Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2024, 05:57
Static task
static1
Behavioral task
behavioral1
Sample
eab656a4588eff1d45b2c0ea6c805c65_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
eab656a4588eff1d45b2c0ea6c805c65_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
eab656a4588eff1d45b2c0ea6c805c65_JaffaCakes118.html
-
Size
66KB
-
MD5
eab656a4588eff1d45b2c0ea6c805c65
-
SHA1
cb1f9c51c233d41b78a85d54a394251e53fc2d66
-
SHA256
e3402e6be8bebf539d444a20680c3642cb4cd6d5e0c42fb5a7630dbc3dbf7ca0
-
SHA512
f64281455b4bd22d5c33c3e801c14f780cd928613f0c5560e50b62461b461eee5082d33eb713dee5c11f332ca0591fa6bd2b7c9917b2eee597f1dcdb3521febe
-
SSDEEP
1536:vu0pGlSWQIaAkOMh+aedXe5yeoJeeWeXGePqNU/GtSfQno111AfaUm8Pdk:NpGAWyLuAfaUK
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3392 msedge.exe 3392 msedge.exe 4664 msedge.exe 4664 msedge.exe 3564 identity_helper.exe 3564 identity_helper.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe 3664 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4664 wrote to memory of 4540 4664 msedge.exe 82 PID 4664 wrote to memory of 4540 4664 msedge.exe 82 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 4176 4664 msedge.exe 83 PID 4664 wrote to memory of 3392 4664 msedge.exe 84 PID 4664 wrote to memory of 3392 4664 msedge.exe 84 PID 4664 wrote to memory of 2156 4664 msedge.exe 85 PID 4664 wrote to memory of 2156 4664 msedge.exe 85 PID 4664 wrote to memory of 2156 4664 msedge.exe 85 PID 4664 wrote to memory of 2156 4664 msedge.exe 85 PID 4664 wrote to memory of 2156 4664 msedge.exe 85 PID 4664 wrote to memory of 2156 4664 msedge.exe 85 PID 4664 wrote to memory of 2156 4664 msedge.exe 85 PID 4664 wrote to memory of 2156 4664 msedge.exe 85 PID 4664 wrote to memory of 2156 4664 msedge.exe 85 PID 4664 wrote to memory of 2156 4664 msedge.exe 85 PID 4664 wrote to memory of 2156 4664 msedge.exe 85 PID 4664 wrote to memory of 2156 4664 msedge.exe 85 PID 4664 wrote to memory of 2156 4664 msedge.exe 85 PID 4664 wrote to memory of 2156 4664 msedge.exe 85 PID 4664 wrote to memory of 2156 4664 msedge.exe 85 PID 4664 wrote to memory of 2156 4664 msedge.exe 85 PID 4664 wrote to memory of 2156 4664 msedge.exe 85 PID 4664 wrote to memory of 2156 4664 msedge.exe 85 PID 4664 wrote to memory of 2156 4664 msedge.exe 85 PID 4664 wrote to memory of 2156 4664 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eab656a4588eff1d45b2c0ea6c805c65_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed10146f8,0x7ffed1014708,0x7ffed10147182⤵PID:4540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,17923774468559594294,17690332569682226798,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:22⤵PID:4176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,17923774468559594294,17690332569682226798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,17923774468559594294,17690332569682226798,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:82⤵PID:2156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17923774468559594294,17690332569682226798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:1044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17923774468559594294,17690332569682226798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:2624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,17923774468559594294,17690332569682226798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:82⤵PID:4840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,17923774468559594294,17690332569682226798,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17923774468559594294,17690332569682226798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:12⤵PID:3336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17923774468559594294,17690332569682226798,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:12⤵PID:2840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17923774468559594294,17690332569682226798,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:12⤵PID:3872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,17923774468559594294,17690332569682226798,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:12⤵PID:4808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,17923774468559594294,17690332569682226798,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4944 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3664
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2920
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4656
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD553bc70ecb115bdbabe67620c416fe9b3
SHA1af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA256b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
SHA512cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
-
Filesize
152B
MD5e765f3d75e6b0e4a7119c8b14d47d8da
SHA1cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA256986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
SHA512a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
-
Filesize
604B
MD55697fd9e570287d3254ad356828bf71c
SHA1b684572e26438cc22d9d5bc2f1c2d5daa4bbca74
SHA25656617fe6033084147da10d5a1fd30dfddc48c80df26a5ca6c0220ec8922ced3e
SHA51209febef53f85d3c1fa3a1df43fa743b9c122029074fb8273e4f8e7aedc4dc82584faeb1c50ae19cf3f143da4be899c4590a4d2fa9bc45b9352ad3d70708a89c2
-
Filesize
469B
MD5bc437175ecc0a77b75c88df7656af8d9
SHA18630a63766a0c24f120ff061982bb6336d9edd4e
SHA25681d9a2aec63eeee7689953ee032487885e3e88cc574de54c2c8bbb58508cdcc2
SHA51230627308a23d1a247a575f1c4e4113eeb9e8a6603e7a389f8f489e8be27e8d9053ec9310febe7b82d7d775171bdd4ba91077b0168caf8ce6b6a3d42221d0c5b2
-
Filesize
5KB
MD51631b063200a7704e6d64d6605402348
SHA157d7cc40057bf7baa0c27084f55091273bf7354a
SHA256b55da083290cb5db018eddcd252fb83e3e26c3420b718cf73832c991d05b5900
SHA512d253b7d52c962717e7f5c72ad1ae721b7262cef4131ca73f59739dcde1c574dec4989a582af823669f31e8fafeb2bd2bb62a0e3722792a91ac73611cc1dfa93c
-
Filesize
6KB
MD5d5e15d3c13005eebb439c4c5cc126d22
SHA1048d8234393d410686e329c7a0550a7fa8107a07
SHA2567499ced035f6df9a0d9ddb49a86de09d5d99754a720011958e0815eca21d9362
SHA512e38c739fb5bae45a94fe9922838ccbc5147d408d63f12622b1c39d6174d40891eaa53f57fe16359dbf8b86f02d1895ab2dd325c36627f8c2b83f05be7c126b33
-
Filesize
6KB
MD54c3eecf22403f750d83abf472807fcc3
SHA155304d26c694ed1ef5f2cce75e1a5bd873380f73
SHA25663c4a077b9fabbbd19e95038d32770cfa57386bf96803b8a78a089e8db8b85d1
SHA512c5916687a8a5615d870b50949f3058ba8a77865799b4d527a0f49265907e41dc65cd189609b71a72cd601b1cdc836d0b90ae4bbf5fef4d3441d485890b06b128
-
Filesize
368B
MD5d4c314f2ee0a048922401f041c531495
SHA1e1c8a809888572d97352961a16639a4ea4bb7fdb
SHA2566b8450786c33392473b8d3d0922ade1014c8b480ce6f5bcfd4606f7a116ca7ee
SHA5120bf739c5b8da9890bf58e70c710d72cd70dc2b957bf2a97f0e958e491970a3de640eec50b7111c4cb40e9fba4dd870fa2f146e1136cf6e70d7e3464cea5c97ed
-
Filesize
364B
MD52cf420a6c37b2d48b402c35d7728397c
SHA13c582475364019f6529c8b4fb83c731356f984bd
SHA25654036a805f5929f790622c402aff0ea8bb09ae2286bb0197d4fdbd3d80c94433
SHA512731722fe35db415f69ce2655a0a8f21cdfbae46bc4748067452e702a034c96eaa590cbe81228f9d4365d271e779dc8f02b1640ff2081508bf025b39656c28511
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD500ccc1c99ceac6f3abb147fc7163d11a
SHA1ce8e344c5d636c39f664dcca36386a803109fee2
SHA256d464bd44977c1d6e95169e61c40cd17b5448ffab809f4b9009d779f7cde25165
SHA512bb4c0d7e7291b19bd16fa583adba352bf5fc22c21ae699c9813601dcdd129cd92e41749722fae0fa10a4cb139ea04f20d3312543dfcb096ed2498a46e98a41a7