Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 17:09
Static task
static1
Behavioral task
behavioral1
Sample
9eed70344427533bdcc512bfe7055e69_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
9eed70344427533bdcc512bfe7055e69_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9eed70344427533bdcc512bfe7055e69_JaffaCakes118.html
-
Size
18KB
-
MD5
9eed70344427533bdcc512bfe7055e69
-
SHA1
d0fa813f2583a661073708c2efc6638202f1be14
-
SHA256
311540e4ff6b1e2c8ada2a7f9f1c4e624a9f21c1d63b4afc30856dd9fcedacec
-
SHA512
97c729d0a4c7d133079b30c7916fc5c85d3b71bcb525c46ddd0277acbcac8374405e8687fe7a35c394a60966ffa95e2d1a83f2888a54f2855ecc54e1e07ec80e
-
SSDEEP
192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIf4zzUnjBhR782qDB8:SIMd0I5nO9HJsvRgxDB8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2940 msedge.exe 2940 msedge.exe 2300 msedge.exe 2300 msedge.exe 4020 identity_helper.exe 4020 identity_helper.exe 4264 msedge.exe 4264 msedge.exe 4264 msedge.exe 4264 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2300 wrote to memory of 1092 2300 msedge.exe 81 PID 2300 wrote to memory of 1092 2300 msedge.exe 81 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 4980 2300 msedge.exe 82 PID 2300 wrote to memory of 2940 2300 msedge.exe 83 PID 2300 wrote to memory of 2940 2300 msedge.exe 83 PID 2300 wrote to memory of 2848 2300 msedge.exe 84 PID 2300 wrote to memory of 2848 2300 msedge.exe 84 PID 2300 wrote to memory of 2848 2300 msedge.exe 84 PID 2300 wrote to memory of 2848 2300 msedge.exe 84 PID 2300 wrote to memory of 2848 2300 msedge.exe 84 PID 2300 wrote to memory of 2848 2300 msedge.exe 84 PID 2300 wrote to memory of 2848 2300 msedge.exe 84 PID 2300 wrote to memory of 2848 2300 msedge.exe 84 PID 2300 wrote to memory of 2848 2300 msedge.exe 84 PID 2300 wrote to memory of 2848 2300 msedge.exe 84 PID 2300 wrote to memory of 2848 2300 msedge.exe 84 PID 2300 wrote to memory of 2848 2300 msedge.exe 84 PID 2300 wrote to memory of 2848 2300 msedge.exe 84 PID 2300 wrote to memory of 2848 2300 msedge.exe 84 PID 2300 wrote to memory of 2848 2300 msedge.exe 84 PID 2300 wrote to memory of 2848 2300 msedge.exe 84 PID 2300 wrote to memory of 2848 2300 msedge.exe 84 PID 2300 wrote to memory of 2848 2300 msedge.exe 84 PID 2300 wrote to memory of 2848 2300 msedge.exe 84 PID 2300 wrote to memory of 2848 2300 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9eed70344427533bdcc512bfe7055e69_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffedb2d46f8,0x7ffedb2d4708,0x7ffedb2d47182⤵PID:1092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,17365101544888520632,208778107102029980,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:4980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,17365101544888520632,208778107102029980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,17365101544888520632,208778107102029980,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:82⤵PID:2848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17365101544888520632,208778107102029980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:2180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17365101544888520632,208778107102029980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:3896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,17365101544888520632,208778107102029980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4348 /prefetch:82⤵PID:3664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,17365101544888520632,208778107102029980,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4348 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17365101544888520632,208778107102029980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:12⤵PID:2368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17365101544888520632,208778107102029980,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:12⤵PID:4592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17365101544888520632,208778107102029980,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:12⤵PID:1532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17365101544888520632,208778107102029980,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:12⤵PID:936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,17365101544888520632,208778107102029980,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3380 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4264
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5084
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3244
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
Filesize
5KB
MD5dc9ebd29ca59e2e793b631cca3c5d2ca
SHA13cfc36ad9cd1411424a592f3ccd757ba2fc19f31
SHA2566e832471a1c7457056e83e2e7034cff351590e36c07c238b5ae2cc716b15176a
SHA51281ecbbbb60679cfaa37644d9970d91bee184b1b4c543d7edb7a83630ca81794da5b0a176733c432d106f1173762eded1484ab7ce8b6ddc7766aa215d9d7acdb4
-
Filesize
6KB
MD5230a9fc368f516f34fde1c712cb64119
SHA134d5cee644617ac025845c83dc580ca9a8a983f1
SHA256132e31501e2610e9a133e8d99e4b3a9d2ef2e27c7f972eab1b60cd0f0a5eeaf9
SHA51222326cf559a6efcd78ba5e2f54175bba88c21ce7589304ba78d18186bd75fe5256ed4d2180662f9cdb3705a832ee3e35ba0d6a597648e4de0a911b57e7817a25
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD5575cd7056f6de881fcbe90743a320604
SHA136870056a0b1b177aae777f7e071f11c90c4c23c
SHA256d44545e39d9c72120dd996b48e5801f4e6819e34d0ea26fdd5110c5c268be740
SHA5125e86ba9afbf4afb16925db3108671af0d5d45785b259d6bf336fbaef8ea99051717901a815ce04c5dfd7eb25908ff4c907cae46962d567ca0f20c98e0e9fed2c