Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
20/09/2024, 21:57
Static task
static1
Behavioral task
behavioral1
Sample
ee8090c2dc63e2524624764e0421109d_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ee8090c2dc63e2524624764e0421109d_JaffaCakes118.html
Resource
win10v2004-20240910-en
General
-
Target
ee8090c2dc63e2524624764e0421109d_JaffaCakes118.html
-
Size
94KB
-
MD5
ee8090c2dc63e2524624764e0421109d
-
SHA1
9cb42e253eec3de78abf06dfa6f05d04937e49eb
-
SHA256
efc14a3d52aa0f3a1728a8fdc53b17663d810d1fbe566e057ee7f7e7df9f80c6
-
SHA512
0356019da0e6f35a92e822a6881f8e61edd0037e7d5b86dc2c246fb785bb9768838e6f956572079002ac88dbe35584724c6d407b71863fb23f06088744ac8c84
-
SSDEEP
1536:WMLiNcp8YGm1Evza5fFLf2pJIyFL17LcffKyLZ3BdkrY8mgHC+qpEyW:WAiEjxBdkrY8mgHC+qpEyW
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2216 msedge.exe 2216 msedge.exe 4940 msedge.exe 4940 msedge.exe 2456 identity_helper.exe 2456 identity_helper.exe 2212 msedge.exe 2212 msedge.exe 2212 msedge.exe 2212 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe 4940 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4940 wrote to memory of 2428 4940 msedge.exe 84 PID 4940 wrote to memory of 2428 4940 msedge.exe 84 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 1696 4940 msedge.exe 85 PID 4940 wrote to memory of 2216 4940 msedge.exe 86 PID 4940 wrote to memory of 2216 4940 msedge.exe 86 PID 4940 wrote to memory of 1216 4940 msedge.exe 87 PID 4940 wrote to memory of 1216 4940 msedge.exe 87 PID 4940 wrote to memory of 1216 4940 msedge.exe 87 PID 4940 wrote to memory of 1216 4940 msedge.exe 87 PID 4940 wrote to memory of 1216 4940 msedge.exe 87 PID 4940 wrote to memory of 1216 4940 msedge.exe 87 PID 4940 wrote to memory of 1216 4940 msedge.exe 87 PID 4940 wrote to memory of 1216 4940 msedge.exe 87 PID 4940 wrote to memory of 1216 4940 msedge.exe 87 PID 4940 wrote to memory of 1216 4940 msedge.exe 87 PID 4940 wrote to memory of 1216 4940 msedge.exe 87 PID 4940 wrote to memory of 1216 4940 msedge.exe 87 PID 4940 wrote to memory of 1216 4940 msedge.exe 87 PID 4940 wrote to memory of 1216 4940 msedge.exe 87 PID 4940 wrote to memory of 1216 4940 msedge.exe 87 PID 4940 wrote to memory of 1216 4940 msedge.exe 87 PID 4940 wrote to memory of 1216 4940 msedge.exe 87 PID 4940 wrote to memory of 1216 4940 msedge.exe 87 PID 4940 wrote to memory of 1216 4940 msedge.exe 87 PID 4940 wrote to memory of 1216 4940 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ee8090c2dc63e2524624764e0421109d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5e2d46f8,0x7ffe5e2d4708,0x7ffe5e2d47182⤵PID:2428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,1654131754097233048,8447028320261264109,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:22⤵PID:1696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,1654131754097233048,8447028320261264109,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,1654131754097233048,8447028320261264109,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:82⤵PID:1216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1654131754097233048,8447028320261264109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1654131754097233048,8447028320261264109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:1824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,1654131754097233048,8447028320261264109,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:82⤵PID:4352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,1654131754097233048,8447028320261264109,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1654131754097233048,8447028320261264109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:12⤵PID:5096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1654131754097233048,8447028320261264109,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2848 /prefetch:12⤵PID:3128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1654131754097233048,8447028320261264109,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,1654131754097233048,8447028320261264109,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:12⤵PID:692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,1654131754097233048,8447028320261264109,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1052 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2212
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3456
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4428
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD57006aacd11b992cd29fca21e619e86ea
SHA1f224b726a114d4c73d7379236739d5fbb8e7f7b7
SHA2563c434b96841d5a0fa0a04a6b503c3c4d46f1c4e3a1be77853175e5680e182814
SHA5126de169882c0e01217c4ca01f6ead8e5ebb316a77558e51cd862532dbf9147d9e267f8db667ff6e9fa33164243724f5e437cb882392382f3cae1072dadb762c1d
-
Filesize
152B
MD5b80cf20d9e8cf6a579981bfaab1bdce2
SHA1171a886be3a882bd04206295ce7f1db5b8b7035e
SHA25610d995b136b604440ac4033b2222543975779068a321d7bddf675d0cb2a4c2b1
SHA5120233b34866be1afd214a1c8a9dcf8328d16246b3a5ef142295333547b4cfdc787c8627439a2ca03c20cb49107f7428d39696143b71f56b7f1f05029b3a14376a
-
Filesize
178B
MD5efb3e41ddcb00d4e436d59962fe73c4d
SHA14b9f2cbd664cf2136cd6966774f9ee04b4efa46a
SHA256edc776d59064e412098066a07cba55cbabb1e7d18534e1292d34003961ad3bb6
SHA51285a53139125a0e589b222ebee00d1c593eb24c8059b9f3f86196f8ef346cf7fc988493bb6f5cebf7aec2d0debc5017eff291b04e8aa37180d1ec5a6e2bb362ba
-
Filesize
5KB
MD50489cb0bb52ca525e95be30feea0aad7
SHA16e0b8f649128511bb3c4b3a36ae4ad03ff0d43a4
SHA2567c4bdb5ea555ca343156cd4084db078cd15b249710bdac03358605c598b56f10
SHA51252fbce8d74ce302c85bd3e09ab83e70c1970b8c81fe0e5cbedbd530b3c30d33fa1f6357590cb5ba4c0e8d9983af91be7f3d89d4df78b8e484b1c2b6f8ae315da
-
Filesize
6KB
MD536b8fdc331c1478d0f3049a8a64e32a4
SHA13da3eac340a93877e5060325d54650d17f008ce5
SHA256a52603e73ffd3cb6fc238a3ae58d71580ebec1894a3dc920651abccc5d8b8e9e
SHA51207bb373757cfd4cf919c12a7d76961a3cf5a63046d3b6bef5117fb7e6b08831ed0db6a8cab8f159a1180a1fbe0f49c6defadf9639812baacb808cd7c8e9a7ad3
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5d30b0ffd040d3e2a1888b09ac002bc62
SHA170607768e3fda6f0af7870d0a840e6c494e1768e
SHA256c4181cf6a1ae00181a824ae128ca6524487eaeb7d57c871cf8ef5a9c1e9de083
SHA512ef4ddd1793a7b2bfc88697c5dd537834090c1605eb12db60269bae879910db9337c9cf020cf8e7a6280c15ead224330f43edf671b3da61a4015c0ca5a6ac2092