Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28/04/2024, 16:02
Static task
static1
Behavioral task
behavioral1
Sample
058f8cd2c274643ecac28e3b04028acf_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
058f8cd2c274643ecac28e3b04028acf_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
058f8cd2c274643ecac28e3b04028acf_JaffaCakes118.html
-
Size
461KB
-
MD5
058f8cd2c274643ecac28e3b04028acf
-
SHA1
dc0f6db334f09149da004f715c41f09b3691394f
-
SHA256
40a797ec52e48fcd2d4fcbf1fabf6b53eb922aa81c0a468ef917e5379e5ef522
-
SHA512
4e0a4e3208ee4e246ad48e6228619b23025c1e1de8c5afa1d6b159470c5b406569dfe319bc42fbbda81168d6e4bb384201f391c1500073ac845a682bfe2c048c
-
SSDEEP
6144:SAsMYod+X3oI+Ya/sMYod+X3oI+YesMYod+X3oI+YLsMYod+X3oI+YQ:95d+X3I5d+X3C5d+X315d+X3+
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 780 msedge.exe 780 msedge.exe 3264 msedge.exe 3264 msedge.exe 3696 identity_helper.exe 3696 identity_helper.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe 3240 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe 3264 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3264 wrote to memory of 2172 3264 msedge.exe 83 PID 3264 wrote to memory of 2172 3264 msedge.exe 83 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 3184 3264 msedge.exe 84 PID 3264 wrote to memory of 780 3264 msedge.exe 85 PID 3264 wrote to memory of 780 3264 msedge.exe 85 PID 3264 wrote to memory of 2796 3264 msedge.exe 86 PID 3264 wrote to memory of 2796 3264 msedge.exe 86 PID 3264 wrote to memory of 2796 3264 msedge.exe 86 PID 3264 wrote to memory of 2796 3264 msedge.exe 86 PID 3264 wrote to memory of 2796 3264 msedge.exe 86 PID 3264 wrote to memory of 2796 3264 msedge.exe 86 PID 3264 wrote to memory of 2796 3264 msedge.exe 86 PID 3264 wrote to memory of 2796 3264 msedge.exe 86 PID 3264 wrote to memory of 2796 3264 msedge.exe 86 PID 3264 wrote to memory of 2796 3264 msedge.exe 86 PID 3264 wrote to memory of 2796 3264 msedge.exe 86 PID 3264 wrote to memory of 2796 3264 msedge.exe 86 PID 3264 wrote to memory of 2796 3264 msedge.exe 86 PID 3264 wrote to memory of 2796 3264 msedge.exe 86 PID 3264 wrote to memory of 2796 3264 msedge.exe 86 PID 3264 wrote to memory of 2796 3264 msedge.exe 86 PID 3264 wrote to memory of 2796 3264 msedge.exe 86 PID 3264 wrote to memory of 2796 3264 msedge.exe 86 PID 3264 wrote to memory of 2796 3264 msedge.exe 86 PID 3264 wrote to memory of 2796 3264 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\058f8cd2c274643ecac28e3b04028acf_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3af846f8,0x7ffe3af84708,0x7ffe3af847182⤵PID:2172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1812,2665661942641779339,1077034420947471987,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:22⤵PID:3184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1812,2665661942641779339,1077034420947471987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1812,2665661942641779339,1077034420947471987,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:82⤵PID:2796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,2665661942641779339,1077034420947471987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:2320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,2665661942641779339,1077034420947471987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:3568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1812,2665661942641779339,1077034420947471987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 /prefetch:82⤵PID:3976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1812,2665661942641779339,1077034420947471987,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,2665661942641779339,1077034420947471987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:12⤵PID:4964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,2665661942641779339,1077034420947471987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:12⤵PID:4160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,2665661942641779339,1077034420947471987,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:12⤵PID:1264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1812,2665661942641779339,1077034420947471987,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:12⤵PID:2908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1812,2665661942641779339,1077034420947471987,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4392 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3240
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3392
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2328
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dbac49e66219979194c79f1cf1cb3dd1
SHA14ef87804a04d51ae1fac358f92382548b27f62f2
SHA256f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562
SHA512bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1
-
Filesize
152B
MD5a9e55f5864d6e2afd2fd84e25a3bc228
SHA1a5efcff9e3df6252c7fe8535d505235f82aab276
SHA2560f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452
SHA51212f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75
-
Filesize
6KB
MD5e913d1e4a7582f2ab0372668fec1f4a4
SHA100cb6b7a92021694648137cc25955d7b8b7697a8
SHA256d2050f608e8cdd7a3b2dab86a5f353130478acc8ef2c8dd8c7ef5ddc9fcc34e0
SHA51220e46a66d2f9f3ce99203ac71ea5467a42958349cb2658e68d5cd527d7848ff73a3afc62b751ca0969526d30148055fc83c70eabdc35584758d3e9bc6e5e5d31
-
Filesize
6KB
MD5f267c5819c38f676674f3afc8be8eea0
SHA13ddc4e4aa69e2a228e7cb82bfcd3322288a67b7f
SHA256155792f4da09b926c58ceed3d4be5fb350b09c9bf9090293fd05835d2a0ab975
SHA5128574da50ef2020b6aca8f5d13e8da1f78a181240c61770892309cadbd6e9291f78fece87fce08afec963e72df3150443ab7a05c62f6ada6081669decb9ebecac
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
8KB
MD56c8c695d50a55a5efe504991863ba3b3
SHA1180b05c5cba4c4eadcd37fb799aa2bdaf98af8f0
SHA25679f688a19d7a3b2b5293a828d48e2aabec2daa90fca3439fcafe38bb41716c5d
SHA5128517810326357cef08a22e4b85967503ff49f2ba6f83e7f0a4e5861d25c626062548ae4c38e0347dce4bb71f802b79cc57c9f02b0cef05859c42bda51928ed93