Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/10/2024, 21:37
Static task
static1
Behavioral task
behavioral1
Sample
25cefeb838e55699a6b6399eaa89e133_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
25cefeb838e55699a6b6399eaa89e133_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
25cefeb838e55699a6b6399eaa89e133_JaffaCakes118.html
-
Size
52KB
-
MD5
25cefeb838e55699a6b6399eaa89e133
-
SHA1
f55b9d25cc7d57162b44071deceadf82c0e21c5f
-
SHA256
ac2b95bec54c8ce4bcfb660c64571efa14e4a988ffba1bbf266f82e1046fe1a1
-
SHA512
7f6131cb8c3dab3801eb051d19d410ed94c3b9f4266e93344240ce91e2552afb301382d6044220ab4d4262f26993d061d868d554d219832b6a36d5ee0e805fae
-
SSDEEP
1536:15DOM4esyOhFKBUMrtheE9QzWW+vsuO83G9NwXouOzltsSupuFHOM4ess:15TOhFWUMrthresb6B
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2008 msedge.exe 2008 msedge.exe 848 msedge.exe 848 msedge.exe 1680 identity_helper.exe 1680 identity_helper.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe 3340 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe 848 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 848 wrote to memory of 3248 848 msedge.exe 83 PID 848 wrote to memory of 3248 848 msedge.exe 83 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 232 848 msedge.exe 84 PID 848 wrote to memory of 2008 848 msedge.exe 85 PID 848 wrote to memory of 2008 848 msedge.exe 85 PID 848 wrote to memory of 1692 848 msedge.exe 86 PID 848 wrote to memory of 1692 848 msedge.exe 86 PID 848 wrote to memory of 1692 848 msedge.exe 86 PID 848 wrote to memory of 1692 848 msedge.exe 86 PID 848 wrote to memory of 1692 848 msedge.exe 86 PID 848 wrote to memory of 1692 848 msedge.exe 86 PID 848 wrote to memory of 1692 848 msedge.exe 86 PID 848 wrote to memory of 1692 848 msedge.exe 86 PID 848 wrote to memory of 1692 848 msedge.exe 86 PID 848 wrote to memory of 1692 848 msedge.exe 86 PID 848 wrote to memory of 1692 848 msedge.exe 86 PID 848 wrote to memory of 1692 848 msedge.exe 86 PID 848 wrote to memory of 1692 848 msedge.exe 86 PID 848 wrote to memory of 1692 848 msedge.exe 86 PID 848 wrote to memory of 1692 848 msedge.exe 86 PID 848 wrote to memory of 1692 848 msedge.exe 86 PID 848 wrote to memory of 1692 848 msedge.exe 86 PID 848 wrote to memory of 1692 848 msedge.exe 86 PID 848 wrote to memory of 1692 848 msedge.exe 86 PID 848 wrote to memory of 1692 848 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\25cefeb838e55699a6b6399eaa89e133_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8640646f8,0x7ff864064708,0x7ff8640647182⤵PID:3248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,1920144317110812893,16669910707019126569,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:22⤵PID:232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,1920144317110812893,16669910707019126569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,1920144317110812893,16669910707019126569,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:82⤵PID:1692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1920144317110812893,16669910707019126569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:3224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1920144317110812893,16669910707019126569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1920144317110812893,16669910707019126569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:12⤵PID:4232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,1920144317110812893,16669910707019126569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:82⤵PID:4924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,1920144317110812893,16669910707019126569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1920144317110812893,16669910707019126569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:12⤵PID:3676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1920144317110812893,16669910707019126569,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:12⤵PID:4080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1920144317110812893,16669910707019126569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:12⤵PID:2160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1920144317110812893,16669910707019126569,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:12⤵PID:3928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,1920144317110812893,16669910707019126569,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4928 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3340
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3124
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3904
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5c2d9eeb3fdd75834f0ac3f9767de8d6f
SHA14d16a7e82190f8490a00008bd53d85fb92e379b0
SHA2561e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66
SHA512d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd
-
Filesize
6KB
MD5a13d5da1bf37de40fb562279ec32585c
SHA148e8b957d06b0de9e3ab485f61dab9cc52c199b5
SHA256763c7a8a5eb91916322eff7b05db4dbeb227401622a3d7814206590413150ee5
SHA51260d7c17f1cf9caf9316abc3ac4e88da9b070b6fdaf6ffecc07a357d9969245121c7f1f4249300ea97666552dd8c5c41daf4113098265740c44d2fc9560297883
-
Filesize
6KB
MD5dc75e143cd5ec138e2b04b1e78a8ca77
SHA19953850265ccf5d98b6c82cd8936116e565f0ca1
SHA256f55dc4aeb78ca0eba846b6bb3ff23e7215b92ddd2ce823adc979970b74d782b0
SHA512596854a5ec34f8de9d87133206354f72a6fc10a8447bf69077f687ded95d74913d22efa8fa434185f693bf99b69c7ea7747795506644ff2dc420231951a17079
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5b2ff3d35b466be4e807e209624dd794a
SHA18ecd662667148b1baf72d3d5e8a72743194392d1
SHA256e89ec0f7cbea588ac853c45c44273ebfc02da2af5ca1f1758f187b4f9e5e1d92
SHA512c713cf493b63e7e1d544de490c090cca40fe5f3618a7baff18ff128d35544beb5aa50e75372decaa25b66b67f9030a2c817fe481c212339840037c2381858811