Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 05:28
Static task
static1
Behavioral task
behavioral1
Sample
2d92d658ab703c57640d42c02d7ed310_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2d92d658ab703c57640d42c02d7ed310_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
2d92d658ab703c57640d42c02d7ed310_JaffaCakes118.html
-
Size
460KB
-
MD5
2d92d658ab703c57640d42c02d7ed310
-
SHA1
68177ef7fcdad26a1e98fc8cdc9646b854ff558b
-
SHA256
f3e74f9036deb9bf2d80cdc68fa30fd35c363a78ba038e012dae0b2bbcb4699c
-
SHA512
af31b5377a3feb151411e2a504c4c2070838fab0cc7f12c694caa4eb910e32ad491d2cc6c8f0188470e448c36c18145fbe85addd49ab168026d2c90e81c2f648
-
SSDEEP
6144:SQsMYod+X3oI+YIQdsMYod+X3oI+YhsMYod+X3oI+YLsMYod+X3oI+YQ:v5d+X3j5d+X3f5d+X315d+X3+
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2712 msedge.exe 2712 msedge.exe 3520 msedge.exe 3520 msedge.exe 2744 identity_helper.exe 2744 identity_helper.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe 4152 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe 3520 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3520 wrote to memory of 5092 3520 msedge.exe 83 PID 3520 wrote to memory of 5092 3520 msedge.exe 83 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2708 3520 msedge.exe 84 PID 3520 wrote to memory of 2712 3520 msedge.exe 85 PID 3520 wrote to memory of 2712 3520 msedge.exe 85 PID 3520 wrote to memory of 3560 3520 msedge.exe 86 PID 3520 wrote to memory of 3560 3520 msedge.exe 86 PID 3520 wrote to memory of 3560 3520 msedge.exe 86 PID 3520 wrote to memory of 3560 3520 msedge.exe 86 PID 3520 wrote to memory of 3560 3520 msedge.exe 86 PID 3520 wrote to memory of 3560 3520 msedge.exe 86 PID 3520 wrote to memory of 3560 3520 msedge.exe 86 PID 3520 wrote to memory of 3560 3520 msedge.exe 86 PID 3520 wrote to memory of 3560 3520 msedge.exe 86 PID 3520 wrote to memory of 3560 3520 msedge.exe 86 PID 3520 wrote to memory of 3560 3520 msedge.exe 86 PID 3520 wrote to memory of 3560 3520 msedge.exe 86 PID 3520 wrote to memory of 3560 3520 msedge.exe 86 PID 3520 wrote to memory of 3560 3520 msedge.exe 86 PID 3520 wrote to memory of 3560 3520 msedge.exe 86 PID 3520 wrote to memory of 3560 3520 msedge.exe 86 PID 3520 wrote to memory of 3560 3520 msedge.exe 86 PID 3520 wrote to memory of 3560 3520 msedge.exe 86 PID 3520 wrote to memory of 3560 3520 msedge.exe 86 PID 3520 wrote to memory of 3560 3520 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2d92d658ab703c57640d42c02d7ed310_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9d0c46f8,0x7ffd9d0c4708,0x7ffd9d0c47182⤵PID:5092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,7441963372729912869,18374167283699532233,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:22⤵PID:2708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,7441963372729912869,18374167283699532233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,7441963372729912869,18374167283699532233,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:82⤵PID:3560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7441963372729912869,18374167283699532233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:4704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7441963372729912869,18374167283699532233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:1492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,7441963372729912869,18374167283699532233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:82⤵PID:4108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,7441963372729912869,18374167283699532233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7441963372729912869,18374167283699532233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:12⤵PID:4608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7441963372729912869,18374167283699532233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:12⤵PID:856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7441963372729912869,18374167283699532233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:12⤵PID:3756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,7441963372729912869,18374167283699532233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:12⤵PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,7441963372729912869,18374167283699532233,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4912 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4152
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2012
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4184
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5a652509db06b937667afa24d9727fbb6
SHA179096e2e875a2ed2b3d5f9e302cf835571cad134
SHA256cafe260fb7f11f64d4c18890ec96e10ddd0dc963bfab67c227bfc0f26e35ed21
SHA512022f24cb313ec7f485f2a427cb0d5f6deae4b6129517677fd725c093394885e0f97b3e2165d7f8b5aff2c5b50a4514b4f204e01779bc3484341f1ac7ab756b3c
-
Filesize
152B
MD51ac52e2503cc26baee4322f02f5b8d9c
SHA138e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA5127670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
-
Filesize
152B
MD5b2a1398f937474c51a48b347387ee36a
SHA1922a8567f09e68a04233e84e5919043034635949
SHA2562dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA5124a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
-
Filesize
5KB
MD50211d08911b9bfd3ae7c917a1889ab75
SHA1b9e25fe63e8b9722fca0eff7cc498e6b5de069e9
SHA25603ab7f2718815dca9594c806d962bed8b7480eb213535a9f5fb988a3f817800b
SHA512808aa038268ea82f4fec85f9a9d230392bca7dcbdfc3821bf911bca2a5c4f95b90dc6d03864a714924a45a997ce978e06afa04a3473651f1e85a8715a3694959
-
Filesize
6KB
MD50d0a7e3112c52d30db2965982810fd3e
SHA1aad39640eeff816ecedc108867856c19bdf3dcb5
SHA2565b30760fde342190f334369ab9c3f5414ca95503aa4fc4dbf5cdcccf8238fed0
SHA5124a37fc7559a3893fee3f833423e4975d6398e4aa7fd182e274dc3938e03773f74b531206ccd1663fcbb0f5ce8b76ab23cbf436a0362886ece51d01340b7491bc
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389