Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/09/2024, 23:34
Static task
static1
Behavioral task
behavioral1
Sample
ea2e0ce29ba805563e777303fd83158e_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ea2e0ce29ba805563e777303fd83158e_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
ea2e0ce29ba805563e777303fd83158e_JaffaCakes118.html
-
Size
27KB
-
MD5
ea2e0ce29ba805563e777303fd83158e
-
SHA1
3c9ab82fe61dad8d0d91e4cad809c39a92f37490
-
SHA256
f46709c07233fc33ac255aad06fd193149acbfacad1a5eca58078f8356a83744
-
SHA512
d5f96b1399b9de2775d782f1fa234c56b515a1dd1c4ad39c1cab432e6fd23ed3b39533bd616127dba2253ce2fde44d2aac435bf3bb410a311759003d2547328a
-
SSDEEP
192:uwLUb5nXbmnQjxn5Q/+nQiedNnLnQOkEntWAnQTbnFnQ9eF2am6lT3RQl7MB9qna:0nQ/TsvR34Szv
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 748 msedge.exe 748 msedge.exe 2996 msedge.exe 2996 msedge.exe 2164 identity_helper.exe 2164 identity_helper.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe 4016 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe 2996 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2996 wrote to memory of 2824 2996 msedge.exe 82 PID 2996 wrote to memory of 2824 2996 msedge.exe 82 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 4632 2996 msedge.exe 83 PID 2996 wrote to memory of 748 2996 msedge.exe 84 PID 2996 wrote to memory of 748 2996 msedge.exe 84 PID 2996 wrote to memory of 3872 2996 msedge.exe 85 PID 2996 wrote to memory of 3872 2996 msedge.exe 85 PID 2996 wrote to memory of 3872 2996 msedge.exe 85 PID 2996 wrote to memory of 3872 2996 msedge.exe 85 PID 2996 wrote to memory of 3872 2996 msedge.exe 85 PID 2996 wrote to memory of 3872 2996 msedge.exe 85 PID 2996 wrote to memory of 3872 2996 msedge.exe 85 PID 2996 wrote to memory of 3872 2996 msedge.exe 85 PID 2996 wrote to memory of 3872 2996 msedge.exe 85 PID 2996 wrote to memory of 3872 2996 msedge.exe 85 PID 2996 wrote to memory of 3872 2996 msedge.exe 85 PID 2996 wrote to memory of 3872 2996 msedge.exe 85 PID 2996 wrote to memory of 3872 2996 msedge.exe 85 PID 2996 wrote to memory of 3872 2996 msedge.exe 85 PID 2996 wrote to memory of 3872 2996 msedge.exe 85 PID 2996 wrote to memory of 3872 2996 msedge.exe 85 PID 2996 wrote to memory of 3872 2996 msedge.exe 85 PID 2996 wrote to memory of 3872 2996 msedge.exe 85 PID 2996 wrote to memory of 3872 2996 msedge.exe 85 PID 2996 wrote to memory of 3872 2996 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ea2e0ce29ba805563e777303fd83158e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbda7c46f8,0x7ffbda7c4708,0x7ffbda7c47182⤵PID:2824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,12620455541007325157,8532618631309510033,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:22⤵PID:4632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,12620455541007325157,8532618631309510033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,12620455541007325157,8532618631309510033,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:82⤵PID:3872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12620455541007325157,8532618631309510033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12620455541007325157,8532618631309510033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:2684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,12620455541007325157,8532618631309510033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:82⤵PID:3080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,12620455541007325157,8532618631309510033,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12620455541007325157,8532618631309510033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:12⤵PID:3024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12620455541007325157,8532618631309510033,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:12⤵PID:4064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12620455541007325157,8532618631309510033,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:12⤵PID:2644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,12620455541007325157,8532618631309510033,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:12⤵PID:1008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,12620455541007325157,8532618631309510033,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4904 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4016
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2292
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:556
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d4829218222c8bedb9ffe89dffd37095
SHA1aae577f33f413ec3d09f2e7ff5d9cc20a602241c
SHA25649239b229a2519583ba5d6de3702480b8a8ebf3cfaa8945100dbab25fcb02b7b
SHA51203e26a2e3de41b8a829b5543da504c7d7ccdc4c112d629efcac24dcda23acb50a52b5b99572b5efb2a01cf392a457cf9fac85663b3d63f7606be00dba218f8f1
-
Filesize
152B
MD515e9c4b4eefb3e1c08a010e748e10f58
SHA13172378f2c7a00553ce086dbf53fcf3126c5a724
SHA25607b56a769467e8b57f9b7acd9d32da266ca5000803758c18bb6818ac236c7000
SHA512811058b539e914a812c88543bb6657de736f691d18d6dadb5e1f6ced286780fb334dc5f575babbcf4fd2dceda30d1bf4004b374c5775e7f278346b100b29eb7e
-
Filesize
5KB
MD5ad3726a16efc94f572965f9ba3cb8a13
SHA1aefdecffabbf93a9d456cd3985d1656c6f7901fc
SHA256b6b819b0e0229107f894e4e7178c0514180dffe3be6f6ed2eec8541fdc7c4884
SHA512a2056f351a60a477cacbde98c1b3cf21c55183bbf58aa834c01321155b758b61fcc191d73fbecd20b0db21820749d796258b5bea4d2b0e61d80a8fca16a5d2ae
-
Filesize
5KB
MD5b35927104e68cdbd8b8723d0e9a3cdb7
SHA1fbb4538358675b45c2fcf413d74c02cfb0756688
SHA25630f5035d6c1348ea688d9e32943c7361601de2bec6150c5398e1c526fb9e5239
SHA51261fe3f665d58b19868e6c5deddd38ba3c54cf9b3ce5fff376668a348e0c506394d0adc2acd62e3b8762018952a557f8a351dbc5a693b726fc16922785f8dfd0e
-
Filesize
24KB
MD57915ba0545666aa5833cf9f9f86d45d6
SHA1743ecc319bc2a54973582d4a5198042a48fbe8db
SHA256f8fcc045da13bde0f5dec3ada86342105cbff34ebc2442bcf51e8ed509a95b20
SHA512a53036251a22cdc95579ea8641c5574f1dc1f7dfd0390f00ebeafbbea0c1a2c0c3e6dba23bbbb8d8e2c77a3e1e816ccfaf84a97da1c334019c8df1414999d1f9
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5d84cee1191eb1482865beae9f7782189
SHA1324ce6171a9ada5fa8607e43862696b146affb0f
SHA256c3a3c75deafc618db595b1cace97355d5efe288570e287057b3ab405bbdf8410
SHA51258e48631c13fa4f013e3a05557f33d48b9b8e3d780a54e27babe881a273ed7d424bcdacaa0b1af61987a260c0c7cc0f87135163f7dab0afd34591e68885231f8