Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2024, 00:47
Static task
static1
Behavioral task
behavioral1
Sample
dd5922d5e692f4fe6151d0c9264c2f6e_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
dd5922d5e692f4fe6151d0c9264c2f6e_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
dd5922d5e692f4fe6151d0c9264c2f6e_JaffaCakes118.html
-
Size
94KB
-
MD5
dd5922d5e692f4fe6151d0c9264c2f6e
-
SHA1
50764a4544f21729070407b3473c7110cbb83628
-
SHA256
7130b7b9a81f5ef66b5ade5408c95fafc340ceee60b27d43890649186d6f5989
-
SHA512
c1b9df9d7d8f0836960d2528390b55706e12053f9e3c11a7c4ec609dad8276f8eb49ff8374ef2775dc1c8b41de3df25e5cda9924979cbe10c40e58f1a7df3ce7
-
SSDEEP
1536:WMLiN1rl48FLe2Otdn4fiq6/NRs7LR8Dyp8BZbHBdkrY8mgHC+qpEyW:WAiFwHBdkrY8mgHC+qpEyW
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3700 msedge.exe 3700 msedge.exe 1088 msedge.exe 1088 msedge.exe 964 identity_helper.exe 964 identity_helper.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe 1684 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe 1088 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1088 wrote to memory of 2812 1088 msedge.exe 83 PID 1088 wrote to memory of 2812 1088 msedge.exe 83 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 4204 1088 msedge.exe 84 PID 1088 wrote to memory of 3700 1088 msedge.exe 85 PID 1088 wrote to memory of 3700 1088 msedge.exe 85 PID 1088 wrote to memory of 3516 1088 msedge.exe 86 PID 1088 wrote to memory of 3516 1088 msedge.exe 86 PID 1088 wrote to memory of 3516 1088 msedge.exe 86 PID 1088 wrote to memory of 3516 1088 msedge.exe 86 PID 1088 wrote to memory of 3516 1088 msedge.exe 86 PID 1088 wrote to memory of 3516 1088 msedge.exe 86 PID 1088 wrote to memory of 3516 1088 msedge.exe 86 PID 1088 wrote to memory of 3516 1088 msedge.exe 86 PID 1088 wrote to memory of 3516 1088 msedge.exe 86 PID 1088 wrote to memory of 3516 1088 msedge.exe 86 PID 1088 wrote to memory of 3516 1088 msedge.exe 86 PID 1088 wrote to memory of 3516 1088 msedge.exe 86 PID 1088 wrote to memory of 3516 1088 msedge.exe 86 PID 1088 wrote to memory of 3516 1088 msedge.exe 86 PID 1088 wrote to memory of 3516 1088 msedge.exe 86 PID 1088 wrote to memory of 3516 1088 msedge.exe 86 PID 1088 wrote to memory of 3516 1088 msedge.exe 86 PID 1088 wrote to memory of 3516 1088 msedge.exe 86 PID 1088 wrote to memory of 3516 1088 msedge.exe 86 PID 1088 wrote to memory of 3516 1088 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dd5922d5e692f4fe6151d0c9264c2f6e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82fc046f8,0x7ff82fc04708,0x7ff82fc047182⤵PID:2812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,14049589295349787385,6819372112013549458,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:4204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,14049589295349787385,6819372112013549458,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,14049589295349787385,6819372112013549458,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:82⤵PID:3516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14049589295349787385,6819372112013549458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:5072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14049589295349787385,6819372112013549458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:3728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,14049589295349787385,6819372112013549458,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:82⤵PID:4692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,14049589295349787385,6819372112013549458,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14049589295349787385,6819372112013549458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:12⤵PID:1520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14049589295349787385,6819372112013549458,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:12⤵PID:2268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14049589295349787385,6819372112013549458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:1212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,14049589295349787385,6819372112013549458,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:12⤵PID:952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,14049589295349787385,6819372112013549458,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1684
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4860
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4428
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d7114a6cd851f9bf56cf771c37d664a2
SHA1769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA256d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
SHA51233bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
-
Filesize
152B
MD5719923124ee00fb57378e0ebcbe894f7
SHA1cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA256aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
SHA512a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
-
Filesize
178B
MD5efb3e41ddcb00d4e436d59962fe73c4d
SHA14b9f2cbd664cf2136cd6966774f9ee04b4efa46a
SHA256edc776d59064e412098066a07cba55cbabb1e7d18534e1292d34003961ad3bb6
SHA51285a53139125a0e589b222ebee00d1c593eb24c8059b9f3f86196f8ef346cf7fc988493bb6f5cebf7aec2d0debc5017eff291b04e8aa37180d1ec5a6e2bb362ba
-
Filesize
5KB
MD5e0445a26e22655bec7b7bbff17248bbc
SHA1acbeace2619f3864254138e0ca09fd3801d1a651
SHA256e067e829815ddde51a6f5e7d9885e0c9a6b23f73fd9ca6be8165cc6ca2b41fd9
SHA5128864c48be8cd7fd8faecff112688c93ddba565f19b753d386367196c221765624ebeb2c356cbad1b7eb5858ea9b16f352a38d3d7e7222444e6cc0eb9701fe132
-
Filesize
6KB
MD5f8b0fd0c2fcb4342281d4835642c29f6
SHA12c979fa5d180a3909c0bb3ce3ddd769f3c0df230
SHA256d681dfa023b598fc2b6d885a01cf84f5a5943fbba410ff3a98539080181729fb
SHA512a8866aaeb43874b1369a10fbb4b45778a2318b7af73d563a8be19540031792dc02f2765ddf8d8066e357e8e00ed26c3009904fd3c701651aac2d38e1e046071c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD592dbf4ad6ec14cd29790086b66becf31
SHA1e1fbef4bc8c94f53de57bac9e6880bf1f92e43d2
SHA256b8da9978b1f676fac8043b3ce04ab953790db1412fc85f28e8637616c1d767b9
SHA512b46287bdcb68e653439a0461ace4b0e99e04c8476f4ef480cccd28ca18491e3d23b676ff6b15087112a0c5f4c2a72f63b8904c7b2a70c10c21b5e1bc4826e4f9