Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/09/2024, 14:37
Static task
static1
Behavioral task
behavioral1
Sample
fc81cf145112e2cbedbd019aba47313e_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
fc81cf145112e2cbedbd019aba47313e_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
fc81cf145112e2cbedbd019aba47313e_JaffaCakes118.html
-
Size
36KB
-
MD5
fc81cf145112e2cbedbd019aba47313e
-
SHA1
e00f97efad1d1970b1e085cf846981563b0b342d
-
SHA256
84517d742ad63d5a84fe33905ec98a437d61ca96ad893777349c72f1248b7b71
-
SHA512
9cecb8b22381417b558f53449cdc46c486607461417be3d934b84930ba53a958a855a405def0ab072bd37db6c3957ef5e5707940ce55cb9830922c1b045bb5cd
-
SSDEEP
768:zwx/MDTHZB88hARUZPXvE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6T9ZOl6DJtxo6lL0:Q/zbJxNV3uCS+/48GK
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4348 msedge.exe 4348 msedge.exe 2628 msedge.exe 2628 msedge.exe 2488 identity_helper.exe 2488 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe 2628 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2628 wrote to memory of 5040 2628 msedge.exe 81 PID 2628 wrote to memory of 5040 2628 msedge.exe 81 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 2584 2628 msedge.exe 82 PID 2628 wrote to memory of 4348 2628 msedge.exe 83 PID 2628 wrote to memory of 4348 2628 msedge.exe 83 PID 2628 wrote to memory of 2792 2628 msedge.exe 84 PID 2628 wrote to memory of 2792 2628 msedge.exe 84 PID 2628 wrote to memory of 2792 2628 msedge.exe 84 PID 2628 wrote to memory of 2792 2628 msedge.exe 84 PID 2628 wrote to memory of 2792 2628 msedge.exe 84 PID 2628 wrote to memory of 2792 2628 msedge.exe 84 PID 2628 wrote to memory of 2792 2628 msedge.exe 84 PID 2628 wrote to memory of 2792 2628 msedge.exe 84 PID 2628 wrote to memory of 2792 2628 msedge.exe 84 PID 2628 wrote to memory of 2792 2628 msedge.exe 84 PID 2628 wrote to memory of 2792 2628 msedge.exe 84 PID 2628 wrote to memory of 2792 2628 msedge.exe 84 PID 2628 wrote to memory of 2792 2628 msedge.exe 84 PID 2628 wrote to memory of 2792 2628 msedge.exe 84 PID 2628 wrote to memory of 2792 2628 msedge.exe 84 PID 2628 wrote to memory of 2792 2628 msedge.exe 84 PID 2628 wrote to memory of 2792 2628 msedge.exe 84 PID 2628 wrote to memory of 2792 2628 msedge.exe 84 PID 2628 wrote to memory of 2792 2628 msedge.exe 84 PID 2628 wrote to memory of 2792 2628 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fc81cf145112e2cbedbd019aba47313e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab96846f8,0x7ffab9684708,0x7ffab96847182⤵PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,18236606167200192027,9293841904488959401,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵PID:2584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,18236606167200192027,9293841904488959401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,18236606167200192027,9293841904488959401,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 /prefetch:82⤵PID:2792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18236606167200192027,9293841904488959401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:4840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18236606167200192027,9293841904488959401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:2004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,18236606167200192027,9293841904488959401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:82⤵PID:4848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,18236606167200192027,9293841904488959401,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18236606167200192027,9293841904488959401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:12⤵PID:2204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18236606167200192027,9293841904488959401,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:12⤵PID:260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18236606167200192027,9293841904488959401,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:12⤵PID:5080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18236606167200192027,9293841904488959401,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:12⤵PID:4628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,18236606167200192027,9293841904488959401,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2972 /prefetch:22⤵PID:348
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5088
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3236
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ff63763eedb406987ced076e36ec9acf
SHA116365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA2568f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
SHA512ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
-
Filesize
152B
MD52783c40400a8912a79cfd383da731086
SHA1001a131fe399c30973089e18358818090ca81789
SHA256331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
SHA512b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
-
Filesize
614B
MD558218a65124962e846321da6225a11de
SHA1aa2d79b831be17ea8e5f71341ca433c609e62e45
SHA25612276d71b85c5c2cf03a9458c3e42aabc33efb0297104f4f27907d90f2531bff
SHA51284ec536908e3acaf024ad7f360916f194ef2b0cfbe487ff83fa335e88a887eb6369c5ddadcea4c5f5d7b42f45affb0832dd1de26f7eed65555f051c0eaa2ee44
-
Filesize
6KB
MD59dbdce84982d272f2897ad003ebffb0f
SHA1097c16c58805f3df7ac6a58df12a75becf6361cf
SHA25649e950906f80dc3398f1dbe273615aac4309543da9ba897399c10a641de64ba4
SHA512b142a8b6f2bbf82767207dc178c3f9526a027c70a5420c457cc31ed32576810338ec6f2c5c9966358b0d04ebcab50fdfc73a11f0b6013e8617347673cc6a6f0f
-
Filesize
5KB
MD5f0f23e638e990b2df217980bbd257e8e
SHA1cead05c2fa24fe075f63346a3f0900d54ec78989
SHA256cb359865075c58f5c38ad78793e34503bca5641f339c2151f0382fd77b8c5c13
SHA512dbd68f038e03c05d07231f4e8dec620cd83bdec735e1eaa319ec54aabef4116653850d9f97e5a8120c5979baad15251b59fea342e93e88c86f9da18f6e793f25
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD59edc0b528dcee0573520c56d0d0334e1
SHA140107dcb246230e03fef4f1e75e3010ab3ebba5e
SHA25601aa21ad99bc7ca25615c95b86d073299050b8d7f83ec735767d5f53c465865a
SHA512e511b9a1d5408cf23649e4bf507dd06686e1b918e46eac5fc48803db2ccb681c6d9d3d4682150a6064fb33456ec263d33d29086d8f4ed5f7e0121fdfe6aff186