Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/09/2024, 07:23
Static task
static1
Behavioral task
behavioral1
Sample
d9de01570fa16d2307e514fa021d8d8d_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d9de01570fa16d2307e514fa021d8d8d_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d9de01570fa16d2307e514fa021d8d8d_JaffaCakes118.html
-
Size
35KB
-
MD5
d9de01570fa16d2307e514fa021d8d8d
-
SHA1
28c3876ce872f1f0d72193df4e7998e8d95c2381
-
SHA256
66c4cdcbd3e74a857628532f5ca2d8b4c2600349df00870e62099253303921fc
-
SHA512
93795ec4c67f299f5f314bafd5e03e42b43b0d6f714d3e93a1021d714d087955d440c9c982ec6e98fc93bd3f093a1e99576610dd6a937a56d5917a5fbd7b4f2c
-
SSDEEP
768:zwx/MDTHlt88hARHZPX+E1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TIZOf6sggf6lLRk:Q/TbJxNVNu0Sx/P8DK
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3944 msedge.exe 3944 msedge.exe 3432 msedge.exe 3432 msedge.exe 3428 identity_helper.exe 3428 identity_helper.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe 3432 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3432 wrote to memory of 4048 3432 msedge.exe 85 PID 3432 wrote to memory of 4048 3432 msedge.exe 85 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3104 3432 msedge.exe 86 PID 3432 wrote to memory of 3944 3432 msedge.exe 87 PID 3432 wrote to memory of 3944 3432 msedge.exe 87 PID 3432 wrote to memory of 2164 3432 msedge.exe 88 PID 3432 wrote to memory of 2164 3432 msedge.exe 88 PID 3432 wrote to memory of 2164 3432 msedge.exe 88 PID 3432 wrote to memory of 2164 3432 msedge.exe 88 PID 3432 wrote to memory of 2164 3432 msedge.exe 88 PID 3432 wrote to memory of 2164 3432 msedge.exe 88 PID 3432 wrote to memory of 2164 3432 msedge.exe 88 PID 3432 wrote to memory of 2164 3432 msedge.exe 88 PID 3432 wrote to memory of 2164 3432 msedge.exe 88 PID 3432 wrote to memory of 2164 3432 msedge.exe 88 PID 3432 wrote to memory of 2164 3432 msedge.exe 88 PID 3432 wrote to memory of 2164 3432 msedge.exe 88 PID 3432 wrote to memory of 2164 3432 msedge.exe 88 PID 3432 wrote to memory of 2164 3432 msedge.exe 88 PID 3432 wrote to memory of 2164 3432 msedge.exe 88 PID 3432 wrote to memory of 2164 3432 msedge.exe 88 PID 3432 wrote to memory of 2164 3432 msedge.exe 88 PID 3432 wrote to memory of 2164 3432 msedge.exe 88 PID 3432 wrote to memory of 2164 3432 msedge.exe 88 PID 3432 wrote to memory of 2164 3432 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d9de01570fa16d2307e514fa021d8d8d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7d4a46f8,0x7ffe7d4a4708,0x7ffe7d4a47182⤵PID:4048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,6057673757292300843,7107364678204380435,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:22⤵PID:3104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,6057673757292300843,7107364678204380435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,6057673757292300843,7107364678204380435,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:82⤵PID:2164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,6057673757292300843,7107364678204380435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:4212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,6057673757292300843,7107364678204380435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:2412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,6057673757292300843,7107364678204380435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:82⤵PID:544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,6057673757292300843,7107364678204380435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,6057673757292300843,7107364678204380435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:12⤵PID:3716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,6057673757292300843,7107364678204380435,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:12⤵PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,6057673757292300843,7107364678204380435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:12⤵PID:4116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,6057673757292300843,7107364678204380435,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:12⤵PID:2708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,6057673757292300843,7107364678204380435,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3724 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4320
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4404
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4492
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ff63763eedb406987ced076e36ec9acf
SHA116365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA2568f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
SHA512ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
-
Filesize
152B
MD52783c40400a8912a79cfd383da731086
SHA1001a131fe399c30973089e18358818090ca81789
SHA256331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
SHA512b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
-
Filesize
614B
MD5c982df60221b68d4449538781ac4fa5c
SHA194fd85af6631acd530b40351968c3839aec5d616
SHA25690fa7261a0c05ba83faa81d4926878f824627a2ef3fa688a851f1fa97626189a
SHA512a7b1f71c8962c0500d210dd8f12e4295c05f9df78f6a5b4a138c45679fbda5d7a6abad6aa59e668f13f7c5c512281a33fd63497613c64dfda0157a23b128c3a6
-
Filesize
6KB
MD54ba28a84fc64fe10179c681120ed334c
SHA1f760794d882d8d4f00f98c76aa0a38543410cd3a
SHA2562c2bbc41c2bd3137006ba894fcd9930e2fca0317a7d557adf1008bf1484f6b5e
SHA5127edb344749fe7ac8bf8570f3baed29988df8341f556f6a72cbd49eb415222dde352dd92534df690b5b11ced4ee68c683e7d4e0eaf76138dffeb45239273a77b4
-
Filesize
5KB
MD5110266702d5b8e02138e06beb5a49bfd
SHA1a2bf91dd9d6a57a553ebd876f6cbe6b00586169c
SHA256e9c8a98176a4f5b4e7ac86ed7b07e4eac7b49b91a6ede0cec0a859f8d2d9ee68
SHA51281c1f9d68376a01e460e0aeb49ea2031a236c4fa09202ed47027bb872f34826184314cf58f03de3ecc14b0775febd7ca8b927444be817b1723799f3b2ae2b3a8
-
Filesize
6KB
MD501ced2046a7abf08fff6cec901c1a259
SHA11b741cf2ccb2c3ebf2387f80500d7f6ee79d0811
SHA2560960d0b88e847cf17007cac0586546825ba7b14d6f2c219366305347095dd087
SHA51228f3934695bf43f5c61fd6f69c4218fca809370a1335d57d0d21941a516b0a1900aa5821f61013dae6cba04a1b33dbe7222319ced80bdf51565c86bb96b4bf7e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD5b5554d6fa7631d4970b69c14cdd9060b
SHA19e58d9e4cc642652d3e7c4036b060bdd774c3784
SHA2561ac25a6e1650688e8bac0326baa0c92f2a01b15e5d6af76c894073fc51ce7fdb
SHA51261fb0fed87c2b9d6de31bc166fcda8439bf88eb28ef27333471f1f740e92119b0b09002cfb8f816b30a88bc0ef7627013751bdb4dd66c46714c521e459942972