Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/09/2024, 19:51
Static task
static1
Behavioral task
behavioral1
Sample
e9dcd6d83acb79591c1e333b613a8ccf_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e9dcd6d83acb79591c1e333b613a8ccf_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
e9dcd6d83acb79591c1e333b613a8ccf_JaffaCakes118.html
-
Size
117KB
-
MD5
e9dcd6d83acb79591c1e333b613a8ccf
-
SHA1
94fe889c7ef7524dd353d0b10c7564575d2c3a80
-
SHA256
b663ba9aa0c1a03dcc979bf758f66475d2fa97ece885db261297c772fe3c89dd
-
SHA512
247bed8dc5b902b1f225d8b5deb3237280041e797afa4408944d2257be70a2c78fa5880bf99f9185cf77d6eaf9067dc4f7b5d7d26312af08bd7050ad38cd33a8
-
SSDEEP
1536:SuYp75P1yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy+:SLpFdyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5044 msedge.exe 5044 msedge.exe 5092 msedge.exe 5092 msedge.exe 2852 identity_helper.exe 2852 identity_helper.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe 2676 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe 5092 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5092 wrote to memory of 4844 5092 msedge.exe 82 PID 5092 wrote to memory of 4844 5092 msedge.exe 82 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 768 5092 msedge.exe 83 PID 5092 wrote to memory of 5044 5092 msedge.exe 84 PID 5092 wrote to memory of 5044 5092 msedge.exe 84 PID 5092 wrote to memory of 1724 5092 msedge.exe 85 PID 5092 wrote to memory of 1724 5092 msedge.exe 85 PID 5092 wrote to memory of 1724 5092 msedge.exe 85 PID 5092 wrote to memory of 1724 5092 msedge.exe 85 PID 5092 wrote to memory of 1724 5092 msedge.exe 85 PID 5092 wrote to memory of 1724 5092 msedge.exe 85 PID 5092 wrote to memory of 1724 5092 msedge.exe 85 PID 5092 wrote to memory of 1724 5092 msedge.exe 85 PID 5092 wrote to memory of 1724 5092 msedge.exe 85 PID 5092 wrote to memory of 1724 5092 msedge.exe 85 PID 5092 wrote to memory of 1724 5092 msedge.exe 85 PID 5092 wrote to memory of 1724 5092 msedge.exe 85 PID 5092 wrote to memory of 1724 5092 msedge.exe 85 PID 5092 wrote to memory of 1724 5092 msedge.exe 85 PID 5092 wrote to memory of 1724 5092 msedge.exe 85 PID 5092 wrote to memory of 1724 5092 msedge.exe 85 PID 5092 wrote to memory of 1724 5092 msedge.exe 85 PID 5092 wrote to memory of 1724 5092 msedge.exe 85 PID 5092 wrote to memory of 1724 5092 msedge.exe 85 PID 5092 wrote to memory of 1724 5092 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e9dcd6d83acb79591c1e333b613a8ccf_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b2b846f8,0x7ff9b2b84708,0x7ff9b2b847182⤵PID:4844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6005636954834953218,11535511565554355459,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:22⤵PID:768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,6005636954834953218,11535511565554355459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,6005636954834953218,11535511565554355459,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:82⤵PID:1724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6005636954834953218,11535511565554355459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6005636954834953218,11535511565554355459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6005636954834953218,11535511565554355459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:12⤵PID:4896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6005636954834953218,11535511565554355459,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:12⤵PID:4916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6005636954834953218,11535511565554355459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:82⤵PID:4140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6005636954834953218,11535511565554355459,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6005636954834953218,11535511565554355459,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:12⤵PID:320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6005636954834953218,11535511565554355459,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:12⤵PID:4604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6005636954834953218,11535511565554355459,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3048 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2676
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2152
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ecf7ca53c80b5245e35839009d12f866
SHA1a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA256882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
SHA512706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
-
Filesize
152B
MD54dd2754d1bea40445984d65abee82b21
SHA14b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA256183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
SHA51292d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
-
Filesize
6KB
MD5d52d6ffacee413f0449c984eadae61f3
SHA17d2ac5181ccc348078649f55de05b0a996f3586e
SHA256e418509e5f61488dd2d6272f7eda587a22db1a099aba3ef6e3dcbc5df27ec6ea
SHA512b6e1dda705606577c9f79bd24ed8859503a0c22de22f15deb466f9909ba64384c6a0f6b31133abe53711b11ac0349b212a0266fa555d9d8cb0e25c6565f7575e
-
Filesize
5KB
MD51a7120902d7be1989bfa1ed7abc400b1
SHA194f8c3bff20424de1bca587ea73102161968d09f
SHA2568663aa626a59266706a818251db626092487a5dcdc580dcf172189bde8b66a31
SHA5123e84e18b75db531d9765020d79ee0511c88769ceeab4af1dff57793c746d650d84a61285bf991eb90694c8296ec851e603e8d4d5b57037c1d8a74b70126e9cb4
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5d2506d1e80c24c37f8ffa00f205a43ef
SHA1b0cbbb63222a01ec71f1132ac6942a2dfce455d7
SHA256a526410ee1cf8e6863e3f8c95f11d6e2416dfa4c0a629193b01901ba75867a63
SHA5121c8d4e0d8756cd16d2b601e07362e3ddd734ebc3bbee0fdbcceb3e9cafe70590aa97057e51f36e707862da22a3d54eb6d60b5071058aab41068b317148dfa3ec