Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2024, 14:05
Static task
static1
Behavioral task
behavioral1
Sample
5c41c7086ef197ae766cad0077f93285_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5c41c7086ef197ae766cad0077f93285_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
5c41c7086ef197ae766cad0077f93285_JaffaCakes118.html
-
Size
12KB
-
MD5
5c41c7086ef197ae766cad0077f93285
-
SHA1
f3e8e9e08012c0f5b404139de8139acbc49de648
-
SHA256
80aa3a3a946d70239504f2c18dbb958cef56c77dfeb55b6ffe7374fee091f70d
-
SHA512
e56e1f83cbefcddd1c86005dea9ddd502721a3b1668a7f42483240c37b086ddbda48cf5ce2793cc6aa636a02cad5b5ec5281ce84a286cc0b624ede698245d498
-
SSDEEP
192:zsC7lFShyO22HN9FXPvDvNd/CkbBgXWvzxS54u7bdPmXQ:zEyOpN9F/vDv7/CkbBgXiwbb8XQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 640 msedge.exe 640 msedge.exe 644 msedge.exe 644 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe 1912 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe 644 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 644 wrote to memory of 4636 644 msedge.exe 84 PID 644 wrote to memory of 4636 644 msedge.exe 84 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 3504 644 msedge.exe 85 PID 644 wrote to memory of 640 644 msedge.exe 86 PID 644 wrote to memory of 640 644 msedge.exe 86 PID 644 wrote to memory of 1060 644 msedge.exe 87 PID 644 wrote to memory of 1060 644 msedge.exe 87 PID 644 wrote to memory of 1060 644 msedge.exe 87 PID 644 wrote to memory of 1060 644 msedge.exe 87 PID 644 wrote to memory of 1060 644 msedge.exe 87 PID 644 wrote to memory of 1060 644 msedge.exe 87 PID 644 wrote to memory of 1060 644 msedge.exe 87 PID 644 wrote to memory of 1060 644 msedge.exe 87 PID 644 wrote to memory of 1060 644 msedge.exe 87 PID 644 wrote to memory of 1060 644 msedge.exe 87 PID 644 wrote to memory of 1060 644 msedge.exe 87 PID 644 wrote to memory of 1060 644 msedge.exe 87 PID 644 wrote to memory of 1060 644 msedge.exe 87 PID 644 wrote to memory of 1060 644 msedge.exe 87 PID 644 wrote to memory of 1060 644 msedge.exe 87 PID 644 wrote to memory of 1060 644 msedge.exe 87 PID 644 wrote to memory of 1060 644 msedge.exe 87 PID 644 wrote to memory of 1060 644 msedge.exe 87 PID 644 wrote to memory of 1060 644 msedge.exe 87 PID 644 wrote to memory of 1060 644 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5c41c7086ef197ae766cad0077f93285_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc715846f8,0x7ffc71584708,0x7ffc715847182⤵PID:4636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,12913773602563854423,896814983719192346,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:3504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,12913773602563854423,896814983719192346,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,12913773602563854423,896814983719192346,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:82⤵PID:1060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12913773602563854423,896814983719192346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:1464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12913773602563854423,896814983719192346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:1320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12913773602563854423,896814983719192346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:12⤵PID:2396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,12913773602563854423,896814983719192346,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:82⤵PID:3704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,12913773602563854423,896814983719192346,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:82⤵PID:1476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12913773602563854423,896814983719192346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:12⤵PID:4492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12913773602563854423,896814983719192346,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:12⤵PID:4192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12913773602563854423,896814983719192346,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:12⤵PID:2488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12913773602563854423,896814983719192346,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:12⤵PID:4044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,12913773602563854423,896814983719192346,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5656 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1912
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4376
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3916
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52f842025e22e522658c640cfc7edc529
SHA14c2b24b02709acdd159f1b9bbeb396e52af27033
SHA2561191573f2a7c12f0b9b8460e06dc36ca5386305eb8c883ebbbc8eb15f4d8e23e
SHA5126e4393fd43984722229020ef662fc5981f253de31f13f30fadd6660bbc9ededcbfd163f132f6adaf42d435873322a5d0d3eea60060cf0e7f2e256262632c5d05
-
Filesize
152B
MD554aadd2d8ec66e446f1edb466b99ba8d
SHA1a94f02b035dc918d8d9a46e6886413f15be5bff0
SHA2561971045943002ef01930add9ba1a96a92ddc10d6c581ce29e33c38c2120b130e
SHA5127e077f903463da60b5587aed4f5352060df400ebda713b602b88c15cb2f91076531ea07546a9352df772656065e0bf27bd285905a60f036a5c5951076d35e994
-
Filesize
6KB
MD55533d4d51cf222af5c87de52d7bd5b89
SHA16bc46f8917974c124b1e11039d865b000c223a22
SHA25666e5eb68fd9fbcb60ddffebb10d1fe611f3cef7584a9c561f57b7a4500a28032
SHA512eeb9f5df0304dc034f36e351306e255ecd8a7a8afba08c3a65c9084b8473f0c5a5d73ca17bec739dd9a6dd339dde0fdee68f4591a185a434de110ece4406a39e
-
Filesize
5KB
MD52be62f61343c4e3913f734207e2381ae
SHA1fc39c5c45e642c9de361826af077cef570dd2a54
SHA256d2e999f0e46d8c2280b180e2f165c41c755a31edb4f484a2a09bcc6c427c2f31
SHA512c10d85235a7485d2b1e67c10fa6621d0eed5d1b768ca5294d94dd6555f251cf6b1bb5cb1ba3b02dca5bf1129a4ea33af6bf1b164bb4a99c581704275cf405a52
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5da900d40e33c77066fe7728c70547bab
SHA1bf45922892ea5a37e8a8ad1509ee55724b4e7ab0
SHA256b9114e85b00fcfe6eeb02d8c62feb6d8cfae2ca173c436594006e6072021afa1
SHA5124d69cb63c07efb54e9f12c175fe43ba040a23ebe4359ddabcf04c08581c77abe6cb89466fd62e94e8635b2f7765ddd471ad57a4952e11f194ca3b3dd2e6d22fe