Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22/05/2024, 17:56
Static task
static1
Behavioral task
behavioral1
Sample
681cf10bead356fc2bc6691a44bb801f_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
681cf10bead356fc2bc6691a44bb801f_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
681cf10bead356fc2bc6691a44bb801f_JaffaCakes118.html
-
Size
4KB
-
MD5
681cf10bead356fc2bc6691a44bb801f
-
SHA1
f262aee253d323e4e27fe28fd4ee21ce20ffeff0
-
SHA256
7f5291089f3c0716135c4881dc6266bd9ec02cf34f261e8d582ae436b5e5b478
-
SHA512
f18575fee2fff2eb2fb2a4b7be5c189dddf20d7fbe624575710376b4617119c97911fb440bf9b983103ea19ca238495f5bbd0926b6a6fc54c72097e27c5c497c
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o1WqO84K:Pk7yY1aEFHVKtF37sNjtXATIQFM93pD0
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2680 msedge.exe 2680 msedge.exe 456 msedge.exe 456 msedge.exe 1812 identity_helper.exe 1812 identity_helper.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe 2536 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe 456 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 456 wrote to memory of 4784 456 msedge.exe 82 PID 456 wrote to memory of 4784 456 msedge.exe 82 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 820 456 msedge.exe 83 PID 456 wrote to memory of 2680 456 msedge.exe 84 PID 456 wrote to memory of 2680 456 msedge.exe 84 PID 456 wrote to memory of 3816 456 msedge.exe 85 PID 456 wrote to memory of 3816 456 msedge.exe 85 PID 456 wrote to memory of 3816 456 msedge.exe 85 PID 456 wrote to memory of 3816 456 msedge.exe 85 PID 456 wrote to memory of 3816 456 msedge.exe 85 PID 456 wrote to memory of 3816 456 msedge.exe 85 PID 456 wrote to memory of 3816 456 msedge.exe 85 PID 456 wrote to memory of 3816 456 msedge.exe 85 PID 456 wrote to memory of 3816 456 msedge.exe 85 PID 456 wrote to memory of 3816 456 msedge.exe 85 PID 456 wrote to memory of 3816 456 msedge.exe 85 PID 456 wrote to memory of 3816 456 msedge.exe 85 PID 456 wrote to memory of 3816 456 msedge.exe 85 PID 456 wrote to memory of 3816 456 msedge.exe 85 PID 456 wrote to memory of 3816 456 msedge.exe 85 PID 456 wrote to memory of 3816 456 msedge.exe 85 PID 456 wrote to memory of 3816 456 msedge.exe 85 PID 456 wrote to memory of 3816 456 msedge.exe 85 PID 456 wrote to memory of 3816 456 msedge.exe 85 PID 456 wrote to memory of 3816 456 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\681cf10bead356fc2bc6691a44bb801f_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff089646f8,0x7fff08964708,0x7fff089647182⤵PID:4784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,10543377877226010182,763226177328377258,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:22⤵PID:820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,10543377877226010182,763226177328377258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,10543377877226010182,763226177328377258,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:82⤵PID:3816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10543377877226010182,763226177328377258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:3244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10543377877226010182,763226177328377258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:2136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,10543377877226010182,763226177328377258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:82⤵PID:3044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,10543377877226010182,763226177328377258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10543377877226010182,763226177328377258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:12⤵PID:2164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10543377877226010182,763226177328377258,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:12⤵PID:1748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10543377877226010182,763226177328377258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:12⤵PID:3084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10543377877226010182,763226177328377258,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:12⤵PID:768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,10543377877226010182,763226177328377258,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2536
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3300
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4284
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
Filesize
292B
MD501eca3ae9e7478c371ee8a942f6663fe
SHA10d727dcc8f3e8fc80a6409545ffb89773ccb546a
SHA256a23867ea35e73d67e9b6abd43b90d249ca8e08b78fbe4c6fb4e676693451fa62
SHA512b9ab6d7dae43cc2eb30451b2ecd4ba8ab310f47057f19dca9323b521d5a276f0ce5083cd30489ca6b06d45edc47d070cafe0773a8038c612b4b02fa4133a8eb6
-
Filesize
6KB
MD53dd25b9d456fcb717266510d29a8ac77
SHA16a340d3031a6e23a19ddf4fd9852bc6466f0ba0b
SHA25614b9b33001c501450ef192a8e210ef9051c0306f9508b0fe87d0da4976700ec7
SHA5121f4f12cd739584d22a4e2c2debed35896dcd7661c796d2f67287726dde3044303c061f11ea8733928b1c89e03d10ffba9e01fcef888cf5ac80d8efaadcab6dae
-
Filesize
5KB
MD540044caa2897c0e177b0c3e238723895
SHA1c64b47b19541e03ce4e7a5c00c1f16363a5e48cd
SHA256cec617f13321f40745a697b931d6e9db78315f7862477bf25007a252f71a8e4c
SHA51263beb17e1b2d93eefc8f5edb511330b80c5425437af52ea008d018fa28cf3ecb366261bb04bc0889b41693fc4b18f0bdcbbaa677835b6cbf1f6c9f049c3c8d44
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD54fb513aef9a0ebed2fcf6d284203495f
SHA1c7f62119c06a360c36c5ef58c68a00c4fbb3326b
SHA256d8a1524c71637d6a7d88970d092f914079f4594091778573dc714e8b089d9fc8
SHA51246126a527b17ee0fd8103f2f13bace15760ac6d1b21790da5583b472e3701ca4d2b0a34013f724b705f2e279748a2348e3962b93261ea0e042f8c1bfc314b507