Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 01:29
Static task
static1
Behavioral task
behavioral1
Sample
373365f76c6a679ab2e1ef9cea9d1286_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
373365f76c6a679ab2e1ef9cea9d1286_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
373365f76c6a679ab2e1ef9cea9d1286_JaffaCakes118.html
-
Size
38KB
-
MD5
373365f76c6a679ab2e1ef9cea9d1286
-
SHA1
081d745d02a8427d782d21b301f34943b398f81b
-
SHA256
3de8d23640a2ef6fd99106531650e16c8a80a96bf24fe5ca4532f8bdb9fbe95a
-
SHA512
e8c89149b9fbcfd7b291017c92a0f74284d377998052aa926f5ace06be3adf2d0ef4a22437a7b1e7d2e27ed5776bb68ace970f441934e1e9469ac3568800f1e4
-
SSDEEP
768:FdtiEqi1ptIx3wj4jQbKD/my/XwGhuWyd:7tiET/yws0s/myfFIR
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4392 msedge.exe 4392 msedge.exe 2376 msedge.exe 2376 msedge.exe 2152 identity_helper.exe 2152 identity_helper.exe 3188 msedge.exe 3188 msedge.exe 3188 msedge.exe 3188 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe 2376 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2376 wrote to memory of 2992 2376 msedge.exe 83 PID 2376 wrote to memory of 2992 2376 msedge.exe 83 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 632 2376 msedge.exe 85 PID 2376 wrote to memory of 4392 2376 msedge.exe 86 PID 2376 wrote to memory of 4392 2376 msedge.exe 86 PID 2376 wrote to memory of 1768 2376 msedge.exe 87 PID 2376 wrote to memory of 1768 2376 msedge.exe 87 PID 2376 wrote to memory of 1768 2376 msedge.exe 87 PID 2376 wrote to memory of 1768 2376 msedge.exe 87 PID 2376 wrote to memory of 1768 2376 msedge.exe 87 PID 2376 wrote to memory of 1768 2376 msedge.exe 87 PID 2376 wrote to memory of 1768 2376 msedge.exe 87 PID 2376 wrote to memory of 1768 2376 msedge.exe 87 PID 2376 wrote to memory of 1768 2376 msedge.exe 87 PID 2376 wrote to memory of 1768 2376 msedge.exe 87 PID 2376 wrote to memory of 1768 2376 msedge.exe 87 PID 2376 wrote to memory of 1768 2376 msedge.exe 87 PID 2376 wrote to memory of 1768 2376 msedge.exe 87 PID 2376 wrote to memory of 1768 2376 msedge.exe 87 PID 2376 wrote to memory of 1768 2376 msedge.exe 87 PID 2376 wrote to memory of 1768 2376 msedge.exe 87 PID 2376 wrote to memory of 1768 2376 msedge.exe 87 PID 2376 wrote to memory of 1768 2376 msedge.exe 87 PID 2376 wrote to memory of 1768 2376 msedge.exe 87 PID 2376 wrote to memory of 1768 2376 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\373365f76c6a679ab2e1ef9cea9d1286_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff98a9546f8,0x7ff98a954708,0x7ff98a9547182⤵PID:2992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,12474916687446462972,5263675787091803594,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:22⤵PID:632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,12474916687446462972,5263675787091803594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,12474916687446462972,5263675787091803594,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:82⤵PID:1768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12474916687446462972,5263675787091803594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:2700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12474916687446462972,5263675787091803594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:4028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12474916687446462972,5263675787091803594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:12⤵PID:5020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,12474916687446462972,5263675787091803594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 /prefetch:82⤵PID:4712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,12474916687446462972,5263675787091803594,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12474916687446462972,5263675787091803594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:12⤵PID:1856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12474916687446462972,5263675787091803594,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:12⤵PID:3300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12474916687446462972,5263675787091803594,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:12⤵PID:2432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,12474916687446462972,5263675787091803594,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:12⤵PID:3316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,12474916687446462972,5263675787091803594,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5756 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3188
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3352
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5080
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5eaaad45aced1889a90a8aa4c39f92659
SHA15c0130d9e8d1a64c97924090d9a5258b8a31b83c
SHA2565e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b
SHA5120db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4
-
Filesize
152B
MD53ee50fb26a9d3f096c47ff8696c24321
SHA1a8c83e798d2a8b31fec0820560525e80dfa4fe66
SHA256d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f
SHA512479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5
-
Filesize
6KB
MD50d93dc11ffb7a0374ea2b79796c76bff
SHA16f052ece1f2286e30b9ac7e4465e1607e2760b7d
SHA256d10c1dcddec03b3696c2a2a3a7b0e25b2185778c1778df59492b26f12ac3c792
SHA5127ac2054f370583efde99db2db3b1e1131765fcf2479cefb6f64fb02b49989206b33afac86a42c0fc45edacb591f41d85534112a251af85d7b787f1f068a0d4cd
-
Filesize
6KB
MD5b88b19f34ad931a69addf62851847087
SHA14c72dd229eada07f0c787ddde416e2cbb7acff4f
SHA256114f4b45ae764d16cd189fdcd1cd007f5ebab9c609dc6b2529f332ada2450a4e
SHA5120cd42247d584e61a8ed04e4e138bacaf482fa68de0b02a78edaa1fd92c13a631a17b07bc078502cac673e8351fa167327d391e7d08c79a4e88e1c13bdf9dec9c
-
Filesize
6KB
MD58b8a2a4d7e2fe87ca85fbfade9361fa1
SHA1831a70dab1566e6138e5b78d3192972bffb164d6
SHA25669b3bfeb00e7b5aceb96ff1949511b76695b70f2995a87fbcd033fbd65130dfa
SHA512249363d172473ca356f7c0b4779dd9c000ec9bbb4fc77aed1ee2b5f76a200cff6985c12f067553ca93eb7dce1882b8b740c3af6860a4d9a1c5fd7af388f17e1e
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD52d1a0de19957722a1fe2da7f3668bc0e
SHA10a36622b3b9c41ae0577eaaeaac4346025c899e0
SHA256b35c279a18e16d84bb3e847017bb95d1fc2d116a600681eafa26eb78480d3b61
SHA512bdda125fc637ef7d8cecb37e08df3557bc6fbdeb013327b9c4716455fe4abe0d51ad29f25bf20f7b1adf78a52cc1d498866b5c78f1ef2afce461a5de87e4cb0f