Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 17:46
Static task
static1
Behavioral task
behavioral1
Sample
f053240a31226d4192c1aa285a839712_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f053240a31226d4192c1aa285a839712_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
f053240a31226d4192c1aa285a839712_JaffaCakes118.html
-
Size
54KB
-
MD5
f053240a31226d4192c1aa285a839712
-
SHA1
c6827d23c084aa885eb8f11f311b94d2d6fd1349
-
SHA256
6fad538a2f1d630f31d1f364a2c6f4901b08a1423c2166976ea5462015290fa6
-
SHA512
d30a2acb819d9dc706e67c8d8ec5110063d23c8148f9e609d880809b782cf6d600a7b1829eb5230addd2351943d0aab06e1ec77f4a2374f45a4a28364bf6bf20
-
SSDEEP
1536:pE46aw5fUJ02WVHAJlTclra5bT/9VT3o157+UYFhBsD:pE4dwSJwn8T/9VT3o157+UYFhmD
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5024 msedge.exe 5024 msedge.exe 5084 msedge.exe 5084 msedge.exe 1212 identity_helper.exe 1212 identity_helper.exe 2972 msedge.exe 2972 msedge.exe 2972 msedge.exe 2972 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe 5084 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5084 wrote to memory of 1980 5084 msedge.exe 82 PID 5084 wrote to memory of 1980 5084 msedge.exe 82 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 4272 5084 msedge.exe 83 PID 5084 wrote to memory of 5024 5084 msedge.exe 84 PID 5084 wrote to memory of 5024 5084 msedge.exe 84 PID 5084 wrote to memory of 2336 5084 msedge.exe 85 PID 5084 wrote to memory of 2336 5084 msedge.exe 85 PID 5084 wrote to memory of 2336 5084 msedge.exe 85 PID 5084 wrote to memory of 2336 5084 msedge.exe 85 PID 5084 wrote to memory of 2336 5084 msedge.exe 85 PID 5084 wrote to memory of 2336 5084 msedge.exe 85 PID 5084 wrote to memory of 2336 5084 msedge.exe 85 PID 5084 wrote to memory of 2336 5084 msedge.exe 85 PID 5084 wrote to memory of 2336 5084 msedge.exe 85 PID 5084 wrote to memory of 2336 5084 msedge.exe 85 PID 5084 wrote to memory of 2336 5084 msedge.exe 85 PID 5084 wrote to memory of 2336 5084 msedge.exe 85 PID 5084 wrote to memory of 2336 5084 msedge.exe 85 PID 5084 wrote to memory of 2336 5084 msedge.exe 85 PID 5084 wrote to memory of 2336 5084 msedge.exe 85 PID 5084 wrote to memory of 2336 5084 msedge.exe 85 PID 5084 wrote to memory of 2336 5084 msedge.exe 85 PID 5084 wrote to memory of 2336 5084 msedge.exe 85 PID 5084 wrote to memory of 2336 5084 msedge.exe 85 PID 5084 wrote to memory of 2336 5084 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f053240a31226d4192c1aa285a839712_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82b1346f8,0x7ff82b134708,0x7ff82b1347182⤵PID:1980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,8550403667289723020,8114853031845984549,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:22⤵PID:4272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,8550403667289723020,8114853031845984549,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,8550403667289723020,8114853031845984549,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:82⤵PID:2336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8550403667289723020,8114853031845984549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:1012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8550403667289723020,8114853031845984549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:3556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,8550403667289723020,8114853031845984549,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:82⤵PID:4500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,8550403667289723020,8114853031845984549,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8550403667289723020,8114853031845984549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:12⤵PID:4984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8550403667289723020,8114853031845984549,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:12⤵PID:1040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8550403667289723020,8114853031845984549,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:1232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,8550403667289723020,8114853031845984549,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:12⤵PID:3452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,8550403667289723020,8114853031845984549,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2972
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2860
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4952
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD553bc70ecb115bdbabe67620c416fe9b3
SHA1af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA256b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
SHA512cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
-
Filesize
152B
MD5e765f3d75e6b0e4a7119c8b14d47d8da
SHA1cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA256986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
SHA512a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
-
Filesize
493B
MD5e7456e9d704a9c71f7dccad5eecd1d76
SHA125096dc7952999fd895eab03d19a01573b5bcde4
SHA2561292b16ab0d8b2817f97bf9ae5c8917b828a9be3853724a1751195e5eea6fcdb
SHA512dabab830d9271ed8eb76bc216d7b400879066f7151f7bf96d27cb21168ca7cc69eae7c2149460372c60f212bd4a85cd02454e7540fa88613c8c6c8f6ea811143
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
5KB
MD57309fbabab8fa194a8c2dac8dd01790c
SHA190bfc3d3ef0982a7e5b5a8b2d83ab7c56377d8d2
SHA25666ea9ff872e255a561cb2a0f4573cfad10c755cad9606b459f0bd1aba20be9c9
SHA5127e5be1c4bb045ebd140c0dd530791f589e450356911b3909c1d1dbc9f92152d4830efed6c06ef16a75f44d1469610190dfc4b6da4c1d11ab884585c9e6888ffa
-
Filesize
6KB
MD548c975acf6edb5b25f5f4926f7971105
SHA19fb8d78d2e13b20a46ada8afec746f38df68cfc2
SHA2560b2b873ab069a3589dfafdc72470da8a1672e27db50744be4bc6d97e93328d04
SHA5120eed47af93bca4554738ff19b7d3cd8e492daf549d7224b264b06527cab0b44ab1ac63770006b2a0e3da39f901f78243719377b08c167c273fa9527b56935a57
-
Filesize
6KB
MD53aa3883d403ea97d49e586f773d5c5f4
SHA1018a7ab9bfb5ce1548b868fc23f885827ae517b2
SHA256bbc1483a4257e8d4062d6b34c550c182904235a36ef8a718f2f434a09940331d
SHA51240d95a3f428794e03b4002d1eb78d51c98b00f8e93e54168e9b8e08c809f3bc944f0def3fc7e0cc220d0a827efb5bf17b3225fb5b4c52d2980d9907f68998de3
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD596ffb957c67f4ac0a90845780f43469a
SHA18fddd36b3fdd28435e117d3cdc1652a6e871d187
SHA256dc4689ce858578df5bf71dcecfb4a4063374f0c6409fc6f974cddba3fc56c63b
SHA5125db1cdeabdfa32beadacddb19876dc3c6215e6d7a0d48943fac0e4d8943ba44bbbe1f681977252596782e090a31b881a07945c992627c3e66fa22dff64dda346