Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 06:44
Static task
static1
Behavioral task
behavioral1
Sample
3e5fd95c9214fa424524384ffb6641de_JaffaCakes118.html
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3e5fd95c9214fa424524384ffb6641de_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
3e5fd95c9214fa424524384ffb6641de_JaffaCakes118.html
-
Size
53KB
-
MD5
3e5fd95c9214fa424524384ffb6641de
-
SHA1
7c898753810bdc819e45e73a3702d9ad9d1d529d
-
SHA256
68e8efabbb441ba313efa486550539c59e4361b9ceaa708cd2a42a7f29c2fd5a
-
SHA512
83014343c55e54b7b9f2444abfdfeaf8c7dd2dd9fe627ab7fd89795dbd0f6f290a5af7a0b8fd721ca6c0d58259eb48d7187a2fbea171036755bffc63c5a0a8fb
-
SSDEEP
1536:CkgUiIakTqGivi+PyUl5runlYG63Nj+q5VyvR0w2AzTICbbUoH/t9M/dNwIUEDmF:CkgUiIakTqGivi+PyU3runlYG63Nj+qi
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3896 msedge.exe 3896 msedge.exe 1200 msedge.exe 1200 msedge.exe 4240 identity_helper.exe 4240 identity_helper.exe 3648 msedge.exe 3648 msedge.exe 3648 msedge.exe 3648 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe 1200 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1200 wrote to memory of 1092 1200 msedge.exe 83 PID 1200 wrote to memory of 1092 1200 msedge.exe 83 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 1812 1200 msedge.exe 84 PID 1200 wrote to memory of 3896 1200 msedge.exe 85 PID 1200 wrote to memory of 3896 1200 msedge.exe 85 PID 1200 wrote to memory of 4692 1200 msedge.exe 86 PID 1200 wrote to memory of 4692 1200 msedge.exe 86 PID 1200 wrote to memory of 4692 1200 msedge.exe 86 PID 1200 wrote to memory of 4692 1200 msedge.exe 86 PID 1200 wrote to memory of 4692 1200 msedge.exe 86 PID 1200 wrote to memory of 4692 1200 msedge.exe 86 PID 1200 wrote to memory of 4692 1200 msedge.exe 86 PID 1200 wrote to memory of 4692 1200 msedge.exe 86 PID 1200 wrote to memory of 4692 1200 msedge.exe 86 PID 1200 wrote to memory of 4692 1200 msedge.exe 86 PID 1200 wrote to memory of 4692 1200 msedge.exe 86 PID 1200 wrote to memory of 4692 1200 msedge.exe 86 PID 1200 wrote to memory of 4692 1200 msedge.exe 86 PID 1200 wrote to memory of 4692 1200 msedge.exe 86 PID 1200 wrote to memory of 4692 1200 msedge.exe 86 PID 1200 wrote to memory of 4692 1200 msedge.exe 86 PID 1200 wrote to memory of 4692 1200 msedge.exe 86 PID 1200 wrote to memory of 4692 1200 msedge.exe 86 PID 1200 wrote to memory of 4692 1200 msedge.exe 86 PID 1200 wrote to memory of 4692 1200 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3e5fd95c9214fa424524384ffb6641de_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff91dcb46f8,0x7ff91dcb4708,0x7ff91dcb47182⤵PID:1092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,6237471700416031164,8453666990752614717,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵PID:1812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,6237471700416031164,8453666990752614717,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,6237471700416031164,8453666990752614717,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:82⤵PID:4692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6237471700416031164,8453666990752614717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:3200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6237471700416031164,8453666990752614717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:2192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6237471700416031164,8453666990752614717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:12⤵PID:4732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,6237471700416031164,8453666990752614717,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:82⤵PID:2044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,6237471700416031164,8453666990752614717,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6237471700416031164,8453666990752614717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:12⤵PID:1244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6237471700416031164,8453666990752614717,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:12⤵PID:2616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6237471700416031164,8453666990752614717,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:12⤵PID:1948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,6237471700416031164,8453666990752614717,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:12⤵PID:3992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,6237471700416031164,8453666990752614717,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1284 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3648
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3968
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1492
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d7cb450b1315c63b1d5d89d98ba22da5
SHA1694005cd9e1a4c54e0b83d0598a8a0c089df1556
SHA25638355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
SHA512df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8
-
Filesize
152B
MD537f660dd4b6ddf23bc37f5c823d1c33a
SHA11c35538aa307a3e09d15519df6ace99674ae428b
SHA2564e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
SHA512807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\573082c8-9b0e-4103-86df-df4d52182b92.tmp
Filesize6KB
MD573614ebf92b6c52cd489b810224abdb3
SHA129fa6751f4ca2a02bd78a27524b95b7fd796777b
SHA256fbff1f441aa00c59603d93cc944309460baba6cfb089b08c13681b47bebdb7bd
SHA512af7531b1017cc60231a683f216da5b82ad1e020acf51f1aa77981241e6c4449f1d240421e4ee0395b6ba9475cd1cdf0cff357747b2b071027287cee564220349
-
Filesize
6KB
MD5af3227b72377bc87325f59e4a2cc1bc4
SHA111321c81655ab3b28646742f000db9bae827bb18
SHA256d229b53f9c83cba236c1df57179d74406578003693e6ab8e91874ada356940da
SHA5122a8259998dd4eaa6fad0fc00e384e195e82cc7e3e2e0b0dd410b3e38598a60381122ff08f9508e1b165f5b6df5d384fae7dcc63378c9b6aa4282389730702ddc
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5ba86e71e931e3b85a39a6429e82cbc94
SHA1377dc4d6e47287d27a8bd51013a4689ff75dfa52
SHA2560a0bcbeeff3feb1eee247aed14d089f1b66026ca0b5ea3e27595fc290a792eaf
SHA512b09bb111fde289e31c06480ca6d8c223ee007362108210f36a97a26943424a0b0ca1a818909fbc9fd99248423a4e815e753711949984e32672eee88ab3442456