Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2024, 18:54
Static task
static1
Behavioral task
behavioral1
Sample
dcd9bf8f03ba1c3d13b7fbf1db64ccc8_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dcd9bf8f03ba1c3d13b7fbf1db64ccc8_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
dcd9bf8f03ba1c3d13b7fbf1db64ccc8_JaffaCakes118.html
-
Size
37KB
-
MD5
dcd9bf8f03ba1c3d13b7fbf1db64ccc8
-
SHA1
5915044c9a3b1518fa91a32df3a271ca28b97f72
-
SHA256
30e7a8e35f9e50546b1cf064a8578b453583840c024b3878061c52dad7b3d099
-
SHA512
059f7378defc0affe4c386c20e244d299823b660fc1e23655b9479c0b69b90e444bab85fd554ba7bfb514818ac78aa96415dbd41af4ecd7a612ccdbdfd87ef32
-
SSDEEP
768:PA152HzZdeN/WCN0OEdcqVUDDkMCmoOla6VJ86Ia29uJu3UV:40zZdeN/WCN0OEdcqVUDDkMY6Vor3UV
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4596 msedge.exe 4596 msedge.exe 3376 msedge.exe 3376 msedge.exe 1728 identity_helper.exe 1728 identity_helper.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe 1720 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe 3376 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3376 wrote to memory of 3168 3376 msedge.exe 86 PID 3376 wrote to memory of 3168 3376 msedge.exe 86 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 5092 3376 msedge.exe 87 PID 3376 wrote to memory of 4596 3376 msedge.exe 88 PID 3376 wrote to memory of 4596 3376 msedge.exe 88 PID 3376 wrote to memory of 2240 3376 msedge.exe 89 PID 3376 wrote to memory of 2240 3376 msedge.exe 89 PID 3376 wrote to memory of 2240 3376 msedge.exe 89 PID 3376 wrote to memory of 2240 3376 msedge.exe 89 PID 3376 wrote to memory of 2240 3376 msedge.exe 89 PID 3376 wrote to memory of 2240 3376 msedge.exe 89 PID 3376 wrote to memory of 2240 3376 msedge.exe 89 PID 3376 wrote to memory of 2240 3376 msedge.exe 89 PID 3376 wrote to memory of 2240 3376 msedge.exe 89 PID 3376 wrote to memory of 2240 3376 msedge.exe 89 PID 3376 wrote to memory of 2240 3376 msedge.exe 89 PID 3376 wrote to memory of 2240 3376 msedge.exe 89 PID 3376 wrote to memory of 2240 3376 msedge.exe 89 PID 3376 wrote to memory of 2240 3376 msedge.exe 89 PID 3376 wrote to memory of 2240 3376 msedge.exe 89 PID 3376 wrote to memory of 2240 3376 msedge.exe 89 PID 3376 wrote to memory of 2240 3376 msedge.exe 89 PID 3376 wrote to memory of 2240 3376 msedge.exe 89 PID 3376 wrote to memory of 2240 3376 msedge.exe 89 PID 3376 wrote to memory of 2240 3376 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dcd9bf8f03ba1c3d13b7fbf1db64ccc8_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe5ba46f8,0x7ffbe5ba4708,0x7ffbe5ba47182⤵PID:3168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17995891119249444157,14200516238332787496,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:5092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,17995891119249444157,14200516238332787496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2600 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,17995891119249444157,14200516238332787496,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:82⤵PID:2240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17995891119249444157,14200516238332787496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:5096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17995891119249444157,14200516238332787496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:3920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,17995891119249444157,14200516238332787496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:82⤵PID:2104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,17995891119249444157,14200516238332787496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17995891119249444157,14200516238332787496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:12⤵PID:4028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17995891119249444157,14200516238332787496,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:12⤵PID:4852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17995891119249444157,14200516238332787496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:12⤵PID:4384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17995891119249444157,14200516238332787496,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:12⤵PID:2332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17995891119249444157,14200516238332787496,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1948 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1720
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3036
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1372
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5709c6f4a32b317f6487b598788b6353d
SHA150f44d43be9630018f0bd2acb1528df07cd05b7f
SHA256353aff71e8cf078c88c836e66d86be266ddbe36496a597b9b5a5a87d21eae83b
SHA5124f33792eb73a792c88e8e2dc8bef7b00a2af7b1b91f4bab0cd5076dd2cb9abbb752eb7e60a4c6204d15f9bca1562915f2468b94e5f01f79279e1e7469055f0a3
-
Filesize
152B
MD59ebc024cdb324eb41f33c6ec63d1458d
SHA1f623e96981ee63c1b6879f682c4364fd5c2265e5
SHA25623b9bd7316816043f42a80784e7f247f3afebd3dbe370fbc702189a6a0dddb1f
SHA5126971b6430bc01a36c48bc1e41cf8c4bed65a2890837f7778a896072159940ae739d11834176cc7be6cf6fa0f2ea9e6764c30cd23beadcc88c390e5573bbad097
-
Filesize
1KB
MD5e566e28be52668f25bea4c09cc3a1d60
SHA1900cd597d204464b7fad1fd921af519ac9124094
SHA2562a030f848ea3604824761a65b37dd22e250aec4db07005599d0e22aa5ff43eea
SHA512e70d29e9886751073091b640159a42a628539f38314580087e2d4ae4e68d63318540002e64cab88e20a0f9ba9ae8a4814966923d774cdbb0c05f369fb8110181
-
Filesize
5KB
MD5d1bb783a2318c2854327ba49a7a5e857
SHA1440c4b51abdb2b073f19aea9bb230d04bf3d7bd3
SHA256b46f706ee8d267d986973a52f2760c44782348fbb2fe8e6f92a772ffe5bfc23d
SHA5121ef4ac5ebc74e1cff493ccf58d3875af2eaeac7ca8e8c132cbd031bdd9b972394f53f9dc27168b3f75d830ad5f5825ddb53e86cc30b3e1d3b6cbcdb5c5a3b83d
-
Filesize
5KB
MD5cf84998cf1632afe64c5cabce77dd662
SHA1f23798bf6c4069be3bc9b11a3b2e16e59b1f6cce
SHA2568d3eb7aa3acad68c3cc539c26f897dcab5a7038615a6da5fb63e395c5e0efca3
SHA512b0c7fe8b8a103df8cae274ebb09627dd571428f439b9d75358ff725f07a57693947b4adcf790296bd9ce5adb9e40d1d18d6e516ecfe486ead1d145c6241147ba
-
Filesize
5KB
MD5105d8af2ad076ae04ad399bff1eceabf
SHA109bdba00591af9661150e97f4332cbdd5f8376c5
SHA256f2f106368f0c66372898a0077b42fbbf89d0e577c5456fc9ecdee1584c3ed498
SHA5128bb8e3760aa76c6a681f97a69d11090de7fa4be42cd8c1519ed7a8a29c812282ce2016a4a03249d51b4f6fa91be48e297c81c390bb3afc3b6db2ac05903ec5cb
-
Filesize
24KB
MD5494a861dfe3fb61b7f6e9a8e1f92d179
SHA1903db9c91a888cdd2a359e921ea2c1a958228aa9
SHA25646ffd9cec0b1524402f64218ea9584cb751cd61e56eae54ac0ad61c55273c690
SHA512f97bfb87546ee38f100ef52f6ee6d102d05feb378a940954a1953f5dc301e6ae7a91de2b2176dcac165a61abf867e06e3e31572a378b1abd9ea2768de76e7175
-
Filesize
204B
MD549346a8ce8b45593e7da0d087cabb10c
SHA1008ece9ed1300e5bb18310544561c3e64e1242aa
SHA25607bcbeaf353118e3520ad5c422cfe145d698aa2c74d984432701a6f9133c98d3
SHA512f761f172acca2c7eee9236e7d56933812d4e64aa4077cefb6b4d9b3a3ae87837d0193fd5e56d86fccf08a67ee21b71abdbb061ab085823f98061a10c4d7d989f
-
Filesize
204B
MD59cb7709203bc7fbc2627337d38eb2e19
SHA1cf5e07370d81b78fe21bc34729e816d6a661d1fb
SHA256dab127e4a5c9407ef914cee5fa5bb5473634d46d9c8f811db347c017c9b8dadd
SHA512e0b11ee56759195cc0e072f21c51709e5b87750b399c786f0f1ffb4effd18a4433297163dcb09ae050668ba1d765d98ac0eaac2db34e2a09f7a8c84dff7e3adb
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5aeee99b5c700d5d6ae877d89b49ea08d
SHA1f501a2042ff483fa6e080ebd69649f6b6a80d717
SHA256bba321bc5d25a772ab818b2967ef88e90743a2af08677699a240e9601ecb7a0d
SHA5127494cd953c1ee1829b1f9d5bcd2b7cc762ca938cde5d9f053101553e918357ad553d6bee0955de5f0a630e0e260be71dfbc4815ecfad1d633c9d5975f1316c31