Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 07:44
Static task
static1
Behavioral task
behavioral1
Sample
127104cfff9644be820b10ea77ea3b4b_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
127104cfff9644be820b10ea77ea3b4b_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
127104cfff9644be820b10ea77ea3b4b_JaffaCakes118.html
-
Size
3KB
-
MD5
127104cfff9644be820b10ea77ea3b4b
-
SHA1
ec56e9d0782484474f4bf4cda3bb0e4ea29dce29
-
SHA256
a3af42c523ba48e8e9d68356c378224e348368e4ce5b3bbd6be18a713d7a5a7b
-
SHA512
325df5c934e917acfecca06d104402ce96287bc89d7dd9f319bbd29aa51c4e10c689b0cbf81ae2601fc25082a0113139f9f386d4a63cdc3a2400e4de3adca77a
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4016 msedge.exe 4016 msedge.exe 5032 msedge.exe 5032 msedge.exe 3648 identity_helper.exe 3648 identity_helper.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe 1232 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe 5032 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5032 wrote to memory of 4928 5032 msedge.exe 82 PID 5032 wrote to memory of 4928 5032 msedge.exe 82 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 3332 5032 msedge.exe 83 PID 5032 wrote to memory of 4016 5032 msedge.exe 84 PID 5032 wrote to memory of 4016 5032 msedge.exe 84 PID 5032 wrote to memory of 408 5032 msedge.exe 85 PID 5032 wrote to memory of 408 5032 msedge.exe 85 PID 5032 wrote to memory of 408 5032 msedge.exe 85 PID 5032 wrote to memory of 408 5032 msedge.exe 85 PID 5032 wrote to memory of 408 5032 msedge.exe 85 PID 5032 wrote to memory of 408 5032 msedge.exe 85 PID 5032 wrote to memory of 408 5032 msedge.exe 85 PID 5032 wrote to memory of 408 5032 msedge.exe 85 PID 5032 wrote to memory of 408 5032 msedge.exe 85 PID 5032 wrote to memory of 408 5032 msedge.exe 85 PID 5032 wrote to memory of 408 5032 msedge.exe 85 PID 5032 wrote to memory of 408 5032 msedge.exe 85 PID 5032 wrote to memory of 408 5032 msedge.exe 85 PID 5032 wrote to memory of 408 5032 msedge.exe 85 PID 5032 wrote to memory of 408 5032 msedge.exe 85 PID 5032 wrote to memory of 408 5032 msedge.exe 85 PID 5032 wrote to memory of 408 5032 msedge.exe 85 PID 5032 wrote to memory of 408 5032 msedge.exe 85 PID 5032 wrote to memory of 408 5032 msedge.exe 85 PID 5032 wrote to memory of 408 5032 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\127104cfff9644be820b10ea77ea3b4b_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdbe2f46f8,0x7ffdbe2f4708,0x7ffdbe2f47182⤵PID:4928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14331290250633622782,6509836960339269223,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:22⤵PID:3332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,14331290250633622782,6509836960339269223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,14331290250633622782,6509836960339269223,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:82⤵PID:408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14331290250633622782,6509836960339269223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:1700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14331290250633622782,6509836960339269223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:3888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14331290250633622782,6509836960339269223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:12⤵PID:4696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14331290250633622782,6509836960339269223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:82⤵PID:988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,14331290250633622782,6509836960339269223,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14331290250633622782,6509836960339269223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:12⤵PID:3980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14331290250633622782,6509836960339269223,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:12⤵PID:3024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14331290250633622782,6509836960339269223,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:12⤵PID:4300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,14331290250633622782,6509836960339269223,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:12⤵PID:4304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,14331290250633622782,6509836960339269223,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6064 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1232
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:644
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4396
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD553bc70ecb115bdbabe67620c416fe9b3
SHA1af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA256b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
SHA512cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
-
Filesize
152B
MD5e765f3d75e6b0e4a7119c8b14d47d8da
SHA1cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA256986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
SHA512a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
-
Filesize
505B
MD5edc72621147b3142c134bf3b8132dee0
SHA12382ace17c9c965e9b08a96262534c736610d75a
SHA256500c5b2c4f8b0464ff3614c0206347c6b5f963ab99939f3dee39261a8401fe77
SHA5120cda1fa592b47e6bbeedb551fb489da157e9d6e5e9e2dcea014ab0f2d30794d2dceeb267cec70a620cb92ca2e7ffb3c7d04a1ff8404b6bcb2dcf3a755912cfa2
-
Filesize
5KB
MD5f1d70a34854ea70c7f261e6a3d433e37
SHA1d4a15a2e2ceb50c4c37ec31562c98a62abbfec23
SHA2562e5059bd19bc2c6e56b647e738703a37c304387e485ddf955a670d36deac36e9
SHA5123a41d45adaaaf64f255ff4c251f8854b1d4a7a6355af3e93fce2fa8ec222fd4500e8bf8ebcd0df722512383f5e7a9f207fad97bf91652acbc2d5d41339ef3933
-
Filesize
6KB
MD53142a8c23658dec1ef911251b7cfa0ba
SHA1cc41f325c8506507db7c06d77fc4e64a72a0adcd
SHA256619dad998d43914e0445ce586797a63226ebccdbd4d1463f2674861b7155a61e
SHA512a9e7b842c136c97827e1d5357b7e1a14c38fa021e2a5ee23ff569f25022d55d0853c4b9ba84658ab4386bc65c20f656f2e10b8c79f987582efe69d836e5d1da4
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD592b85d01b9a84881534699866ac90632
SHA1639c31c3c1be0d79a249ee4075841d2e245f6359
SHA25637a7aa721f83f2e4bbde34009a17bb59fd39d417cd3a35ee82858306f5f51fd5
SHA5121a9ac21bdd11aba45536ed741695f35354720501cfd49e3c6eebcd84c341a1618c0c5e1509f5ff8ef6296922b4f6ac95779fef91d0bddb544f5f957325295198