Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/09/2024, 07:13
Static task
static1
Behavioral task
behavioral1
Sample
d5d8eae16240f3e906a794d91bb839dd_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d5d8eae16240f3e906a794d91bb839dd_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d5d8eae16240f3e906a794d91bb839dd_JaffaCakes118.html
-
Size
10KB
-
MD5
d5d8eae16240f3e906a794d91bb839dd
-
SHA1
16643d1e733d80eac87e4c5b4c739f76d883453e
-
SHA256
9418d72900a3d9b94ed6fe175e9cfd1d12264ae6944f74e8e6e419abfbcaae49
-
SHA512
3a139368e09ca71a2f487fefc795ad5d6dc84893525e11d2f70e208d93170142266542d438898336ec89a3f9be688d90669996ebbe303a6361ce3efd76515de3
-
SSDEEP
96:PG9o3EH4uvgGkp7iBACNNQjRSpdKFU96wrBzBA54Y0RM6nNtHpPDzSid/WWtzC9o:Pd9pWrbGUciBA5jONtViVwz83h/TU
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2308 msedge.exe 2308 msedge.exe 3996 msedge.exe 3996 msedge.exe 4964 identity_helper.exe 4964 identity_helper.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe 948 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe 3996 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3996 wrote to memory of 4856 3996 msedge.exe 83 PID 3996 wrote to memory of 4856 3996 msedge.exe 83 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2604 3996 msedge.exe 84 PID 3996 wrote to memory of 2308 3996 msedge.exe 85 PID 3996 wrote to memory of 2308 3996 msedge.exe 85 PID 3996 wrote to memory of 3164 3996 msedge.exe 86 PID 3996 wrote to memory of 3164 3996 msedge.exe 86 PID 3996 wrote to memory of 3164 3996 msedge.exe 86 PID 3996 wrote to memory of 3164 3996 msedge.exe 86 PID 3996 wrote to memory of 3164 3996 msedge.exe 86 PID 3996 wrote to memory of 3164 3996 msedge.exe 86 PID 3996 wrote to memory of 3164 3996 msedge.exe 86 PID 3996 wrote to memory of 3164 3996 msedge.exe 86 PID 3996 wrote to memory of 3164 3996 msedge.exe 86 PID 3996 wrote to memory of 3164 3996 msedge.exe 86 PID 3996 wrote to memory of 3164 3996 msedge.exe 86 PID 3996 wrote to memory of 3164 3996 msedge.exe 86 PID 3996 wrote to memory of 3164 3996 msedge.exe 86 PID 3996 wrote to memory of 3164 3996 msedge.exe 86 PID 3996 wrote to memory of 3164 3996 msedge.exe 86 PID 3996 wrote to memory of 3164 3996 msedge.exe 86 PID 3996 wrote to memory of 3164 3996 msedge.exe 86 PID 3996 wrote to memory of 3164 3996 msedge.exe 86 PID 3996 wrote to memory of 3164 3996 msedge.exe 86 PID 3996 wrote to memory of 3164 3996 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d5d8eae16240f3e906a794d91bb839dd_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff6bd746f8,0x7fff6bd74708,0x7fff6bd747182⤵PID:4856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,6422567634305996578,6505646393645806403,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:22⤵PID:2604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,6422567634305996578,6505646393645806403,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,6422567634305996578,6505646393645806403,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:82⤵PID:3164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6422567634305996578,6505646393645806403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:4508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6422567634305996578,6505646393645806403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:2864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6422567634305996578,6505646393645806403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:12⤵PID:392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6422567634305996578,6505646393645806403,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:12⤵PID:1724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,6422567634305996578,6505646393645806403,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:82⤵PID:2652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,6422567634305996578,6505646393645806403,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6422567634305996578,6505646393645806403,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:12⤵PID:3024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6422567634305996578,6505646393645806403,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵PID:2112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,6422567634305996578,6505646393645806403,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4876 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:948
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:972
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4352
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5eeaa8087eba2f63f31e599f6a7b46ef4
SHA1f639519deee0766a39cfe258d2ac48e3a9d5ac03
SHA25650fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
SHA512eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
-
Filesize
152B
MD5b9569e123772ae290f9bac07e0d31748
SHA15806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA25620ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
SHA512cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
-
Filesize
300B
MD529f023490c955b3b63d0c15c288b8e7b
SHA122c40795e653e73972bd63ab498ddfb16931a080
SHA25681da7d7cb240530e78361cf47ac4fe5f80f06b641865c04469c9b52395bcdc6e
SHA5127065b88d5b48d3be1c1506876b9f5221331af8d1057dc5be6b0e96d1d56cc567b79e43255dd2c457529873346a464cdab006e8d921873b726c99164788008d09
-
Filesize
5KB
MD5ccde3ab28702d16f72d97c0f715ad9a5
SHA1346ef68eeea7486699092dfa06c3e8017c04b93d
SHA256696d180683d9a2f3b7902f190ee8a93f83227ab8c8dd5307ba01b0a960978010
SHA51265e65fe42f03e17668178203fb0bf5843ed3bd3afdce7df8bb641ecef03a6fe1e4ff2420408ab43452ae2070639c94975183c560f7bb7ce6c60d1621a3ee9dc4
-
Filesize
6KB
MD5c5e780d1c97fa32f956c5f4a6ddff31e
SHA1a0679aedb2a737bcd30c9f915191522f61c2600c
SHA256cae24a011c7ecdadde459ae6b0e3ed8db08f742ab72026cd45a1ba8cfa9a9303
SHA5124073d12ce9d51be9d0388ff3ab8922366994442b825e596be164a6f81c35853a3e34996047ac3f30426aafc32ec930ec68361644f0403bbd5eb4e91570e520f8
-
Filesize
6KB
MD5cc444be74c60c6e3f191798e9adc24c7
SHA1adc77af6a68fac33d00df988f34a8964fbaeba61
SHA256a2dccfc1287832389b70d2f292ab7f93180d3faac46c99073d96e34961b49e61
SHA5120a1993bde00dea23c4f2107b46f6f41db37ab7941ca8e6033c1322c843439dd975449e6e2fd82ae5ba18acee546ff574894cc2615132586707f673de1e0eb5a6
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD560f2b7acdbc1f0688a73c141058591a2
SHA1b870bf25a4abb2c2cabe4fe739a54db09cc74e44
SHA2565488309d3b5dd4dc3b8ae8dc2125edd0e7b81d9ece605d5fb78f167b96540692
SHA512564910ae1a8020a52b91e61f238e264497fd5a0ed873338f4be0d6b31173b7eff5140c62f3dd2e268d0ab8b963464d80ef1b8e0f1aa740b23130dbd3ff437b33