Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2024, 02:44
Static task
static1
Behavioral task
behavioral1
Sample
dd8259a43b16cea4e5f3734c3fc175ba_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
dd8259a43b16cea4e5f3734c3fc175ba_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
dd8259a43b16cea4e5f3734c3fc175ba_JaffaCakes118.html
-
Size
6KB
-
MD5
dd8259a43b16cea4e5f3734c3fc175ba
-
SHA1
e2d2c9430f07fa1e7d78f5d942b6585344fbeaf7
-
SHA256
962097e94763d5a08b48bad17cb09dc652ff62b7a15a83136dbd401d2534ef0a
-
SHA512
f669f10d7f3ad241ba29140cec1c82f9eaf7c05bda4eccf38900c7e2ab1897da85d3b372f06e83e27d4c9227a9af874097570e9a9a269fe2ccecc5c927c005d4
-
SSDEEP
96:uzVs+ux7w3LLY1k9o84d12ef7CSTUeZcEZ7ru7f:csz7w3AYS/lb76f
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2076 msedge.exe 2076 msedge.exe 4064 msedge.exe 4064 msedge.exe 3604 identity_helper.exe 3604 identity_helper.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe 4692 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe 4064 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4064 wrote to memory of 2516 4064 msedge.exe 83 PID 4064 wrote to memory of 2516 4064 msedge.exe 83 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 948 4064 msedge.exe 84 PID 4064 wrote to memory of 2076 4064 msedge.exe 85 PID 4064 wrote to memory of 2076 4064 msedge.exe 85 PID 4064 wrote to memory of 1944 4064 msedge.exe 86 PID 4064 wrote to memory of 1944 4064 msedge.exe 86 PID 4064 wrote to memory of 1944 4064 msedge.exe 86 PID 4064 wrote to memory of 1944 4064 msedge.exe 86 PID 4064 wrote to memory of 1944 4064 msedge.exe 86 PID 4064 wrote to memory of 1944 4064 msedge.exe 86 PID 4064 wrote to memory of 1944 4064 msedge.exe 86 PID 4064 wrote to memory of 1944 4064 msedge.exe 86 PID 4064 wrote to memory of 1944 4064 msedge.exe 86 PID 4064 wrote to memory of 1944 4064 msedge.exe 86 PID 4064 wrote to memory of 1944 4064 msedge.exe 86 PID 4064 wrote to memory of 1944 4064 msedge.exe 86 PID 4064 wrote to memory of 1944 4064 msedge.exe 86 PID 4064 wrote to memory of 1944 4064 msedge.exe 86 PID 4064 wrote to memory of 1944 4064 msedge.exe 86 PID 4064 wrote to memory of 1944 4064 msedge.exe 86 PID 4064 wrote to memory of 1944 4064 msedge.exe 86 PID 4064 wrote to memory of 1944 4064 msedge.exe 86 PID 4064 wrote to memory of 1944 4064 msedge.exe 86 PID 4064 wrote to memory of 1944 4064 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dd8259a43b16cea4e5f3734c3fc175ba_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2f8c46f8,0x7ffa2f8c4708,0x7ffa2f8c47182⤵PID:2516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,16383139422342376713,11844340255878112716,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:22⤵PID:948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,16383139422342376713,11844340255878112716,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,16383139422342376713,11844340255878112716,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2588 /prefetch:82⤵PID:1944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16383139422342376713,11844340255878112716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:8
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16383139422342376713,11844340255878112716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:1996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,16383139422342376713,11844340255878112716,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 /prefetch:82⤵PID:3596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,16383139422342376713,11844340255878112716,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16383139422342376713,11844340255878112716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:12⤵PID:348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16383139422342376713,11844340255878112716,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:12⤵PID:4292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16383139422342376713,11844340255878112716,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:12⤵PID:2460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16383139422342376713,11844340255878112716,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:12⤵PID:4280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,16383139422342376713,11844340255878112716,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4692
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2004
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3956
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59b008261dda31857d68792b46af6dd6d
SHA1e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA2569ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
SHA51278853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
-
Filesize
152B
MD50446fcdd21b016db1f468971fb82a488
SHA1726b91562bb75f80981f381e3c69d7d832c87c9d
SHA25662c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
SHA5121df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
-
Filesize
5KB
MD569c51c337226a1ab2899c59c5b1e79b9
SHA142c0180d875421a5fb0301a8c99775903a82814b
SHA256a8c44f3850df5d1e3353c30810ac986fe40d1f1789a4611a2f45e3ff2c5adc07
SHA51212733fddc220e49be30925219779a88ce94f2906b93a9d5ff8066c5c372b62a12d18fe1d1925807c6d77d0541748ecfcde5a8fd45513e21bd206280d6cd9993e
-
Filesize
6KB
MD5f63b95ff8d22d61b4e4252cd56ca8921
SHA14241317a979da45fb9ef7db849af437360523532
SHA256b95abc4ed29e3f2a1536ed038f1afcbcad2fbe29e9cb2983bbb3a7bef918e8e6
SHA512abdf0a160ca6e1dd05cec387132c78a35364184de10930971cf2e333a1eea97e7aeaf0ad701b7ff710483e3048544c0fb86a3835fe1960695a336ca120c22286
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD586a2e208cf84524107ac95681293fb10
SHA191918b1535b9cd64f8ed73066be25f310b9ae627
SHA25629161522fd3aea526b72d952ab2b1aebff4a5700f3bf0cc5f98d39675a61d4b1
SHA512e87c301c8dfce5347b778a1652d940fdc3a61dcbbea3427212d2ca683a3c8c063cfc36329a4ff1960384f4236ac309d51e753e71c827943c6c07df00dc54a61d