Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/09/2024, 11:29
Static task
static1
Behavioral task
behavioral1
Sample
fc35320fb774ecb765f1e4e1c9d022db_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fc35320fb774ecb765f1e4e1c9d022db_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
fc35320fb774ecb765f1e4e1c9d022db_JaffaCakes118.html
-
Size
94B
-
MD5
fc35320fb774ecb765f1e4e1c9d022db
-
SHA1
e7b57ae2aeda9cacd0832dbbe2764ad8bef7f9a4
-
SHA256
ebffe334c4ff06a650c3dc125d1070836829bee734536dc31e78fe1c79df5753
-
SHA512
fb7eb811206b16082003461fb1109be875e7747d7b55bd19382c97756e9c598271bd58a0e72a22a8313e6914d8827f3d05b2aa49a5ffc97d58980859b650449a
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3064 msedge.exe 3064 msedge.exe 388 msedge.exe 388 msedge.exe 620 identity_helper.exe 620 identity_helper.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe 4456 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
pid Process 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe 388 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 388 wrote to memory of 3000 388 msedge.exe 82 PID 388 wrote to memory of 3000 388 msedge.exe 82 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 2196 388 msedge.exe 83 PID 388 wrote to memory of 3064 388 msedge.exe 84 PID 388 wrote to memory of 3064 388 msedge.exe 84 PID 388 wrote to memory of 1504 388 msedge.exe 85 PID 388 wrote to memory of 1504 388 msedge.exe 85 PID 388 wrote to memory of 1504 388 msedge.exe 85 PID 388 wrote to memory of 1504 388 msedge.exe 85 PID 388 wrote to memory of 1504 388 msedge.exe 85 PID 388 wrote to memory of 1504 388 msedge.exe 85 PID 388 wrote to memory of 1504 388 msedge.exe 85 PID 388 wrote to memory of 1504 388 msedge.exe 85 PID 388 wrote to memory of 1504 388 msedge.exe 85 PID 388 wrote to memory of 1504 388 msedge.exe 85 PID 388 wrote to memory of 1504 388 msedge.exe 85 PID 388 wrote to memory of 1504 388 msedge.exe 85 PID 388 wrote to memory of 1504 388 msedge.exe 85 PID 388 wrote to memory of 1504 388 msedge.exe 85 PID 388 wrote to memory of 1504 388 msedge.exe 85 PID 388 wrote to memory of 1504 388 msedge.exe 85 PID 388 wrote to memory of 1504 388 msedge.exe 85 PID 388 wrote to memory of 1504 388 msedge.exe 85 PID 388 wrote to memory of 1504 388 msedge.exe 85 PID 388 wrote to memory of 1504 388 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fc35320fb774ecb765f1e4e1c9d022db_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc77046f8,0x7fffc7704708,0x7fffc77047182⤵PID:3000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,10273836235145073016,5953083568251091526,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:22⤵PID:2196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,10273836235145073016,5953083568251091526,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,10273836235145073016,5953083568251091526,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:82⤵PID:1504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10273836235145073016,5953083568251091526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:1752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10273836235145073016,5953083568251091526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:2036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10273836235145073016,5953083568251091526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:12⤵PID:936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,10273836235145073016,5953083568251091526,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:82⤵PID:3676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,10273836235145073016,5953083568251091526,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10273836235145073016,5953083568251091526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:12⤵PID:792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10273836235145073016,5953083568251091526,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:12⤵PID:1832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10273836235145073016,5953083568251091526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:12⤵PID:4440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10273836235145073016,5953083568251091526,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:12⤵PID:1884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10273836235145073016,5953083568251091526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:12⤵PID:4016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10273836235145073016,5953083568251091526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:12⤵PID:4520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10273836235145073016,5953083568251091526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:12⤵PID:1568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,10273836235145073016,5953083568251091526,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1872 /prefetch:12⤵PID:528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,10273836235145073016,5953083568251091526,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4456
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4904
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2608
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d7114a6cd851f9bf56cf771c37d664a2
SHA1769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA256d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
SHA51233bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
-
Filesize
152B
MD5719923124ee00fb57378e0ebcbe894f7
SHA1cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA256aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
SHA512a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0d1be0a6-c8bb-4794-991b-8c8bf771a6c4.tmp
Filesize5KB
MD5d7bf06b918792ca25c90cf6095c7a4cd
SHA13ba5b662d18294ca6e3eb8099373692f2f037722
SHA25634c6a8d63c191037a50fbb9b91540899dfff002292dbb2eeaa68cbcaf597221f
SHA5128188201e09690f6b98c06ef3552ea0c028f82de94c050184d1072f56e4e365d08d8daa3834a3e268029622166df674742c2a3ba1045748d4da845f691b95b811
-
Filesize
6KB
MD54c395e4e32f4d78e650dfede205498dd
SHA149f53023ff5c994b4bbc6d65eccc792eae8a9ae6
SHA2562444f5bc74316794295fe7e24f554c46a46c37ee24b0a023aa22d1dcb270e04f
SHA512266e20744bfb0c375a61955b26e8746164e8bbbd1c1dc4972137bcb4fade19833c85be6febcfa64d04ccbdf01b874eb63ed028f9421870ebf6baf5a4087ec91d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5d22e5e738d4d0d0d9d77df5fc8d0b3e9
SHA138483d5f33fbc3dd04d5eb483a2508683a9fd104
SHA2562aeb0b92e87121367dd009bb3b2caf05c45efcaa502456bd59ad7ff8f8b36ae3
SHA512a62c52778ec8a5ba5400d9e431408e7f47e44534a5192b3a83f6a3e8d17088deedcc1a06ee53843277cb7f0b775ed5c2af934a978d9c008330a8913fc3504b3a