Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 06:33
Static task
static1
Behavioral task
behavioral1
Sample
dfa98c3601d6aeed9e0ff72158f2dbfc_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
dfa98c3601d6aeed9e0ff72158f2dbfc_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
dfa98c3601d6aeed9e0ff72158f2dbfc_JaffaCakes118.html
-
Size
202KB
-
MD5
dfa98c3601d6aeed9e0ff72158f2dbfc
-
SHA1
20eae2e944d00b20973ec6f88a8da6b535d17e1f
-
SHA256
acf85043e9d993a4f7230bc72c9bc912ce0f032f74cb2ef0c953d4e78c59ee8b
-
SHA512
c0038e1ccf4e32ea276432f657892e3794ffc3b4ae82fd1cf67f492e095a0e111af913f997e9be79102fc95762bc956433126092b484f5891f87bc56bf2f5c0a
-
SSDEEP
1536:kaSWTUl+5/pLSFyetIzNcBYOFOJLLjt6dnaeqOYNfGvM:dSHoIy
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2596 msedge.exe 2596 msedge.exe 2392 msedge.exe 2392 msedge.exe 4524 identity_helper.exe 4524 identity_helper.exe 2952 msedge.exe 2952 msedge.exe 2952 msedge.exe 2952 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe 2392 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2392 wrote to memory of 624 2392 msedge.exe 83 PID 2392 wrote to memory of 624 2392 msedge.exe 83 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2472 2392 msedge.exe 84 PID 2392 wrote to memory of 2596 2392 msedge.exe 85 PID 2392 wrote to memory of 2596 2392 msedge.exe 85 PID 2392 wrote to memory of 4332 2392 msedge.exe 86 PID 2392 wrote to memory of 4332 2392 msedge.exe 86 PID 2392 wrote to memory of 4332 2392 msedge.exe 86 PID 2392 wrote to memory of 4332 2392 msedge.exe 86 PID 2392 wrote to memory of 4332 2392 msedge.exe 86 PID 2392 wrote to memory of 4332 2392 msedge.exe 86 PID 2392 wrote to memory of 4332 2392 msedge.exe 86 PID 2392 wrote to memory of 4332 2392 msedge.exe 86 PID 2392 wrote to memory of 4332 2392 msedge.exe 86 PID 2392 wrote to memory of 4332 2392 msedge.exe 86 PID 2392 wrote to memory of 4332 2392 msedge.exe 86 PID 2392 wrote to memory of 4332 2392 msedge.exe 86 PID 2392 wrote to memory of 4332 2392 msedge.exe 86 PID 2392 wrote to memory of 4332 2392 msedge.exe 86 PID 2392 wrote to memory of 4332 2392 msedge.exe 86 PID 2392 wrote to memory of 4332 2392 msedge.exe 86 PID 2392 wrote to memory of 4332 2392 msedge.exe 86 PID 2392 wrote to memory of 4332 2392 msedge.exe 86 PID 2392 wrote to memory of 4332 2392 msedge.exe 86 PID 2392 wrote to memory of 4332 2392 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dfa98c3601d6aeed9e0ff72158f2dbfc_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a19c46f8,0x7ff8a19c4708,0x7ff8a19c47182⤵PID:624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,16088118510565126893,4524319386777758912,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:2472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,16088118510565126893,4524319386777758912,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,16088118510565126893,4524319386777758912,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:82⤵PID:4332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16088118510565126893,4524319386777758912,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:2792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16088118510565126893,4524319386777758912,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:5024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16088118510565126893,4524319386777758912,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:12⤵PID:4456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,16088118510565126893,4524319386777758912,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:82⤵PID:4588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,16088118510565126893,4524319386777758912,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16088118510565126893,4524319386777758912,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:12⤵PID:1564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16088118510565126893,4524319386777758912,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:12⤵PID:2200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16088118510565126893,4524319386777758912,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:12⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,16088118510565126893,4524319386777758912,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:12⤵PID:3272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,16088118510565126893,4524319386777758912,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4964 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2952
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:904
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f9664c896e19205022c094d725f820b6
SHA1f8f1baf648df755ba64b412d512446baf88c0184
SHA2567121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
SHA5123fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
-
Filesize
152B
MD5847d47008dbea51cb1732d54861ba9c9
SHA1f2099242027dccb88d6f05760b57f7c89d926c0d
SHA25610292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
SHA512bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
-
Filesize
255B
MD584b28e8ffed9fa0b8f6a91b5b31b308d
SHA1efaf4dff37c34966c481eef0caf7dacee9e2a78c
SHA256cf81f066b1ba1e869f5551bbc61c497d91035e2afcb750c3e63d5c7644b0b29c
SHA512a838f81d13c5ecf02aedcdc60159f4b3f6e22e1f14c566ee3b2765e5645fe0eebabe24124ac018ea64986261c904e5bb50512708babe39bde76d7a5ab9280ea9
-
Filesize
5KB
MD58e139aff5c194bd903b3a58ef80fd97f
SHA15696f1f15d1fb8d463164e885e76275b1b2eb0cf
SHA2567265121f4903d9c0bf9f4520a8b8b2a26943529afd0e44f5cdebd964bb280776
SHA512afc0582c8c61c8d4486e060942c7b6907a43ad6f578f2a10b8f6c5cb9963e98fddea3efab2250c07fd039a8e798d5a964f39d998ab91f4cc4aa86e8d64470bb2
-
Filesize
6KB
MD5730fcbc961ec9af9c319ed0f5ea7d6d5
SHA1d86a3eb06aa07e5b5ca05eb495f2d4c3e66aaae8
SHA25669e7bc22207a7132a525c33fcaec0b969234df1d884dcffaa1cf62cc44340748
SHA512ecf46dda249cb7f4253e643d9538f11fb3b559ab43670741bb7f738683f711556c471f622c9fb68c8daa0482bc2e57195a37750929b1e52f3d144df842451b79
-
Filesize
6KB
MD5d221f635870c6af0a6128e6f55ee0234
SHA170a998f4505d54dffdd8b9c51bc923dc68bbfd21
SHA256e066540922c017891bacbab62a976d529ab2a6da2a6249ea863d5aa1f60ec9c6
SHA512261cbc06bf3d7adf936f76484e23db91006d2a1a444d9d874571290d45b1308e4223ada8f5dcc87b21a54e708b2d828075fc4b8792e607b846adbdf78095f76d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD597872684cc610319445e79f4d1c65b86
SHA1bcd12508e6c8e73a365c70374cc1a907783012ca
SHA2564af43ef9b94ed04bbe3118f8cc38a43cadf2d12278d1068d0c8f20f08fdaee67
SHA512663a36d1d34a206f9720aa90c642290411b1b1c885407ef01a0ac3d315c2daf420fe8979bb6143b55f72a3f5c972953793ae4139ce42f1409490df31cee6fe29