d47d8da
SHA1cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA256986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
SHA512a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
-
Filesize
724B
MD534200ff063bba70bc671d593d1a79197
SHA1228e81eb57378843c0fc0cec735d439730a89db4
SHA256a2239e005c796cc75a349df78e9ad84c89dc1ee359d3dab140fdd01e88cb111a
SHA512f1b287181aecc24b6bcc61a80b31e24bfd468bc1503378844c27f4845885e1a76715ddbc1779ed78f7f6ffcfa4569f672508acb64f6a66f61ac52656bc88be1b
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
6KB
MD51d27a767d5da9df941b845376bf2af4a
SHA189197d999e0229318821ab972577e21c8dd9cea7
SHA2565387986a8088883a5990a3c2bc7afebc5075faa7e73f141fa8fcb51c0b4c8deb
SHA51204524877d30b6e7e92d76c8d7f8b3cc91429769c1688433ad863170d18a44d5f160908f2bbe7eca28b8777c518899df82daed7c24187cd01c2b690fa628f6ec8
-
Filesize
5KB
MD5b3f93ff94d4e727167b6ce1d1aabcbe8
SHA19e80ac5125268ab9ca73e0f6473f3be2809ec419
SHA256ffe841c448af1c53dd45f2166d93d97405b25897ff9ebfea0f9a5770842b38b6
SHA512b43ce211101adb433674957a6d604be73aa74869c58991a13df408d083d5708b9f562ca0a577b3becdba886156d93830c724f8734fa505ffd338f5cd1cf09d5b
-
Filesize
6KB
MD5e4ff690f2106a928799b42fe6e8aecd2
SHA14bed19f925eeb04f324eda2155385f5938f40e0b
SHA256547c79a464f0e89d5a30e08c1f83da5edbb5e0a3d0250782b4078090f622354e
SHA51249f1a238cadcb6ab8412cbc00bb62a39c2035497ee305d5731edc0b3f39bc95480edf2e6b9d80e960808b6032cf8fc5c30cd592503dbd417f93bbd8b8b82a5bc
-
Filesize
6KB
MD5b90343a39d8d4fd39012a1943c79ae02
SHA1161f625b296f78c18a3f6213104d5c397fb04ced
SHA256af0914f4658dd3da63ede2398e7321d2c12c12cd459b787181e5bc230f752796
SHA51210a63381b4356aba7c5f98b1bcdc6a4415ce5d8932ce4c2aadaa50b6df47ce96af5a97be9101e3f625bd76df751edc0bffec41a8f0fd37a25b3a989c66e31651
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5d3417fcd14cf33086cafda81d8944871
SHA165fa31fa9da5798209c59b80e44a2c038576ee6e
SHA2566a465db61d175bf15ea9f97183e40dd4d1d534ac423350715308bf6c9829c83b
SHA51242a17959376269a753945615f3e9d19bb67375497bf7d4524b65ade96b0b7cb2396ed1f4b6bc7d0171bfaa1580177414fe29c3c5d67f8146236db42c7600a4e5