Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10/09/2024, 00:23
Static task
static1
Behavioral task
behavioral1
Sample
d7548f1b1a2345155fe2332602f1be75_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
d7548f1b1a2345155fe2332602f1be75_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d7548f1b1a2345155fe2332602f1be75_JaffaCakes118.html
-
Size
128KB
-
MD5
d7548f1b1a2345155fe2332602f1be75
-
SHA1
1dd4eff0b41b167ef03661ab10c3a4d6cfb58b02
-
SHA256
ab6e0d4f03eac702b8997273c9d747cd43f3391cc5477498c9fca6098ca83c1b
-
SHA512
e1f22a4347ebadcb51b991541d0d985b396278ce41ad0223ea964cf98ecbb86b7f6addc5fad06a8a5a13b3acb9b827e3ca50e47ac2ef01a55667a3c5fdd51b5b
-
SSDEEP
1536:O2+lwKpyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9w:O2+7pyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1684 msedge.exe 1684 msedge.exe 2656 msedge.exe 2656 msedge.exe 3068 identity_helper.exe 3068 identity_helper.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe 4916 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe 2656 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2680 2656 msedge.exe 86 PID 2656 wrote to memory of 2680 2656 msedge.exe 86 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 3332 2656 msedge.exe 87 PID 2656 wrote to memory of 1684 2656 msedge.exe 88 PID 2656 wrote to memory of 1684 2656 msedge.exe 88 PID 2656 wrote to memory of 4104 2656 msedge.exe 89 PID 2656 wrote to memory of 4104 2656 msedge.exe 89 PID 2656 wrote to memory of 4104 2656 msedge.exe 89 PID 2656 wrote to memory of 4104 2656 msedge.exe 89 PID 2656 wrote to memory of 4104 2656 msedge.exe 89 PID 2656 wrote to memory of 4104 2656 msedge.exe 89 PID 2656 wrote to memory of 4104 2656 msedge.exe 89 PID 2656 wrote to memory of 4104 2656 msedge.exe 89 PID 2656 wrote to memory of 4104 2656 msedge.exe 89 PID 2656 wrote to memory of 4104 2656 msedge.exe 89 PID 2656 wrote to memory of 4104 2656 msedge.exe 89 PID 2656 wrote to memory of 4104 2656 msedge.exe 89 PID 2656 wrote to memory of 4104 2656 msedge.exe 89 PID 2656 wrote to memory of 4104 2656 msedge.exe 89 PID 2656 wrote to memory of 4104 2656 msedge.exe 89 PID 2656 wrote to memory of 4104 2656 msedge.exe 89 PID 2656 wrote to memory of 4104 2656 msedge.exe 89 PID 2656 wrote to memory of 4104 2656 msedge.exe 89 PID 2656 wrote to memory of 4104 2656 msedge.exe 89 PID 2656 wrote to memory of 4104 2656 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d7548f1b1a2345155fe2332602f1be75_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xc4,0x108,0x7ffb979446f8,0x7ffb97944708,0x7ffb979447182⤵PID:2680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,16513608711772857707,9168065746987898597,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:22⤵PID:3332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,16513608711772857707,9168065746987898597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,16513608711772857707,9168065746987898597,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:82⤵PID:4104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,16513608711772857707,9168065746987898597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:12⤵PID:3356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,16513608711772857707,9168065746987898597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:3212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,16513608711772857707,9168065746987898597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:82⤵PID:1532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,16513608711772857707,9168065746987898597,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,16513608711772857707,9168065746987898597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2288 /prefetch:12⤵PID:2836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,16513608711772857707,9168065746987898597,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:12⤵PID:2408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,16513608711772857707,9168065746987898597,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:12⤵PID:872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,16513608711772857707,9168065746987898597,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:12⤵PID:944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,16513608711772857707,9168065746987898597,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4916
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3128
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5eeaa8087eba2f63f31e599f6a7b46ef4
SHA1f639519deee0766a39cfe258d2ac48e3a9d5ac03
SHA25650fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
SHA512eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
-
Filesize
152B
MD5b9569e123772ae290f9bac07e0d31748
SHA15806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA25620ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
SHA512cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
-
Filesize
6KB
MD59c7f21b64f48d1b09e441216b83d3906
SHA1a2d5752b7059c715cba3b30dc6f9b59bdb463d91
SHA25673ad311e4f641dbc864130df39db1f436d0b31bd455c1f973280558e4946101c
SHA51228fdefec60212f927a1e8be0c79f9647c96b860db641ae3c1bfcf476a4eeb190ec33097ee8274cd1946aa44af8599e9b689a99ee55c2dc02480c80be085a23b4
-
Filesize
6KB
MD57e17f875df12e91d13d3116b9be1d005
SHA11cf95e445ab8291cbba64665c0bd0e25f5571c64
SHA256d4a2f206ce64ca1ed6a32b8a699f13cc0f5bfa4a6722433f50df29f4ee42958a
SHA5120efaa4fb005dbb15bedf2658efcc9d2fc277a3e1574e444f9a44965ee6e2f9f21ba31272200c230dfda15c877572cbf25b3887025218a647dd2f24556a112236
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD514693bd6a3b73f459d3eae78ebd4ae72
SHA18554f4bd7bfb82ebdfcdbcca5f5f6ed933d43490
SHA256c2b1bb70b76d06820a6bb0f1daba68fa492421e461c4868df67574fc3184d496
SHA512dadce8acb6711350ab89b48524ee770de8aeaca9c48ac9ec67a4d6953035f10ee1760dd6b4b364c5d7e26cb6a47c3f9db9affdea93fdf6fee8f13ec8242a8d30