Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 23:58
Static task
static1
Behavioral task
behavioral1
Sample
697b62fda20ea64c6bd9abafc67d1691_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
697b62fda20ea64c6bd9abafc67d1691_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
697b62fda20ea64c6bd9abafc67d1691_JaffaCakes118.html
-
Size
9KB
-
MD5
697b62fda20ea64c6bd9abafc67d1691
-
SHA1
7b7d1c42d47767f1d94f7fda9d9c37a85e56d368
-
SHA256
14fb91a8e3c89969f8f21298689604c5836734592ad748a8ce88963d4aca7c38
-
SHA512
910b850e0b810636ee063ab8675be9da82962b4c017e72b7f1ccd130bc8d23d2f35c7daa0cfe2e8adfe83ebddd90255fce38cf6610dbe13ece1ddf78d29f09ee
-
SSDEEP
96:uzVs+ux74hLLY1k9o84d12ef7CSTU3GT/kzipFHlVHcEZ7ru7f:csz74hAYS/G0dPHb76f
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3104 msedge.exe 3104 msedge.exe 2688 msedge.exe 2688 msedge.exe 4340 identity_helper.exe 4340 identity_helper.exe 5708 msedge.exe 5708 msedge.exe 5708 msedge.exe 5708 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe 2688 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2536 2688 msedge.exe 86 PID 2688 wrote to memory of 2536 2688 msedge.exe 86 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 4468 2688 msedge.exe 87 PID 2688 wrote to memory of 3104 2688 msedge.exe 88 PID 2688 wrote to memory of 3104 2688 msedge.exe 88 PID 2688 wrote to memory of 4808 2688 msedge.exe 89 PID 2688 wrote to memory of 4808 2688 msedge.exe 89 PID 2688 wrote to memory of 4808 2688 msedge.exe 89 PID 2688 wrote to memory of 4808 2688 msedge.exe 89 PID 2688 wrote to memory of 4808 2688 msedge.exe 89 PID 2688 wrote to memory of 4808 2688 msedge.exe 89 PID 2688 wrote to memory of 4808 2688 msedge.exe 89 PID 2688 wrote to memory of 4808 2688 msedge.exe 89 PID 2688 wrote to memory of 4808 2688 msedge.exe 89 PID 2688 wrote to memory of 4808 2688 msedge.exe 89 PID 2688 wrote to memory of 4808 2688 msedge.exe 89 PID 2688 wrote to memory of 4808 2688 msedge.exe 89 PID 2688 wrote to memory of 4808 2688 msedge.exe 89 PID 2688 wrote to memory of 4808 2688 msedge.exe 89 PID 2688 wrote to memory of 4808 2688 msedge.exe 89 PID 2688 wrote to memory of 4808 2688 msedge.exe 89 PID 2688 wrote to memory of 4808 2688 msedge.exe 89 PID 2688 wrote to memory of 4808 2688 msedge.exe 89 PID 2688 wrote to memory of 4808 2688 msedge.exe 89 PID 2688 wrote to memory of 4808 2688 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\697b62fda20ea64c6bd9abafc67d1691_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa89d446f8,0x7ffa89d44708,0x7ffa89d447182⤵PID:2536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,13679591872893894550,17322251472790603770,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:22⤵PID:4468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,13679591872893894550,17322251472790603770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,13679591872893894550,17322251472790603770,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:82⤵PID:4808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13679591872893894550,17322251472790603770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:4460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13679591872893894550,17322251472790603770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:1768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,13679591872893894550,17322251472790603770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:82⤵PID:2116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,13679591872893894550,17322251472790603770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13679591872893894550,17322251472790603770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:12⤵PID:2004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13679591872893894550,17322251472790603770,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:12⤵PID:4316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13679591872893894550,17322251472790603770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:12⤵PID:4668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13679591872893894550,17322251472790603770,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:12⤵PID:868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,13679591872893894550,17322251472790603770,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4108 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5708
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1148
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5c00b0d6e0f836dfa596c6df9d3b2f8f2
SHA169ad27d9b4502630728f98917f67307e9dd12a30
SHA256578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1
SHA5120e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da
-
Filesize
152B
MD554f1b76300ce15e44e5cc1a3947f5ca9
SHA1c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7
SHA25643dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24
SHA512ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a
-
Filesize
5KB
MD5311662781d7492bfaddff57af5f1c5e2
SHA1a2cb4eb9e4869d3a55f4fffbf3fc01dbf9aa7bbe
SHA256654be0259df18fc62226ac50de81f3a2d4481d51d46675b331b3c1f909573191
SHA51241fadb3a3c37ea2e57043b86e305b777a392faf5a372517f2850f851e19223aa59871f9391040481f45b550ccc3ac970215bcf8204330ea2bf6aff351d20ab80
-
Filesize
6KB
MD51744e5ce22fd9c8edf72332b915ef915
SHA13e1364c5406a9a10ff421437b3ab1b4ea007c63b
SHA25612dfbb1cdf2e72d38611dfbe1ac01e238a33f9cec00e727c9ff854bb14b29353
SHA512c4ba5981a4af29643f532c30a1de44aa077ec78e6b8a8c22b07a11be6db227a5c68f4b21990ec8fbcf70ba5832cccd734964435290d9a31479cecea2ec338f2f
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD5a8b4635ab2fdb3a528804cc4714c9f55
SHA170ebd198657a417e5c2e1bbd2571cab41b161518
SHA2565e09f9951c2c9810167c25bd2534ed665ea56f8c48bcaca4217064eda0262da2
SHA51257c8287efd5f1a6961d94c601d67bd1085cb6f8666da8ce661e424d0d0df8eff9aa1cb6bf87031302f7b202769a281a8a2132ebd38c9f04e7e7553ddffb1f2cf