Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2024, 04:41
Static task
static1
Behavioral task
behavioral1
Sample
dbd4182510d80564f133ae029ed8aabe_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dbd4182510d80564f133ae029ed8aabe_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
dbd4182510d80564f133ae029ed8aabe_JaffaCakes118.html
-
Size
6KB
-
MD5
dbd4182510d80564f133ae029ed8aabe
-
SHA1
4764ec61aa94c2e3d399e7af2523cd2efb4c5516
-
SHA256
d067feaeb34e29e99f41d8cca1ab7335b6ec09fc58af0f1308826fc3124c60e9
-
SHA512
2c4e5fe1b40ee64075de5d66f55d0d9e0ffc3c70dd38405f055fb97cf58ec21dc6a7108eafdf2c00ee7454e68a9c2bdb72c101f548fdf66638891345d6ac1442
-
SSDEEP
96:B+jYWiNxKcmSnNxRdddd0V9eX2f9cRmCAIO5URf0O0QKvCi0fiGJ1DIddddOYWiV:GXoY0ayEXIBKOiAlJ1HXoY0aGlJ1NCK
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3964 msedge.exe 3964 msedge.exe 4144 msedge.exe 4144 msedge.exe 4040 identity_helper.exe 4040 identity_helper.exe 1096 msedge.exe 1096 msedge.exe 1096 msedge.exe 1096 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe 4144 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4144 wrote to memory of 3948 4144 msedge.exe 87 PID 4144 wrote to memory of 3948 4144 msedge.exe 87 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 2392 4144 msedge.exe 89 PID 4144 wrote to memory of 3964 4144 msedge.exe 90 PID 4144 wrote to memory of 3964 4144 msedge.exe 90 PID 4144 wrote to memory of 3288 4144 msedge.exe 91 PID 4144 wrote to memory of 3288 4144 msedge.exe 91 PID 4144 wrote to memory of 3288 4144 msedge.exe 91 PID 4144 wrote to memory of 3288 4144 msedge.exe 91 PID 4144 wrote to memory of 3288 4144 msedge.exe 91 PID 4144 wrote to memory of 3288 4144 msedge.exe 91 PID 4144 wrote to memory of 3288 4144 msedge.exe 91 PID 4144 wrote to memory of 3288 4144 msedge.exe 91 PID 4144 wrote to memory of 3288 4144 msedge.exe 91 PID 4144 wrote to memory of 3288 4144 msedge.exe 91 PID 4144 wrote to memory of 3288 4144 msedge.exe 91 PID 4144 wrote to memory of 3288 4144 msedge.exe 91 PID 4144 wrote to memory of 3288 4144 msedge.exe 91 PID 4144 wrote to memory of 3288 4144 msedge.exe 91 PID 4144 wrote to memory of 3288 4144 msedge.exe 91 PID 4144 wrote to memory of 3288 4144 msedge.exe 91 PID 4144 wrote to memory of 3288 4144 msedge.exe 91 PID 4144 wrote to memory of 3288 4144 msedge.exe 91 PID 4144 wrote to memory of 3288 4144 msedge.exe 91 PID 4144 wrote to memory of 3288 4144 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dbd4182510d80564f133ae029ed8aabe_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb271d46f8,0x7ffb271d4708,0x7ffb271d47182⤵PID:3948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3514322925978827795,4300836807076310842,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:2392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,3514322925978827795,4300836807076310842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,3514322925978827795,4300836807076310842,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:82⤵PID:3288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3514322925978827795,4300836807076310842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3514322925978827795,4300836807076310842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:2052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3514322925978827795,4300836807076310842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:82⤵PID:3416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3514322925978827795,4300836807076310842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3514322925978827795,4300836807076310842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:12⤵PID:2372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3514322925978827795,4300836807076310842,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:12⤵PID:3236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3514322925978827795,4300836807076310842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:12⤵PID:4412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3514322925978827795,4300836807076310842,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:12⤵PID:4588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3514322925978827795,4300836807076310842,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1872 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1096
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4728
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1148
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ab8ce148cb7d44f709fb1c460d03e1b0
SHA144d15744015155f3e74580c93317e12d2cc0f859
SHA256014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff
SHA512f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4
-
Filesize
152B
MD538f59a47b777f2fc52088e96ffb2baaf
SHA1267224482588b41a96d813f6d9e9d924867062db
SHA25613569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b
SHA5124657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b
-
Filesize
186B
MD50644ea0800b16bbc3eb3a6f28e69c016
SHA15d6d133999de7af72727b96b6e4a6d58c420f496
SHA256787a30749eba18ff2767a1c70f3769db2406ad85a7e55be56fcb54d8a2e0072b
SHA512722702a53cffc10e72525a6ed7f93b263ea92a5569b6ff8445d25aea2f0d09da975f74b223ceb64a24b91f751e92f67a66cd1a12c65ba2c35b6db1e920661621
-
Filesize
6KB
MD5a1d792d9d69c2145122582f2f9d01a05
SHA16101801ae9290342b97d3cc7313a4c346b676e80
SHA2567d9a8321f4d54efbda9de3baef4e778a2b81b27821bc31eb04973d7662887c55
SHA512da503d8a16b334ccc34715c46501aa37f008585f7f468c14fb6983e4fd1200089cdca8d24c55d832a71f518b0e93da2c55e7d63d608f7488096b972ec6d4a286
-
Filesize
6KB
MD595b5774ae5c00353d5ecea8a91fa4478
SHA1880db8a999cec9d0ef8155a3f0b5ab7b0daec0d2
SHA256ca249c4ba727aa2ae67c3a6bd6a091f309e7b7d2f700aa2effb6112d4f3de972
SHA51254e7fe0d988c51cd0bf6ebb91612296452f084fda8f42058b9f11477b539cfe80aa0aedcb32f4432e923b7d83dba8e47f7d9609c842ddb174a35500bd744391c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD514bbf1b27d05d90039b2bfd1f792601a
SHA1500675bfa3cc16f9f3d0b99f9cf03a6bc9529d0b
SHA2566fd4dd2730707daaf3b1e32e8ecfa6f42a4ea5f80d5363642ae8a3651e2c7529
SHA512aec99bbc14d6c4c9784cc20273ea46ccfa91ce6140849da105b12ebd558130331a87ddec27058ddae7652894bec5bc4171b223adff6c898d46e55654e95ff902