Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
30/09/2024, 06:53
Static task
static1
Behavioral task
behavioral1
Sample
000dcd67128380692c3e5807eb81f497_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
000dcd67128380692c3e5807eb81f497_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
000dcd67128380692c3e5807eb81f497_JaffaCakes118.html
-
Size
1KB
-
MD5
000dcd67128380692c3e5807eb81f497
-
SHA1
151599b94a42a35e3b62864a9246373414caed32
-
SHA256
e69b142f59ddd6099d3b1bfab0bf87a51ffbfb778e31b4ddd612ce0f4e7f2f01
-
SHA512
71ff6aa7aa5979936957546263eef70921f1dd973cd8b06af89f530788bd00da6e8c882974ccec4ccc8d7fb803a7cfae9efe001c94cbe76cc07355f5daa6c450
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1444 msedge.exe 1444 msedge.exe 2380 msedge.exe 2380 msedge.exe 4360 identity_helper.exe 4360 identity_helper.exe 2724 msedge.exe 2724 msedge.exe 2724 msedge.exe 2724 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe 2380 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2380 wrote to memory of 784 2380 msedge.exe 82 PID 2380 wrote to memory of 784 2380 msedge.exe 82 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1248 2380 msedge.exe 83 PID 2380 wrote to memory of 1444 2380 msedge.exe 84 PID 2380 wrote to memory of 1444 2380 msedge.exe 84 PID 2380 wrote to memory of 2448 2380 msedge.exe 85 PID 2380 wrote to memory of 2448 2380 msedge.exe 85 PID 2380 wrote to memory of 2448 2380 msedge.exe 85 PID 2380 wrote to memory of 2448 2380 msedge.exe 85 PID 2380 wrote to memory of 2448 2380 msedge.exe 85 PID 2380 wrote to memory of 2448 2380 msedge.exe 85 PID 2380 wrote to memory of 2448 2380 msedge.exe 85 PID 2380 wrote to memory of 2448 2380 msedge.exe 85 PID 2380 wrote to memory of 2448 2380 msedge.exe 85 PID 2380 wrote to memory of 2448 2380 msedge.exe 85 PID 2380 wrote to memory of 2448 2380 msedge.exe 85 PID 2380 wrote to memory of 2448 2380 msedge.exe 85 PID 2380 wrote to memory of 2448 2380 msedge.exe 85 PID 2380 wrote to memory of 2448 2380 msedge.exe 85 PID 2380 wrote to memory of 2448 2380 msedge.exe 85 PID 2380 wrote to memory of 2448 2380 msedge.exe 85 PID 2380 wrote to memory of 2448 2380 msedge.exe 85 PID 2380 wrote to memory of 2448 2380 msedge.exe 85 PID 2380 wrote to memory of 2448 2380 msedge.exe 85 PID 2380 wrote to memory of 2448 2380 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\000dcd67128380692c3e5807eb81f497_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb538f46f8,0x7ffb538f4708,0x7ffb538f47182⤵PID:784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,11615596102067641779,3759328470219189017,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:1248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,11615596102067641779,3759328470219189017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2480 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,11615596102067641779,3759328470219189017,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:82⤵PID:2448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11615596102067641779,3759328470219189017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:3156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11615596102067641779,3759328470219189017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:1868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11615596102067641779,3759328470219189017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:12⤵PID:4872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,11615596102067641779,3759328470219189017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:82⤵PID:3220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,11615596102067641779,3759328470219189017,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11615596102067641779,3759328470219189017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:12⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11615596102067641779,3759328470219189017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:12⤵PID:1764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11615596102067641779,3759328470219189017,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:12⤵PID:1576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,11615596102067641779,3759328470219189017,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:12⤵PID:3228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,11615596102067641779,3759328470219189017,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3040 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2724
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4956
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4496
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ecf7ca53c80b5245e35839009d12f866
SHA1a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA256882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
SHA512706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
-
Filesize
152B
MD54dd2754d1bea40445984d65abee82b21
SHA14b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA256183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
SHA51292d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
-
Filesize
5KB
MD5518bb8d6892bc51f724c7ded93692093
SHA1551a41e995d449b8fa00877d40f455868e9c9fc4
SHA256ea2c7b46c3363aaf0fbf908b42b1b4b1e7be05790477fdd6d93cae9ab7d68b93
SHA512d6c372c421e3c71a00ace324193ec56b4050665bbaf1f08c020a0498187fb996e363ebd441ca2de271e83c94d8d40a1b3608cd9331a3c8f0ac9c7bf77d147869
-
Filesize
6KB
MD548f6097c55b04aac950887ad45ee2028
SHA1745d889aafb5c904050ce4172b2386a48678187a
SHA2566fe47cf2d4428e473000539295b1c472db37d43c683ded37cc77426fd85cbc7e
SHA51237c7a1e0723d69f1096bfd1458e5765a0de8911a76b9905cf9615f88d91640dea440f87fd0143441df583520d22588a84526afe9917b14ede1a071a3e0e51649
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5df7ab67c9be18462cb3162051d683cfd
SHA126f7306f66597f6ce24ef97d340ffc8df93dc1ce
SHA25631af7ff75670bceab53db2f79b55913f1ca141c8dd2b7129c7af0dbc9acaebde
SHA512e7f7b513072961f905350fa9892051e0daab04ea66dcf536dece96e5ff4d7930263ca05eb23ba7a50101950daccd210d88b720e4884e4b3010c4012d54db471a