Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2024, 00:34
Static task
static1
Behavioral task
behavioral1
Sample
825a64adb174bc2386600937b1b1c9f6_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
825a64adb174bc2386600937b1b1c9f6_JaffaCakes118.html
Resource
win10v2004-20240730-en
General
-
Target
825a64adb174bc2386600937b1b1c9f6_JaffaCakes118.html
-
Size
100KB
-
MD5
825a64adb174bc2386600937b1b1c9f6
-
SHA1
948307f2610d68a63a65ed16c9f859fe2c1d987a
-
SHA256
2d6190ebff8752c6a54988a567a4b63bd748a18e5b3a09fd43aeda0439c28f9e
-
SHA512
2ffd6f96106ff3f696529af0a2309c7e7cff25b1c792f675f103b2bc5de17be728b18edee9e8f63f7f8e90a712c32b08dd4eb9ce3facea9b86c039c4d2e460de
-
SSDEEP
768:SoR/bLN75O4xITVmUOJvV0xtClmqm9WIqMuy/db3ZZq5vL6Kcwu7R8/o1y6:SoRtSIPJvVItCkqSPdbGL6KcgAh
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2008 msedge.exe 2008 msedge.exe 5052 msedge.exe 5052 msedge.exe 1692 identity_helper.exe 1692 identity_helper.exe 4544 msedge.exe 4544 msedge.exe 4544 msedge.exe 4544 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5052 wrote to memory of 1116 5052 msedge.exe 83 PID 5052 wrote to memory of 1116 5052 msedge.exe 83 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 1480 5052 msedge.exe 84 PID 5052 wrote to memory of 2008 5052 msedge.exe 85 PID 5052 wrote to memory of 2008 5052 msedge.exe 85 PID 5052 wrote to memory of 2964 5052 msedge.exe 86 PID 5052 wrote to memory of 2964 5052 msedge.exe 86 PID 5052 wrote to memory of 2964 5052 msedge.exe 86 PID 5052 wrote to memory of 2964 5052 msedge.exe 86 PID 5052 wrote to memory of 2964 5052 msedge.exe 86 PID 5052 wrote to memory of 2964 5052 msedge.exe 86 PID 5052 wrote to memory of 2964 5052 msedge.exe 86 PID 5052 wrote to memory of 2964 5052 msedge.exe 86 PID 5052 wrote to memory of 2964 5052 msedge.exe 86 PID 5052 wrote to memory of 2964 5052 msedge.exe 86 PID 5052 wrote to memory of 2964 5052 msedge.exe 86 PID 5052 wrote to memory of 2964 5052 msedge.exe 86 PID 5052 wrote to memory of 2964 5052 msedge.exe 86 PID 5052 wrote to memory of 2964 5052 msedge.exe 86 PID 5052 wrote to memory of 2964 5052 msedge.exe 86 PID 5052 wrote to memory of 2964 5052 msedge.exe 86 PID 5052 wrote to memory of 2964 5052 msedge.exe 86 PID 5052 wrote to memory of 2964 5052 msedge.exe 86 PID 5052 wrote to memory of 2964 5052 msedge.exe 86 PID 5052 wrote to memory of 2964 5052 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\825a64adb174bc2386600937b1b1c9f6_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9932446f8,0x7ff993244708,0x7ff9932447182⤵PID:1116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,4345378271493850089,8616339985465986956,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:22⤵PID:1480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2256,4345378271493850089,8616339985465986956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2256,4345378271493850089,8616339985465986956,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:82⤵PID:2964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,4345378271493850089,8616339985465986956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:4280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,4345378271493850089,8616339985465986956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:1736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2256,4345378271493850089,8616339985465986956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4128 /prefetch:82⤵PID:4004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2256,4345378271493850089,8616339985465986956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4128 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,4345378271493850089,8616339985465986956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:12⤵PID:3256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,4345378271493850089,8616339985465986956,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:12⤵PID:960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,4345378271493850089,8616339985465986956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:12⤵PID:4572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,4345378271493850089,8616339985465986956,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:12⤵PID:5008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,4345378271493850089,8616339985465986956,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4544
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3116
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1324
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5b55d2d2ff2a4d5d7eeaff5ebb96f3b4a
SHA112d94b9e84142b10d6347a2ff3b634a20f692c7a
SHA2563d249eae36cfc3837b043e4b8df670724fee5657b302c77d488f1da3d835f776
SHA5124dc2fe1eeaca5f9c91d548c70a44ffd12b806a385e22a3c5f724b6f749a15c9ccb3ac1a752c63225bd4d1d90f2b25d8004a15d3912ca6a3cb92fcba91248626f
-
Filesize
152B
MD594c981336abc388ca817dab46e7fc547
SHA12d0f8d89a31adb0aad5c599a195ff40ecf4b161f
SHA2564d44efbb5447fedc3cb21311290fe6a9d0e5a0e682387a1a341bd214df820ef2
SHA512f1c9c98f6642ea3b90c8667a4871d5a3b8c05eb0c50d5dc31e32704e0eeca1d33add414df485aced130523d6be824c48e37d0022b4d58db60006efe3e337fdbc
-
Filesize
185B
MD5efa3b79297b792ddfa72609e2389407a
SHA17c959b0d9c508607119d7c112fe81939169c8ccb
SHA25604371cb7276a5868761433e311d805f97da580075fc9bf1a66f0a9d8ac9a4017
SHA5121f08b7ea9823ae979382586db83b05c0d0dc5cb565b3946fb8134c0dfaaf61fdf80d6c666ceca6522964ac446d2a2e798e1f0eaff3dd2ab5cae88a793db20eaf
-
Filesize
6KB
MD5ebdd315cf0f5cd4a8206e65a6873f746
SHA1534effe21a3c57f627e05c89cfe2d2125fbcc962
SHA256c3294091063736b9fd94c1c3a7aea960145e71fb358b33dd4dc9ebef4b30dff1
SHA512078d6665930a682e9829f2e4a94a8abdaec15f15e5ef78064558021f9eb164c83d9ae90e1c24feb77c5ca3a97f78bf7f23da7c86b27ed0f42be1272a6fbf2224
-
Filesize
6KB
MD5f4b4fbc896c0369ed9288f1dbcfffe76
SHA1e2a8392b5a8544746193a6e8a744cc9bded183f7
SHA256cb583b57b5cb346ed26b48aae6e935b82b5b4eb7c96411f8ec6bd0c35d98c377
SHA512874ec80b50f83ffda8a296f6ba3efcb42e512cf655c5cfce7af3451845765857e7f40d65a897fcea295d6ecac9754c49c9d036b27b9c5d4789ec59e84b8f31eb
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5a4a1a6b905c78c5538b3dc8b6488c688
SHA1552acac19a1e26023e7062684aa81f644c37133d
SHA25681281184357ecc019329ff5fc1e2aa1d1cc611f108d8782ed69bb9aa28529068
SHA5123437f39c52f7e7daa8ce2dd1aa8fb9fb41720147e8ffa0d2e661eee71b2023f9b6a6f2e43abc17f604daccc4d1d21e70ef20f761fbe114f55de9e9a6f1d3cc09