Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 16:56
Static task
static1
Behavioral task
behavioral1
Sample
4a920900c2760f08efc02b166374c221_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4a920900c2760f08efc02b166374c221_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
4a920900c2760f08efc02b166374c221_JaffaCakes118.html
-
Size
1KB
-
MD5
4a920900c2760f08efc02b166374c221
-
SHA1
0d0325a8492187dc587b2f702b7a9dceb49f5029
-
SHA256
2addde6cc88cf459916c14bf81fffa83b5093ae4fb05884f4865de3eacbabab4
-
SHA512
4f5dafa7e77c3c83ed64f34d3f98a91fac6536dc0151bb552e214d011c67ed9cfea0e00291c27e59d38ec04584036730717963e09afb289824207fd98a584f41
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 864 msedge.exe 864 msedge.exe 2124 msedge.exe 2124 msedge.exe 2036 identity_helper.exe 2036 identity_helper.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe 2124 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2124 wrote to memory of 3828 2124 msedge.exe 83 PID 2124 wrote to memory of 3828 2124 msedge.exe 83 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 4824 2124 msedge.exe 85 PID 2124 wrote to memory of 864 2124 msedge.exe 86 PID 2124 wrote to memory of 864 2124 msedge.exe 86 PID 2124 wrote to memory of 4760 2124 msedge.exe 87 PID 2124 wrote to memory of 4760 2124 msedge.exe 87 PID 2124 wrote to memory of 4760 2124 msedge.exe 87 PID 2124 wrote to memory of 4760 2124 msedge.exe 87 PID 2124 wrote to memory of 4760 2124 msedge.exe 87 PID 2124 wrote to memory of 4760 2124 msedge.exe 87 PID 2124 wrote to memory of 4760 2124 msedge.exe 87 PID 2124 wrote to memory of 4760 2124 msedge.exe 87 PID 2124 wrote to memory of 4760 2124 msedge.exe 87 PID 2124 wrote to memory of 4760 2124 msedge.exe 87 PID 2124 wrote to memory of 4760 2124 msedge.exe 87 PID 2124 wrote to memory of 4760 2124 msedge.exe 87 PID 2124 wrote to memory of 4760 2124 msedge.exe 87 PID 2124 wrote to memory of 4760 2124 msedge.exe 87 PID 2124 wrote to memory of 4760 2124 msedge.exe 87 PID 2124 wrote to memory of 4760 2124 msedge.exe 87 PID 2124 wrote to memory of 4760 2124 msedge.exe 87 PID 2124 wrote to memory of 4760 2124 msedge.exe 87 PID 2124 wrote to memory of 4760 2124 msedge.exe 87 PID 2124 wrote to memory of 4760 2124 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4a920900c2760f08efc02b166374c221_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9548046f8,0x7ff954804708,0x7ff9548047182⤵PID:3828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,3316377448518971996,14578124006770529387,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:22⤵PID:4824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,3316377448518971996,14578124006770529387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,3316377448518971996,14578124006770529387,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:82⤵PID:4760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3316377448518971996,14578124006770529387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵PID:4916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3316377448518971996,14578124006770529387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:4312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3316377448518971996,14578124006770529387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:12⤵PID:544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,3316377448518971996,14578124006770529387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:82⤵PID:920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,3316377448518971996,14578124006770529387,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3316377448518971996,14578124006770529387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:12⤵PID:4152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3316377448518971996,14578124006770529387,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:12⤵PID:4732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3316377448518971996,14578124006770529387,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:12⤵PID:5000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,3316377448518971996,14578124006770529387,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:12⤵PID:4448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,3316377448518971996,14578124006770529387,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5500 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1692
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2024
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4612
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD575c9f57baeefeecd6c184627de951c1e
SHA152e0468e13cbfc9f15fc62cc27ce14367a996cff
SHA256648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f
SHA512c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15
-
Filesize
152B
MD510fa19df148444a77ceec60cabd2ce21
SHA1685b599c497668166ede4945d8885d204fd8d70f
SHA256c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b
SHA5123518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef
-
Filesize
6KB
MD5ebe6fab6df57f0bf1ab969eb488f14c0
SHA1b36df35af11c3a618096ae67516ff4c5d79b7872
SHA25655f79571c7b67f24ee5e260dc0700b1ca0a23330bc6a959d7fb8b5f8db049f64
SHA5127625e9aa84bbb91a43f179ad94c275ba8dfd1694bc29a46da9def916cdd3ec0e6d99d3b3c1b0b062b2aac69ae7cae85d37508fa933f6d2bd1c93fa0f10bab8c0
-
Filesize
6KB
MD5c3e3d945c72b7369f6337501864910b3
SHA1c6e7a9f5f68b6d637718344c55c043774cdabed4
SHA2564f3713b009b8117bb1186f32a42f1e0bd3d6e97dec4a88538c11b77895720e3e
SHA512b97aa249aa540bfef1e9c7496ed4c817c9b969bcfa6a3ebc40ccd9c2741b84cf7badb8188159221548964155dd61ccabeb17c784877b578d8d890bb70c1fd1a2
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD55d95691d1fa00498fbff5cd1ab4cdb30
SHA1db68d45fc1fae04abdf670d8bd933fe27571fa75
SHA25658073d5e3766d298602eda96d28671cca2b00a4c17ccfb60c63f0cd1a5351674
SHA512523ca18a46aa1372b2c32d4acec2e141222c2b962e755043bb2bf0f24508fccc4fa59d10fcc5b082967f1228a9b03b89a202fba95d5cefa0974c6e07dd9cb0f7