Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 01:41
Static task
static1
Behavioral task
behavioral1
Sample
37d69430b437832b79e49defe1fac2b6_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
37d69430b437832b79e49defe1fac2b6_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
37d69430b437832b79e49defe1fac2b6_JaffaCakes118.html
-
Size
26KB
-
MD5
37d69430b437832b79e49defe1fac2b6
-
SHA1
1081c0a9556662ac9e5060d3c3cf80a27a7c0083
-
SHA256
9b20e423e689c5772a2c5292ed6579f4106412ecfba5668577ec0966b6f73238
-
SHA512
0caf439ebeb74b68c44047ae08a6feb500520f1eec605d64345d845e089c59e85d5f01cefc197ef0039de8d4c790fc43c245ff42f918f8cd7aad542fb487a1b2
-
SSDEEP
384:EF+NdZ+kVgyqsJJVssXqs6ytk4xJ8gkPi9iaiaiFpOFMy9mriBmNC0mykvwiZE4a:cYLQKsDDfOVLKSzJ/s
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2748 msedge.exe 2748 msedge.exe 1272 msedge.exe 1272 msedge.exe 376 identity_helper.exe 376 identity_helper.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe 3984 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe 1272 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1272 wrote to memory of 2660 1272 msedge.exe 83 PID 1272 wrote to memory of 2660 1272 msedge.exe 83 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 3816 1272 msedge.exe 84 PID 1272 wrote to memory of 2748 1272 msedge.exe 85 PID 1272 wrote to memory of 2748 1272 msedge.exe 85 PID 1272 wrote to memory of 1428 1272 msedge.exe 86 PID 1272 wrote to memory of 1428 1272 msedge.exe 86 PID 1272 wrote to memory of 1428 1272 msedge.exe 86 PID 1272 wrote to memory of 1428 1272 msedge.exe 86 PID 1272 wrote to memory of 1428 1272 msedge.exe 86 PID 1272 wrote to memory of 1428 1272 msedge.exe 86 PID 1272 wrote to memory of 1428 1272 msedge.exe 86 PID 1272 wrote to memory of 1428 1272 msedge.exe 86 PID 1272 wrote to memory of 1428 1272 msedge.exe 86 PID 1272 wrote to memory of 1428 1272 msedge.exe 86 PID 1272 wrote to memory of 1428 1272 msedge.exe 86 PID 1272 wrote to memory of 1428 1272 msedge.exe 86 PID 1272 wrote to memory of 1428 1272 msedge.exe 86 PID 1272 wrote to memory of 1428 1272 msedge.exe 86 PID 1272 wrote to memory of 1428 1272 msedge.exe 86 PID 1272 wrote to memory of 1428 1272 msedge.exe 86 PID 1272 wrote to memory of 1428 1272 msedge.exe 86 PID 1272 wrote to memory of 1428 1272 msedge.exe 86 PID 1272 wrote to memory of 1428 1272 msedge.exe 86 PID 1272 wrote to memory of 1428 1272 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\37d69430b437832b79e49defe1fac2b6_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd56ce46f8,0x7ffd56ce4708,0x7ffd56ce47182⤵PID:2660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,16831191013560709754,9466748661624150747,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:22⤵PID:3816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,16831191013560709754,9466748661624150747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,16831191013560709754,9466748661624150747,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:82⤵PID:1428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,16831191013560709754,9466748661624150747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:2592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,16831191013560709754,9466748661624150747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:4332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,16831191013560709754,9466748661624150747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:12⤵PID:864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,16831191013560709754,9466748661624150747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:12⤵PID:884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,16831191013560709754,9466748661624150747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:12⤵PID:1020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,16831191013560709754,9466748661624150747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 /prefetch:82⤵PID:2724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,16831191013560709754,9466748661624150747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,16831191013560709754,9466748661624150747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:12⤵PID:3848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,16831191013560709754,9466748661624150747,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:12⤵PID:4936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,16831191013560709754,9466748661624150747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:12⤵PID:2956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,16831191013560709754,9466748661624150747,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:12⤵PID:5028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,16831191013560709754,9466748661624150747,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3984
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1948
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3372
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5901f4261c401fa60b903f45d84522760
SHA121c3c7ce874f4b117c711431531ed77feefd1c70
SHA256fba81e0908e3627c4da2f3e92d84edbf1593b827145c6351451b201d0c8248f1
SHA5123e11c094a66e8119fafa7fdda31310f2344ac07a97018773d79af0b9f14b67bc7bbae573d7df82e35b8c973e1495dcc4dd30e53be8f84c6cc46fad6f408b12d7
-
Filesize
152B
MD5dc058ebc0f8181946a312f0be99ed79c
SHA10c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA256378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
SHA51236e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa
-
Filesize
152B
MD5a0486d6f8406d852dd805b66ff467692
SHA177ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA256c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
SHA512065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a
-
Filesize
257B
MD51f7b6237be6c8488e470f5c521ef4329
SHA1035ac545704db0b3c2a1331f92c3053ad1bee633
SHA256ec8d2fedda61079e5d8b5b41f424afba3adafa93ee4e5d2b658101d1cfb1f236
SHA5125e08b70f7bee157ae8a709c5037c580297ec41f92a9417bfd9931f71358595918775e98e9c56f1617f3e939a02dab88a54f6d68470b13ecd902e0b57bcaa34a6
-
Filesize
6KB
MD5e9b979e0c26e8a615be73d46e2bb4f4a
SHA1006b1818b0e4c97c23e0cf34b7a564b358be2795
SHA256e2fb0d2b02ff0b56cb14a49aa1dfa7fec45dd0e99ce64621d185b31970236f4e
SHA512a2dda4f857d05205f8027c5f2c1685fa5309ae0ee966bf37ff02c056a37bc5069c1ac6e189c035149fa06122831a4c0274b4b1b7852c2c11b8c4fa41c722b891
-
Filesize
6KB
MD51e4c8c190e11bedff5169fd8abd4ba50
SHA17c9ff071611c680f723c4b2f2cc37ec0f4d58ee2
SHA25622825ce01e5218e04aa2bb2c8b4c110fde16727aca0dca1fe9d52c3362615ee0
SHA5123f741af964795035d859dccf35f6e74e7441c80a8c872712744fe3dbfb9bf0bc6e7762d78c1677bb513a663de28260a1c56d85bca09b8dbca634226e2a296f79
-
Filesize
6KB
MD53315318d3db78f458ffe5b521bcb9d2b
SHA193718c47289d2c7f2f69c4a7e44430c6b2b67af8
SHA256435b353eb1e7f91d84038bf6e2834708e9ca9be4928a318a98091c307afacb96
SHA51214611c51a84bea94efd518f7777deb6a242b33167562105255a4f00ddb1b9e02420f01e56bd5611420d691fe429e1f4bd0315cd37181a7aef66a9aebcc0bce97
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389