Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10/07/2024, 06:36
Static task
static1
Behavioral task
behavioral1
Sample
33aef11e9defa5ae53f36db5dae4c75b_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
33aef11e9defa5ae53f36db5dae4c75b_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
33aef11e9defa5ae53f36db5dae4c75b_JaffaCakes118.html
-
Size
10KB
-
MD5
33aef11e9defa5ae53f36db5dae4c75b
-
SHA1
b1300543c1de04022548954c54bec73653d9afe6
-
SHA256
62d75e98655c076f293891f76a4ea2ffb63957c16f5379fbdd02e83f300d83e2
-
SHA512
99b6f19ff89079e25a3871db960f9efa14001b1f202832ff9ce7c5285de824395323cc1204de9f18e609d8ac06d11599a73285f27ad77198469f3dc7407f1722
-
SSDEEP
192:BRaV+K5lJqpq/UNlXzyE/GR49G2KBj0hivDVVQPViMx3Lnecucxy3DqUVMD7eC/4:BR4VkE/UNljxuKyBj0hQpyP8Mx3becud
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4928 msedge.exe 4928 msedge.exe 3768 msedge.exe 3768 msedge.exe 2236 identity_helper.exe 2236 identity_helper.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe 956 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe 3768 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3768 wrote to memory of 4352 3768 msedge.exe 82 PID 3768 wrote to memory of 4352 3768 msedge.exe 82 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 3556 3768 msedge.exe 85 PID 3768 wrote to memory of 4928 3768 msedge.exe 86 PID 3768 wrote to memory of 4928 3768 msedge.exe 86 PID 3768 wrote to memory of 872 3768 msedge.exe 87 PID 3768 wrote to memory of 872 3768 msedge.exe 87 PID 3768 wrote to memory of 872 3768 msedge.exe 87 PID 3768 wrote to memory of 872 3768 msedge.exe 87 PID 3768 wrote to memory of 872 3768 msedge.exe 87 PID 3768 wrote to memory of 872 3768 msedge.exe 87 PID 3768 wrote to memory of 872 3768 msedge.exe 87 PID 3768 wrote to memory of 872 3768 msedge.exe 87 PID 3768 wrote to memory of 872 3768 msedge.exe 87 PID 3768 wrote to memory of 872 3768 msedge.exe 87 PID 3768 wrote to memory of 872 3768 msedge.exe 87 PID 3768 wrote to memory of 872 3768 msedge.exe 87 PID 3768 wrote to memory of 872 3768 msedge.exe 87 PID 3768 wrote to memory of 872 3768 msedge.exe 87 PID 3768 wrote to memory of 872 3768 msedge.exe 87 PID 3768 wrote to memory of 872 3768 msedge.exe 87 PID 3768 wrote to memory of 872 3768 msedge.exe 87 PID 3768 wrote to memory of 872 3768 msedge.exe 87 PID 3768 wrote to memory of 872 3768 msedge.exe 87 PID 3768 wrote to memory of 872 3768 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\33aef11e9defa5ae53f36db5dae4c75b_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8d4f46f8,0x7ffa8d4f4708,0x7ffa8d4f47182⤵PID:4352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,12785829810926398403,16855150421466480287,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵PID:3556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,12785829810926398403,16855150421466480287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,12785829810926398403,16855150421466480287,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:82⤵PID:872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12785829810926398403,16855150421466480287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:4568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12785829810926398403,16855150421466480287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:1712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,12785829810926398403,16855150421466480287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:82⤵PID:836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,12785829810926398403,16855150421466480287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12785829810926398403,16855150421466480287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:12⤵PID:4800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12785829810926398403,16855150421466480287,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:12⤵PID:1688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12785829810926398403,16855150421466480287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:12⤵PID:2468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12785829810926398403,16855150421466480287,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:12⤵PID:1016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,12785829810926398403,16855150421466480287,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3000 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:956
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4884
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2972
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5c00b0d6e0f836dfa596c6df9d3b2f8f2
SHA169ad27d9b4502630728f98917f67307e9dd12a30
SHA256578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1
SHA5120e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da
-
Filesize
152B
MD554f1b76300ce15e44e5cc1a3947f5ca9
SHA1c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7
SHA25643dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24
SHA512ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a
-
Filesize
267B
MD56f68a244b6c4ff1068fe60325364c109
SHA19dab70b8e02a2c815257f5ee6ae947c91af82a70
SHA2569176cd1662f2e2ed8db5cad7affaeae41faafe6b67d3b3cc7a7710e881fde1e7
SHA5125ac2bebddf164a47cfcc92399f2b1688c03437ffcc17710894d23ee8bea3d192f052b96dc3e7d19d4a8b8e1e01e6d1ab771b0c1c54748c893c2f5e148b963422
-
Filesize
6KB
MD534a461e6d4a930e11eb9bed19ed7399d
SHA1af6a5c24f602539c823d250b2a94d563a58f6cca
SHA25623454a8851be5433f275e2088112a511097336011fbd937cf4ee6b4a4a0877ab
SHA512c0bf145bf37cf306713c3179e4f628c7bc1b1f9cd3192e28f6c1d25408557a500c5906e66853b5b9d0a67f74ebd23e4efc95f6715ec13ef98d366a8aa30e6eb0
-
Filesize
6KB
MD58eec758c5fa40c2436856d922fde6fcc
SHA11c7f3579eafd791a62c01b1e6a71c4e94d60a40b
SHA256544916d437c9678388e9db9aaf1c3c5af10e2c1623495b24455d58c8cfa2f7bd
SHA512a0e3ba81c667da3479df3742116737440f6999c14b473afd7efd5c1da30bec4a349b95760c5e1e659a2eeafefc7a1079bcf3808b5fbd6591266201dee5e0ed8c
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD51b6ddc443a4d901a69254c20f5f0669b
SHA1c192b90222cf1459ed99c3b98f4887031b2949db
SHA2564be4ac95cefcc3a4324498cac85ce173f120bdc8508ec96bedd9f176ca7051b0
SHA51207b377526ed72e00dd8d49d556320c32c014fb794216994e1c29f57a5e243c780889495f66e028c9f013dfdc17e9383585ef560f85531a00a6622f99c5852b06